aeondave/searchsploit

SearchSploit

Offline Exploit-DB search — find public exploits by software name, version, or CVE.

Quick Start

# Install
apt install exploitdb

# Search by product
searchsploit apache 2.4

# Search by CVE
searchsploit CVE-2021-41773

# Exact phrase
searchsploit -e "remote code execution"

# Copy exploit to current dir
searchsploit -m 50383

Core Flags

| Flag | Purpose | |------|---------| | -t TERM | Search title only | | -e TERM | Exact match | | -m ID | Mirror/copy exploit file | | -p ID | Show full path | | -x ID | Examine exploit in pager | | --cve CVE | Search by CVE | | -w | Show web URL (exploitdb.com) | | --nmap FILE | Parse Nmap XML and find exploits | | -u | Update local database | | --id | Show EDB-ID |

Common Workflows

Find exploits from Nmap scan:

nmap -sV target.com -oX scan.xml
searchsploit --nmap scan.xml

Filter by type:

# Local privilege escalation only
searchsploit -t "local" apache 2.4

# Remote exploits only
searchsploit -t "remote" openssh

# Web application exploits
searchsploit -t "webapps" wordpress 5.8

JSON output (for scripting):

searchsploit --json apache 2.4 | jq '.RESULTS_EXPLOIT[] | {title: .Title, path: .Path}'

Examine and copy relevant exploit:

searchsploit -x 50383     # Read it
searchsploit -m 50383     # Copy to ./

Show web URL for online reference:

searchsploit -w openssh 8.2

Update local DB:

searchsploit -u

Tips

• Exploit-DB path on Kali: /usr/share/exploitdb/exploits/
• Cross-reference with online: https://www.exploit-db.com/exploits/<EDB-ID>
• After -m, inspect the exploit header for compilation/usage notes before running
• For Windows privesc exploits, prefer Metasploit modules over raw EDB scripts — they handle ASLR/DEP better

Resources

| File | When to load | |------|--------------| | references/exploit-notes.md | Exploit compilation, modification, and testing notes |