check-exploit

name	check-exploit
description	Search known exploit databases and sources for a given service, version, or CVE, from searchsploit to Vulners, MSF, and beyond. Trigger when the user has identified a service/version and wants to know if public exploits exist, provides a CVE ID and wants PoC or weaponized exploit references, ran nmap/banner grabbing and wants to cross-reference exploit databases, wants to know if a vulnerability is actively exploited in the wild, or is preparing a pentest report needing exploit evidence references.
license	MIT
metadata	{"version":"0.0.1","author":"Rifteo","tags":["pentest","exploit","searchsploit","CVE","recon","metasploit"]}

Check Exploit

Given a service name, version, CVE ID, or technology stack, systematically search every major exploit source in priority order and return a triage table of findings.

When NOT to use

Do NOT apply this skill — respond normally without the exploit triage format — when:

• The user is asking how to fix or remediate a vulnerability (use remediation-planner instead)
• The user is asking about compliance, framework controls, or audit findings
• The user is asking general security questions not related to finding exploits for a specific target

Input Expected

Provide at least one of:

• Service + version — e.g. Apache 2.4.49, OpenSSH 7.2, vsftpd 2.3.4
• CVE ID — e.g. CVE-2021-41773
• Technology keyword — e.g. Drupal, log4j, mod_ssl
• Nmap XML output — pass the file path; run searchsploit --nmap <file.xml> automatically

If the input is ambiguous (no version, only a product name), ask ONE clarifying question: "Do you have a specific version number or CVE?" — then proceed.

---

Phase 1 — Build the Search Query

Before querying any source, normalize the target into a consistent search string:

1. Extract: product name, version, OS/platform (if known)
2. Construct queries:
   • Exact: "Apache 2.4.49"
   • Broad: "Apache" "2.4"
   • CVE: CVE-YYYY-NNNNN (if known)
3. Identify the vulnerability class if inferable (RCE, LFI, auth bypass, privesc, DoS)

---

Phase 2 — Systematic Source Search

Start by running the automation script:

# Search by product/version
python3 scripts/multi-search.py "apache 2.4.49"

# Search by CVE
python3 scripts/multi-search.py --cve CVE-2021-41773

# Search from nmap XML output
python3 scripts/multi-search.py --nmap scan.xml

The script runs searchsploit locally, prints Metasploit commands to copy-paste, and generates direct URLs for all online sources. Use it as the starting point, then drill into each source manually for results that need further investigation.

Work through every source in references/sources.md in order. For each source, note:

• Whether results were found (yes / no / N/A)
• Exploit ID, title, and type for any match
• Whether a working PoC or weaponized exploit exists

2.1 Searchsploit (Exploit-DB — offline, fastest)

# Basic search
searchsploit "<product> <version>"
searchsploit apache 2.4.49

# Broader search (drop minor version)
searchsploit apache 2.4

# From nmap XML
searchsploit --nmap scan.xml

# Copy exploit to current directory
searchsploit -m <EDB-ID>

# Inspect without copying
searchsploit -x <EDB-ID>

# Show full path
searchsploit -p <EDB-ID>

2.2 Metasploit Search

msf> search type:exploit name:<product>
msf> search platform:linux port:22 type:exploit
msf> search cve:<YYYY-NNNNN>
msf> search platform:windows port:135 target:XP type:exploit

For each result note: module path, rank (excellent / great / good / normal / average / low), and whether it requires authentication.

2.3 Shodan CVEDB

Search by product name (sorted by EPSS — exploitation probability):

https://cvedb.shodan.io/cves?product=<product>&sort_by_epss=true

Look up a specific CVE directly (shows CVSS, EPSS, CISA KEV status, affected CPEs):

https://cvedb.shodan.io/cve/<CVE-ID>

Filter to CISA KEV entries only:

https://cvedb.shodan.io/cves?product=<product>&is_kev=true

Note: exploits.shodan.io is the legacy URL — cvedb.shodan.io is the current platform.

2.4 Vulners

Query: https://vulners.com/search?query=<product>+<version>

Vulners aggregates NVD, Exploit-DB, packetstorm, and vendor advisories. Note CVSS score, exploit availability flag, and any linked PoC.

2.5 Sploitus

Query: https://sploitus.com/?query=<product>+<version>

Sploitus searches across Exploit-DB, GitHub PoCs, and Packet Storm simultaneously. Flag any GitHub PoC links.

2.6 search_vulns

Query: https://search-vulns.com/ — search by product/version.

Aggregates NVD, Exploit-DB, PoC-in-GitHub, GitHub Security Advisory, and endoflife.date. Note if the version is end-of-life.

2.7 Sploitify

Query: https://sploitify.haxx.it — filter by vulnerability type and service type.

Use when looking for categorized exploits (LPE, RCE, Web, SMB, SSH, RDP). Note if practice lab links are available.

2.8 PacketStorm

Query: https://packetstormsecurity.com/search/?q=<product>+<version>

Use as fallback when no results found in steps 2.1–2.7. Also check for advisories and papers that may contain PoC code.

2.9 Pompem

# Install: git clone https://github.com/rfunix/Pompem
python3 pompem.py --search "<product> <version>"

Searches Exploit-DB, Packet Storm, and NVD in one pass.

2.10 Google Dork (last resort)

"<product>" "<version>" exploit site:exploit-db.com
"<product>" "<version>" exploit site:github.com
"CVE-YYYY-NNNNN" poc OR exploit OR "proof of concept"

Google Dork results are unstructured — any findings should be recorded manually in the Exploit Triage Table above rather than the Sources Checked tracker.

---

Phase 3 — Triage and Classify Results

For each exploit found, classify it:

Field	Options
Type	Remote / Local / DoS / WebApp / Privilege Escalation / Info Disclosure
Auth required	None / Low-privilege / Admin
Reliability	Weaponized (Metasploit module) / PoC published / Theoretical
Complexity	Low (works out of the box) / Medium (needs tuning) / High (partial/incomplete)
Active exploitation	Check CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Priority order for reporting:

1. Weaponized + no auth + remote → Critical
2. PoC published + no auth + remote → High
3. Auth required or local only → Medium
4. DoS or info-only → Low/Info

---

Phase 4 — Output Format

Produce exactly this structure:

---

Target: <product> <version> (OS/platform if known)

Search Query Used: <normalized query>

---

Exploit Triage Table:

Source	ID / Module	Title	Type	Auth	Reliability	Notes
Exploit-DB	EDB-XXXXX	[title]	Remote RCE	None	PoC	CVE-YYYY-NNNNN
Metasploit	exploit/unix/ftp/vsftpd_234_backdoor	[title]	Remote	None	Weaponized	Rank: excellent
GitHub	[url]	[title]	RCE	None	PoC	Actively maintained
—	—	No results	—	—	—	—

---

Highest-Severity Finding:

CVE: [CVE ID or N/A] Type: [Remote RCE / LPE / Auth Bypass / etc.] Auth Required: [Yes / No] Reliability: [Weaponized / PoC / Theoretical] CISA KEV: [Listed / Not listed] Summary: One sentence describing what the exploit does and its impact. Exploit Reference: [EDB-ID, Metasploit module path, or GitHub URL]

---

Recommended Next Steps:

1. If weaponized exploit exists → list the exact Metasploit module and usage command
2. If PoC only → describe what adaptation is needed to weaponize
3. If no exploit found → suggest version upgrade, vendor advisory, or manual testing approach
4. If CISA KEV listed → flag for immediate escalation (run python3 scripts/cisa-kev-check.py <CVE> to confirm)

---

Sources Checked:

Source	Searched	Results
Searchsploit	Yes / No	Found N / No results
Metasploit	Yes / No	Found N / No results
Shodan CVEDB	Yes / No	Found N / No results
Vulners	Yes / No	Found N / No results
Sploitus	Yes / No	Found N / No results
search_vulns	Yes / No	Found N / No results
Sploitify	Yes / No	Found N / No results
PacketStorm	Yes / No	Found N / No results
Pompem	Yes / No	Found N / No results

---

Rules

• Never invent exploit IDs, CVE numbers, or GitHub URLs — if a source is not accessible, mark it as "Not checked" and explain why
• Always report the most severe finding first, even if found in a secondary source
• If the version is end-of-life (check search_vulns / endoflife.date), flag it explicitly — EOL status elevates risk regardless of known exploits
• CISA KEV listing overrides all other severity assessments — always escalate
• Do not run exploits — this skill is for discovery and triage only
• For nmap XML input, always run searchsploit --nmap first before any other source
• Ask at most one clarifying question; never stall the search waiting for optional information

Scripts

• scripts/multi-search.py — Runs searchsploit locally and generates ready-to-open URLs for all online sources in one pass. Accepts product/version, --cve, or --nmap flags.
• scripts/cisa-kev-check.py — Fetches the CISA KEV JSON feed and checks if a CVE is listed. Caches the feed for 24 h. Supports --list-recent N to show the latest additions.

Reference Files

• references/sources.md — Full database index with direct search URLs and query syntax for each source