# Search First > Systematizes the "search for existing tools, exploits, and techniques before writing custom ones" workflow. - Skill: `brucesongs/search-first` (Agent Skill, multi-file: 13 files) - Install (CLI): `npx skillmds@latest add brucesongs/search-first` - Raw SKILL.md: https://api.skillmd.com/api/skills/brucesongs/search-first/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Productivity - Author: brucesongs (https://skillmd.com/u/brucesongs) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/brucesongs/search-first --- # Skill: Search First — Research Before You Exploit > **Supplementary Files**: > - `payloads.md` — Search templates for ExploitDB, GitHub, Metasploit, Nuclei, and Kali packages with evaluation scoring > - `test-cases.md` — Structured test cases for CVE discovery, tool discovery, technique research, and custom build decisions ## Summary Search First skill domain covering workflow operations. **Domain**: workflow ## Description Systematizes the "search for existing tools, exploits, and techniques before writing custom ones" workflow. In penetration testing, this means: before developing a custom exploit or tool, search for existing solutions in exploit databases, security tools, GitHub repositories, and community resources. This skill prevents reinventing the wheel and ensures kali-claw leverages the full ecosystem of existing security tools and known exploit techniques. ## Use Cases - Before writing a custom exploit: search Exploit-DB, GitHub, and security blogs for existing PoCs - Before building a reconnaissance tool: check if nmap scripts, Nuclei templates, or Metasploit modules already exist - Before developing a post-exploitation technique: search for existing tools and frameworks - When facing an unfamiliar technology: research known vulnerabilities and attack paths before testing - Before creating automation scripts: check if existing tools already provide the capability ## Methodology ### Search-First Decision Flow ``` ┌─────────────────────────────────────────────┐ │ 1. NEED ANALYSIS │ │ Define what capability is needed │ │ Identify target technology/constraints │ ├─────────────────────────────────────────────┤ │ 2. PARALLEL SEARCH │ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │ │ ExploitDB│ │ GitHub │ │ Security │ │ │ │ MSF/NS │ │ PoCs │ │ Blogs │ │ │ └──────────┘ └──────────┘ └──────────┘ │ ├─────────────────────────────────────────────┤ │ 3. EVALUATE │ │ Score: reliability, compatibility, │ │ OPSEC, maintenance, detection risk │ ├─────────────────────────────────────────────┤ │ 4. DECIDE │ │ ┌─────────┐ ┌──────────┐ ┌─────────┐ │ │ │ Use │ │ Modify │ │ Build │ │ │ │ as-is │ │ /Wrap │ │ Custom │ │ │ └─────────┘ └──────────┘ └─────────┘ │ ├─────────────────────────────────────────────┤ │ 5. EXECUTE │ │ Run existing tool / Modify template / │ │ Write minimal custom exploit │ └─────────────────────────────────────────────┘ ``` ### Decision Matrix | Signal | Action | |--------|--------| | Exact exploit exists for target version | **Use** — run directly, verify results | | Similar exploit exists for adjacent version | **Modify** — adapt parameters/payloads | | Multiple partial tools cover the need | **Compose** — chain existing tools together | | Nothing suitable found | **Build** — write custom, but informed by research | ### Search Sources by Category #### Exploit & Vulnerability Search ```bash # Exploit-DB local search searchsploit apache 2.4.49 remote searchsploit -x 12345 # Examine exploit code # GitHub PoC search gh search code "CVE-2025-12345" --limit 20 gh search repos " exploit" --sort stars # Metasploit module search msfconsole -x "search type:exploit name:" # Nuclei template search nuclei -tl -tags cve | grep "" ``` #### Tool & Capability Search ```bash # Kali package search apt search dpkg -l | grep # GitHub security tool search gh search repos " security tool" --sort stars --limit 20 # Exploit framework module search msfconsole -x "search type:auxiliary name:" msfconsole -x "search type:post name:" ``` #### Technique & Methodology Search ```bash # MITRE ATT&CK technique lookup # Web: https://attack.mitre.org/techniques/enterprise/ # HackTricks methodology # Web: https://book.hacktricks.wiki/ # PayloadsAllTheThings # Web: https://github.com/swisskyrepo/PayloadsAllTheThings # GTFOBins / LOLBAS # Web: https://gtfobins.github.io/ # Web: https://lolbas-project.github.io/ ``` ### Integration with Other Skills - **With `deep-research`**: Use deep-research for broad topic investigation, search-first for quick tool/exploit lookup - **With `security-bounty-hunter`**: Search for existing reports before hunting similar vulnerabilities - **With `terminal-ops`**: Execute found tools with evidence capture protocol - **With `osint`**: Combine OSINT gathering with tool search for comprehensive preparation ## Detection Methods ### Search Pattern Audit - **Anomalous query volume**: Single token consuming >10x typical search rate. - **Cross-domain correlation**: Aggregating data from many domains (OSINT signature). ### SIEM Detection Rules - **Splunk SPL**: `index=search | stats count by user | where count > 1000` ## Defense Evasion Techniques ### Stealth Search - **Distribute across accounts**: Use multiple tokens; below per-token limits. - **Slow & methodical**: Pace queries below anomaly threshold. - **Cache results**: Avoid re-querying same data. - **Mimic legitimate usage**: Use natural language queries matching typical patterns. ## Anti-Patterns - **Jumping to custom code**: Writing an exploit without checking Exploit-DB or Metasploit - **Ignoring version specificity**: Using an exploit for the wrong version without adaptation - **Over-customizing**: Wrapping a tool so heavily it loses its original capability - **Tool hoarding**: Installing every tool found instead of mastering the best one ## Examples ### Example 1: Exploit Apache Path Traversal ``` Need: Exploit path traversal in Apache 2.4.49 Search: searchsploit apache 2.4.49 path traversal Found: CVE-2021-41773, multiple PoCs on GitHub Action: USE — curl-based PoC is sufficient Result: curl "http://target/cgi-bin/.%2e/%2e%2e/etc/passwd" ``` ### Example 2: Active Directory Enumeration ``` Need: Enumerate AD domain from compromised Windows host Search: GitHub "Active Directory enumeration tool" Found: BloodHound, SharpHound, ldapsearch-ad, Certipy Action: USE — BloodHound/SharpHound is the standard Result: Run SharpHound, import to BloodHound for analysis ``` ### Example 3: TLS Reverse Shell ``` Need: Reverse shell bypassing egress filtering (only port 443) Search: GitHub "reverse shell tls encrypted" Found: Several TLS-encrypted shell tools Action: MODIFY — adapt existing TLS shell for constraint Result: Minimal custom wrapper around existing tool ``` ## Orchestration ### ECC Loop Pattern - **Pattern**: Learning Cycle (search → evaluate → decide → refine search if needed) - **Rationale**: Searching is iterative — initial searches inform subsequent queries, and results are refined based on relevance scoring until a suitable solution is found or the decision is made to build custom - **Integration**: deep-research (broad topic investigation), terminal-ops (execute found tools), continuous-learning (remember which sources are reliable per topic), docker-patterns (lab verification of found exploits) ### Cross-Skill Pipeline ``` search-first → [any attack skill] → verification-loop ↓ ↑ deep-research (broader context) continuous-learning (persist tool knowledge) ``` ### Quality Gate - Pre-condition: Need clearly defined (service/version/technique) - Post-condition: At least one result evaluated with scoring matrix, or documented decision to build custom - Verification: Selected tool/exploit tested against lab or verified against documentation