# Search Exploits

> How to systematically search for exploits and vulnerabilities for any service, software, or technology. Use this skill whenever the user mentions finding exploits, searching for vulnerabilities, penetration testing, security research, or needs to check if a service/version has known exploits. Trigger on keywords like "exploit", "vulnerability", "CVE", "searchsploit", "exploitdb", "metasploit", "penetration test", "security audit", or when investigating a specific service/version for weaknesses.

- Skill: `abelrguezr/search-exploits` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/search-exploits`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/search-exploits/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/search-exploits

---


# Search Exploits

A systematic approach to finding exploits and vulnerabilities for services, software, and technologies.

## Quick Start

When investigating a target, follow this workflow:

1. **Identify the target** - Get service name and version
2. **Search online databases** - Use multiple sources
3. **Search local databases** - Use Searchsploit if available
4. **Cross-reference findings** - Verify across multiple sources
5. **Document results** - Track what you found

## Step 1: Identify Your Target

Before searching, gather:
- Service/application name
- Version number (critical!)
- Operating system
- Any additional context (ports, protocols, etc.)

**Example:** Apache 2.4.49 on Linux, or Windows XP with SMB on port 135

## Step 2: Online Search Resources

### Google Search

The simplest and often most effective method:

```
<service_name> [version] exploit
```

**Examples:**
- `apache 2.4.49 exploit`
- `windows xp smb exploit`
- `tomcat 9.0.50 vulnerability`

**Pro tip:** Add `site:github.com` to find PoC code:
```
apache 2.4.49 exploit site:github.com
```

### Shodan Exploit Search

[https://exploits.shodan.io/](https://exploits.shodan.io)

Shodan indexes exploits from multiple sources. Search by:
- Service name
- CVE number
- Software version

### Vulners

[https://vulners.com/](https://vulners.com)

Comprehensive vulnerability database with:
- CVE details
- Exploit availability
- Proof-of-concept code
- References to other databases

### PacketStorm Security

[https://packetstormsecurity.com/](https://packetstormsecurity.com)

Good for:
- Recent exploits
- Zero-day disclosures
- Exploit collections

### Sploitus

[https://sploitus.com/](https://sploitus.com)

Searches multiple exploit databases simultaneously.

### Sploitify

[https://sploitify.haxx.it](https://sploitify.haxx.it)

Curated exploit list with filters for:
- **Vulnerability type:** Local Privilege Escalation, Remote Code Execution, etc.
- **Service type:** Web, SMB, SSH, RDP, etc.
- **Operating System:** Windows, Linux, macOS, etc.
- **Practice labs:** Links to machines for testing

### search_vulns

[https://search-vulns.com/](https://search-vulns.com)

Aggregates data from:
- NVD (National Vulnerability Database)
- Exploit-DB
- PoC-in-GitHub
- GitHub Security Advisory database
- endoflife.date

## Step 3: Local Search Tools

### Searchsploit (Exploit-DB)

If you have `searchsploit` installed (part of Exploit-DB), use these commands:

```bash
# Basic search by service
searchsploit "linux Kernel"
searchsploit apache mod_ssl

# Get exploit by ID
searchsploit -m 7618              # Download to current directory
searchsploit -p 7618[.c]          # Show complete path
searchsploit -x 7618[.c]          # Open in editor to inspect

# Search from nmap results
searchsploit --nmap file.xml      # Find vulns in nmap XML output
```

**Workflow:**
1. Run `searchsploit <service> <version>` to find matches
2. Note the exploit ID numbers
3. Use `-x` to inspect promising exploits
4. Use `-m` to download for analysis

### MSF-Search (Metasploit)

If Metasploit is available:

```bash
msfconsole
msf> search platform:windows port:135 target:XP type:exploit
msf> search apache mod_ssl
msf> search cve:2021-44228
```

**Search parameters:**
- `platform:` - Operating system
- `port:` - Service port
- `target:` - Specific target
- `type:` - exploit, auxiliary, post, etc.
- `cve:` - CVE number

### Pompem

[https://github.com/rfunix/Pompem](https://github.com/rfunix/Pompem)

Alternative tool for searching exploits.

## Step 4: Search Strategy

### When to use each resource

| Resource | Best For |
|----------|----------|
| Google | Quick initial search, finding PoC code |
| Shodan | Exploit availability, real-world instances |
| Vulners | Comprehensive CVE details |
| PacketStorm | Recent exploits, zero-days |
| Searchsploit | Local, offline searching |
| Metasploit | When you have MSF installed |
| Sploitify | Curated, filtered lists |

### Search order recommendation

1. **Start with Google** - Fast, broad coverage
2. **Check Vulners** - Get CVE details and references
3. **Use Searchsploit** - If available, for local search
4. **Cross-reference** - Verify findings across 2+ sources
5. **Download and analyze** - Review exploit code before use

## Step 5: Analyzing Results

When you find an exploit:

1. **Check the date** - Is it recent? Does it match your target version?
2. **Verify the version** - Ensure it matches your target exactly
3. **Read the description** - Understand what it does and requirements
4. **Check references** - Look for additional context
5. **Review the code** - Understand what it does before running

## Common Search Patterns

### By Service
```
<service> <version> exploit
<service> <version> vulnerability
<service> <version> CVE
```

### By CVE
```
CVE-YYYY-NNNN exploit
CVE-YYYY-NNNN poc
```

### By Technology
```
<technology> remote code execution
<technology> privilege escalation
<technology> buffer overflow
```

## Safety Notes

- **Always verify** exploit compatibility with your target
- **Test in isolated environments** before production use
- **Document your findings** for reporting
- **Follow legal guidelines** - only test systems you own or have permission to test
- **Understand the exploit** before running it

## Example Workflow

**Scenario:** You found Apache 2.4.49 on a target

1. **Google search:** `apache 2.4.49 exploit`
2. **Check Vulners:** Search for CVEs affecting 2.4.49
3. **Searchsploit:** `searchsploit apache 2.4.49`
4. **Review results:** Look for matching exploits
5. **Download:** `searchsploit -m <exploit_id>`
6. **Analyze:** Read the exploit code and requirements
7. **Test:** In isolated environment first

## Tips for Better Results

- **Be specific** - Include exact version numbers
- **Try variations** - Different search terms may yield different results
- **Check multiple sources** - One database may miss what another has
- **Look for PoC code** - GitHub often has working examples
- **Follow references** - Exploits often link to related vulnerabilities
- **Stay updated** - New exploits are published regularly

## When Nothing is Found

If searches return no results:

1. **Try broader searches** - Remove version number
2. **Check for related services** - Similar software may have shared vulnerabilities
3. **Look for configuration issues** - Not all vulnerabilities require exploits
4. **Consider manual testing** - Some vulnerabilities aren't documented
5. **Wait and check back** - New exploits may be published later