> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/HackTricks-wiki/hacktricks/llms.txt
> Use this file to discover all available pages before exploring further.

# Search Exploits

> Tools and databases for finding known exploits and vulnerabilities for services, software versions, and CVEs — from searchsploit to Shodan, Sploitus, and more.

## Overview

Once you have identified a service and its version, the next step is to look for known public exploits. This page covers all major exploit databases and search tools.

## Search Strategy

<Steps>
  <Step title="Start with a Web Search">
    Search Google or other search engines for:

    ```
    <service_name> <version> exploit
    <service_name> <version> CVE
    <service_name> <version> RCE
    ```

    Also try the **Shodan exploit search** at [exploits.shodan.io](https://exploits.shodan.io).
  </Step>

  <Step title="Use Searchsploit (Offline Exploit-DB)">
    `searchsploit` allows you to search the Exploit-DB from the command line — useful when you have no internet access:

    ```bash theme={null}
    searchsploit "linux Kernel"              # Search by keyword
    searchsploit apache mod_ssl              # Search specific service
    searchsploit --nmap file.xml            # Search from nmap XML output
    searchsploit -m 7618                     # Copy exploit to current directory
    searchsploit -p 7618                     # Show full path
    searchsploit -x 7618                     # Open exploit in editor
    ```
  </Step>

  <Step title="Search Metasploit Modules">
    ```bash theme={null}
    msf> search platform:windows port:135 target:XP type:exploit
    msf> search name:eternal type:exploit
    msf> search cve:2021-44228
    ```
  </Step>

  <Step title="Check Aggregator Databases">
    If nothing is found in Exploit-DB, try specialized aggregators that index multiple sources.
  </Step>
</Steps>

## Exploit Databases and Resources

<CardGroup cols={2}>
  <Card title="Exploit-DB / Searchsploit" icon="database" href="https://www.exploit-db.com">
    The primary public exploit database. Use `searchsploit` for offline CLI access or browse the web interface.
  </Card>

  <Card title="Sploitus" icon="magnifying-glass" href="https://sploitus.com">
    Aggregates exploits from Exploit-DB, GitHub, and other databases with a clean unified search interface.
  </Card>

  <Card title="Vulners" icon="shield" href="https://vulners.com">
    Comprehensive vulnerability database including CVEs, exploits, and security advisories across many sources.
  </Card>

  <Card title="PacketStorm" icon="bolt" href="https://packetstormsecurity.com">
    Long-running security resource with exploits, advisories, papers, and tools not always indexed elsewhere.
  </Card>

  <Card title="Shodan Exploits" icon="globe" href="https://exploits.shodan.io">
    Search CVEs and exploits integrated with Shodan's internet scanning data.
  </Card>

  <Card title="Sploitify" icon="list" href="https://sploitify.haxx.it">
    GTFOBins-style curated list with filters by vulnerability type (LPE, RCE, etc.), service, and OS. Includes links to practice labs.
  </Card>

  <Card title="search-vulns" icon="search" href="https://search-vulns.com">
    Searches NVD, Exploit-DB, PoC-in-GitHub, GitHub Security Advisory, and endoflife.date in one query.
  </Card>

  <Card title="Pompem" icon="code" href="https://github.com/rfunix/Pompem">
    Python tool to search for exploits across multiple databases from the CLI.
  </Card>
</CardGroup>

## Specific Use Cases

### Finding Exploits from Nmap Scans

```bash theme={null}
# Run nmap and save XML output
nmap -sV -oX scan.xml <target>

# Search searchsploit against the scan results
searchsploit --nmap scan.xml
```

### Searching for CVEs by Service

```bash theme={null}
# Direct CVE search in Metasploit
msf> search cve:2023-44487  # HTTP/2 Rapid Reset
msf> search cve:2021-34527  # PrintNightmare

# Searchsploit by version
searchsploit "Apache 2.4.49"
searchsploit "OpenSSH 7.2"
```

### Verifying Exploit Reliability

When you find an exploit, consider:

1. **Date** — When was it published? Is the service version affected?
2. **Type** — Authenticated vs. unauthenticated, local vs. remote
3. **Reliability** — Is it a PoC, a weaponized exploit, or a Metasploit module?
4. **Patch status** — Has the target applied the relevant patches?

<Note>
  Always test exploits in a controlled lab environment before using them in a production penetration test. An unreliable exploit can cause service crashes or unexpected behavior that falls outside your engagement scope.
</Note>

## GitHub Exploit Repositories

Many exploits are published to GitHub before they appear in formal databases:

```bash theme={null}
# Search GitHub via Google dork
site:github.com "CVE-2024-XXXXX" exploit

# Or via GitHub search API
gh search repos "CVE-2024" --language python --sort stars
```

Platforms like `search-vulns.com` automatically index **PoC-in-GitHub** entries linked to CVE IDs, saving significant manual search time.