search-exploits

name

search-exploits

description

How to systematically search for exploits and vulnerabilities for any service, software, or technology. Use this skill whenever the user mentions finding exploits, searching for vulnerabilities, penetration testing, security research, or needs to check if a service/version has known exploits. Trigger on keywords like "exploit", "vulnerability", "CVE", "searchsploit", "exploitdb", "metasploit", "penetration test", "security audit", or when investigating a specific service/version for weaknesses.

Search Exploits

A systematic approach to finding exploits and vulnerabilities for services, software, and technologies.

Quick Start

When investigating a target, follow this workflow:

1. Identify the target - Get service name and version
2. Search online databases - Use multiple sources
3. Search local databases - Use Searchsploit if available
4. Cross-reference findings - Verify across multiple sources
5. Document results - Track what you found

Step 1: Identify Your Target

Before searching, gather:

• Service/application name
• Version number (critical!)
• Operating system
• Any additional context (ports, protocols, etc.)

Example: Apache 2.4.49 on Linux, or Windows XP with SMB on port 135

Step 2: Online Search Resources

Google Search

The simplest and often most effective method:

<service_name> [version] exploit

Examples:

• apache 2.4.49 exploit
• windows xp smb exploit
• tomcat 9.0.50 vulnerability

Pro tip: Add site:github.com to find PoC code:

apache 2.4.49 exploit site:github.com

Shodan Exploit Search

https://exploits.shodan.io/

Shodan indexes exploits from multiple sources. Search by:

• Service name
• CVE number
• Software version

Vulners

https://vulners.com/

Comprehensive vulnerability database with:

• CVE details
• Exploit availability
• Proof-of-concept code
• References to other databases

PacketStorm Security

https://packetstormsecurity.com/

Good for:

• Recent exploits
• Zero-day disclosures
• Exploit collections

Sploitus

https://sploitus.com/

Searches multiple exploit databases simultaneously.

Sploitify

https://sploitify.haxx.it

Curated exploit list with filters for:

• Vulnerability type: Local Privilege Escalation, Remote Code Execution, etc.
• Service type: Web, SMB, SSH, RDP, etc.
• Operating System: Windows, Linux, macOS, etc.
• Practice labs: Links to machines for testing

search_vulns

https://search-vulns.com/

Aggregates data from:

• NVD (National Vulnerability Database)
• Exploit-DB
• PoC-in-GitHub
• GitHub Security Advisory database
• endoflife.date

Step 3: Local Search Tools

Searchsploit (Exploit-DB)

If you have searchsploit installed (part of Exploit-DB), use these commands:

# Basic search by service
searchsploit "linux Kernel"
searchsploit apache mod_ssl

# Get exploit by ID
searchsploit -m 7618              # Download to current directory
searchsploit -p 7618[.c]          # Show complete path
searchsploit -x 7618[.c]          # Open in editor to inspect

# Search from nmap results
searchsploit --nmap file.xml      # Find vulns in nmap XML output

Workflow:

1. Run searchsploit <service> <version> to find matches
2. Note the exploit ID numbers
3. Use -x to inspect promising exploits
4. Use -m to download for analysis

MSF-Search (Metasploit)

If Metasploit is available:

msfconsole
msf> search platform:windows port:135 target:XP type:exploit
msf> search apache mod_ssl
msf> search cve:2021-44228

Search parameters:

• platform: - Operating system
• port: - Service port
• target: - Specific target
• type: - exploit, auxiliary, post, etc.
• cve: - CVE number

Pompem

https://github.com/rfunix/Pompem

Alternative tool for searching exploits.

Step 4: Search Strategy

When to use each resource

Resource	Best For
Google	Quick initial search, finding PoC code
Shodan	Exploit availability, real-world instances
Vulners	Comprehensive CVE details
PacketStorm	Recent exploits, zero-days
Searchsploit	Local, offline searching
Metasploit	When you have MSF installed
Sploitify	Curated, filtered lists

Search order recommendation

1. Start with Google - Fast, broad coverage
2. Check Vulners - Get CVE details and references
3. Use Searchsploit - If available, for local search
4. Cross-reference - Verify findings across 2+ sources
5. Download and analyze - Review exploit code before use

Step 5: Analyzing Results

When you find an exploit:

1. Check the date - Is it recent? Does it match your target version?
2. Verify the version - Ensure it matches your target exactly
3. Read the description - Understand what it does and requirements
4. Check references - Look for additional context
5. Review the code - Understand what it does before running

Common Search Patterns

By Service

<service> <version> exploit
<service> <version> vulnerability
<service> <version> CVE

By CVE

CVE-YYYY-NNNN exploit
CVE-YYYY-NNNN poc

By Technology

<technology> remote code execution
<technology> privilege escalation
<technology> buffer overflow

Safety Notes

• Always verify exploit compatibility with your target
• Test in isolated environments before production use
• Document your findings for reporting
• Follow legal guidelines - only test systems you own or have permission to test
• Understand the exploit before running it

Example Workflow

Scenario: You found Apache 2.4.49 on a target

1. Google search: apache 2.4.49 exploit
2. Check Vulners: Search for CVEs affecting 2.4.49
3. Searchsploit: searchsploit apache 2.4.49
4. Review results: Look for matching exploits
5. Download: searchsploit -m <exploit_id>
6. Analyze: Read the exploit code and requirements
7. Test: In isolated environment first

Tips for Better Results

• Be specific - Include exact version numbers
• Try variations - Different search terms may yield different results
• Check multiple sources - One database may miss what another has
• Look for PoC code - GitHub often has working examples
• Follow references - Exploits often link to related vulnerabilities
• Stay updated - New exploits are published regularly

When Nothing is Found

If searches return no results:

1. Try broader searches - Remove version number
2. Check for related services - Similar software may have shared vulnerabilities
3. Look for configuration issues - Not all vulnerabilities require exploits
4. Consider manual testing - Some vulnerabilities aren't documented
5. Wait and check back - New exploits may be published later