# Vuln Research

> Auth/lab ref: Exploit research workflow: a target software version or CVE: triage CVSS severity, find public PoCs on NVD/sploitus/PoC-in-GitHub/ExploitDB, assess exploitability, and locate Metasploit modules.

- Skill: `aeondave/vuln-research` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aeondave/vuln-research`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/vuln-research/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/vuln-research

---


# Vuln Research

Exploit research workflow — from software version to working exploit.

## Triage Order

1. Identify exact software + version
2. Search NVD for CVEs
3. Check CVSS score — prioritize Critical (9.0+) / High (7.0+)
4. Find PoC / exploit
5. Assess exploitability (auth required, network access, mitigations)
6. Run exploit or look for Metasploit module

## Step 1 — Identify Version

```bash
# On target — common version fingerprinting
uname -r                          # Kernel
lsb_release -a                    # Linux distro
apache2 -v / nginx -v             # Web server
php --version                     # PHP
mysql --version                   # MySQL
python3 --version
dpkg -l | grep <package>          # Debian package version
rpm -qa | grep <package>          # RHEL/CentOS
```

## Step 2 — CVE Lookup

### NVD (authoritative)

```
https://nvd.nist.gov/vuln/search?query=<product>+<version>
```

### CLI via nvdlib (Python)

```bash
pip install nvdlib
python3 -c "
import nvdlib
cves = nvdlib.searchCVE(keywordSearch='apache 2.4.49', limit=10)
for c in cves:
    print(c.id, c.score, c.descriptions[0].value[:120])
"
```

### Via curl (NVD API v2)

```bash
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=OpenSSH+8.2&resultsPerPage=5" \
  | jq '.vulnerabilities[].cve | {id: .id, score: .metrics.cvssMetricV31[0].cvssData.baseScore, desc: .descriptions[0].value[:100]}'
```

## Step 3 — CVSS Triage

| Score | Severity | Action |
|-------|----------|--------|
| 9.0–10.0 | Critical | Exploit immediately — likely weaponized |
| 7.0–8.9 | High | Check for PoC; often exploitable |
| 4.0–6.9 | Medium | Exploit if conditions met (auth, local) |
| 0.1–3.9 | Low | Deprioritize |

Key CVSS vectors to check:
- **AV:N** (Network) — remotely exploitable; highest value
- **PR:N** (No Privileges Required) — unauthenticated
- **UI:N** (No User Interaction) — autonomous exploitation
- **S:C** (Scope Changed) — impact beyond vulnerable component

## Step 4 — Find Public Exploit / PoC

### Sploitus (aggregates ExploitDB + PacketStorm + GitHub PoCs)

```
https://sploitus.com/?query=<CVE-ID>
https://sploitus.com/?query=<product>+<version>
```

### PoC-in-GitHub

```bash
# Search GitHub for PoCs
curl -s "https://poc-in-github.motikan2010.net/api/v1/?cve_id=CVE-2021-44228" | jq '.pocs[]'
```

```
https://github.com/search?q=CVE-2021-44228+PoC&type=repositories&sort=updated
```

### SearchSploit (offline)

```bash
searchsploit <product> <version>
searchsploit --cve <CVE-ID>
```

### Exploit-DB (online)

```
https://www.exploit-db.com/search?cve=<CVE-ID>
```

### Packetstorm

```
https://packetstormsecurity.com/search/?q=<CVE-ID>
```

### Vulhub (Docker PoC environments)

```
https://github.com/vulhub/vulhub/tree/master/<product>/<CVE>
# Ready-to-deploy Docker lab for the vulnerability
```

## Step 5 — Check Metasploit Module

```bash
msfconsole -q -x "search cve:<CVE-ID>; exit"
msfconsole -q -x "search type:exploit name:<product>; exit"
```

If a Metasploit module exists: prefer it over raw PoC — handles payload staging, bad chars, encoders.

## Step 6 — Assess Exploitability

Before running:

```bash
# Check if target version is actually vulnerable
# Many PoCs have specific minor version requirements

# Linux: ASLR
cat /proc/sys/kernel/randomize_va_space   # 2=full, 1=partial, 0=off

# Linux: mitigations
cat /proc/cpuinfo | grep -E 'flags|bugs'  # spectre/meltdown status

# Windows: check patch level (if access)
systeminfo | findstr /B /C:"OS Version" /C:"Hotfix(s)"

# Network: verify service version matches
nmap -sV -p <port> <target>
```

## Quick Reference: Notable CVEs by Category

| Category | CVE | Product | Impact |
|----------|-----|---------|--------|
| RCE | CVE-2021-44228 | Log4j 2.x | JNDI injection, AV:N/PR:N |
| RCE | CVE-2021-41773 | Apache 2.4.49 | Path traversal + RCE |
| LPE | CVE-2022-0847 | Linux kernel 5.8-5.16 | Dirty Pipe, overwrite RO files |
| LPE | CVE-2021-4034 | Polkit pkexec | Local root |
| RCE | CVE-2017-0144 | Windows SMB | EternalBlue, wormable |
| RCE | CVE-2019-0708 | Windows RDP | BlueKeep, pre-auth |
| RCE | CVE-2021-26855 | Exchange | ProxyLogon, SSRF |
| Auth bypass | CVE-2020-1472 | Netlogon | Zerologon |

## Resources

| File | When to load |
|------|--------------|
| `references/sources.md` | Full source list, API references, CVSS vector decoder |