Searching Exploit-DB
Purpose
Find public Exploit-DB entries reproducibly, then assess whether each entry is relevant to the user's product and environment. An Exploit-DB match proves that a public PoC exists; it does not prove that a target is vulnerable or that the PoC is safe to run.
Workflow
Use the bundled read-only helper on Windows or when searchsploit is unavailable:
python searching-exploit-db\scripts\search_exploit_db.py --cve CVE-2021-44228
python searching-exploit-db\scripts\search_exploit_db.py --edb-id 50592 --format json
python searching-exploit-db\scripts\search_exploit_db.py --query "Apache Log4j remote"
The helper reads the official files_exploits.csv from the Exploit-DB GitLab repository. Pass --csv <path> to use a local clone or saved CSV. On systems with SearchSploit, searchsploit --cve 2021-44228 -j is also appropriate.
For screenshots, tags, setup files, and vulnerability mappings absent from the CSV, inspect the corresponding https://www.exploit-db.com/exploits/<EDB-ID> page.
Assess Applicability
For every candidate:
- Confirm the CVE and affected versions with the current vendor advisory, CVE record, or NVD; recommend the vendor's current supported remediation, not merely the first historical fixed release.
- Compare product, exact version, architecture, attack type, prerequisites, authentication, and network position. Distinguish the vulnerable target OS, the PoC's supported target platform, and the host used to run the PoC.
- Report Exploit-DB's
verified value without treating it as a guarantee.
- State missing facts and distinguish
direct match, possibly relevant, and not applicable.
Do not download, compile, or execute a PoC as part of lookup. If the user asks to test one, confirm the target is owned or explicitly authorized and use the appropriate assessment skill.
Outputs
Return:
| Field |
Content |
| Query |
Normalized CVE, EDB-ID, or terms |
| Matches |
EDB-ID, title, platform/type, date, verified status, URL |
| Applicability |
Direct, possible, or not applicable with reasons |
| Validation |
Linked Exploit-DB page plus vendor/CVE advisory and affected-version evidence |
| Caveats |
Preconditions, missing evidence, and safe next step |
Include the CSV source and retrieval time so a changing main branch result can be traced.
If there is no match, say that Exploit-DB has no indexed result; do not claim that no public exploit exists elsewhere.
Anti-Patterns
- Matching a CVE by substring instead of the exact
codes token.
- Treating an EDB entry as authoritative affected-version data.
- Selecting a PoC by title while ignoring platform or prerequisites.
- Equating
Not verified with false, or Verified with universally reliable.
1---2name: searching-exploit-db3description: Use when looking up CVE identifiers, EDB-IDs, public exploit references, or product/version matches in Exploit-DB for vulnerability research or authorized security assessment.4---56# Searching Exploit-DB78## Purpose910Find public Exploit-DB entries reproducibly, then assess whether each entry is relevant to the user's product and environment. An Exploit-DB match proves that a public PoC exists; it does not prove that a target is vulnerable or that the PoC is safe to run.1112## Workflow1314Use the bundled read-only helper on Windows or when `searchsploit` is unavailable:1516```powershell17python searching-exploit-db\scripts\search_exploit_db.py --cve CVE-2021-4422818python searching-exploit-db\scripts\search_exploit_db.py --edb-id 50592 --format json19python searching-exploit-db\scripts\search_exploit_db.py --query "Apache Log4j remote"20```2122The helper reads the official `files_exploits.csv` from the Exploit-DB GitLab repository. Pass `--csv <path>` to use a local clone or saved CSV. On systems with SearchSploit, `searchsploit --cve 2021-44228 -j` is also appropriate.2324For screenshots, tags, setup files, and vulnerability mappings absent from the CSV, inspect the corresponding `https://www.exploit-db.com/exploits/<EDB-ID>` page.2526## Assess Applicability2728For every candidate:29301. Confirm the CVE and affected versions with the current vendor advisory, CVE record, or NVD; recommend the vendor's current supported remediation, not merely the first historical fixed release.312. Compare product, exact version, architecture, attack type, prerequisites, authentication, and network position. Distinguish the vulnerable target OS, the PoC's supported target platform, and the host used to run the PoC.323. Report Exploit-DB's `verified` value without treating it as a guarantee.334. State missing facts and distinguish `direct match`, `possibly relevant`, and `not applicable`.3435Do not download, compile, or execute a PoC as part of lookup. If the user asks to test one, confirm the target is owned or explicitly authorized and use the appropriate assessment skill.3637## Outputs3839Return:4041| Field | Content |42|---|---|43| Query | Normalized CVE, EDB-ID, or terms |44| Matches | EDB-ID, title, platform/type, date, verified status, URL |45| Applicability | Direct, possible, or not applicable with reasons |46| Validation | Linked Exploit-DB page plus vendor/CVE advisory and affected-version evidence |47| Caveats | Preconditions, missing evidence, and safe next step |4849Include the CSV source and retrieval time so a changing `main` branch result can be traced.5051If there is no match, say that Exploit-DB has no indexed result; do not claim that no public exploit exists elsewhere.5253## Anti-Patterns5455- Matching a CVE by substring instead of the exact `codes` token.56- Treating an EDB entry as authoritative affected-version data.57- Selecting a PoC by title while ignoring platform or prerequisites.58- Equating `Not verified` with false, or `Verified` with universally reliable.
ptn1411