arsenal/searchsploit

searchsploit

offline exploit search · GPL-2.0

Command-line search over the Exploit-DB archive, so you can find and read local exploit code without leaving the terminal.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01A local copy of Exploit-DB

searchsploit searches a local clone of the Exploit-DB archive that lives on your disk, so you can look up public exploits for a given software and version offline, fast, and privately. It does not run anything; it finds and shows you exploit code and papers. The workflow is: you have identified a service and version from nmap, you want to know if a public exploit exists, and searchsploit answers in one command.

↑ contents

02Install and update

It comes with the exploitdb package. Update it regularly so the local archive keeps pace with newly published exploits.

$ sudo apt install exploitdb # Debian / Kali

$ # Gentoo / Fedora / any: git clone https://gitlab.com/exploit-database/exploitdb

$ searchsploit -u # update the local copy

03Searching by product and version

Search for the software and, importantly, the version. Version matters: an exploit for 2.4.49 may not touch 2.4.50. Use terms from the nmap -sV banner. Multiple terms are ANDed.

$ searchsploit apache 2.4.49

$ searchsploit vsftpd 2.3.4

04Reading and copying an exploit

Never run downloaded exploit code blind; read it first. -x opens an exploit for examination, -p shows its full path and copies it to the clipboard, and -m mirrors a copy into your working directory to study and adapt. Reading the code is both safer and how you learn.

$ searchsploit -x multiple/webapps/50383.sh

$ searchsploit -m unix/remote/49757.py

05Feeding it an nmap scan

searchsploit can read an nmap XML output and suggest exploits for the services it found, which bridges scanning and exploitation. Treat the suggestions as leads to verify, not confirmed vulnerabilities, because version banners can mislead.

$ nmap -sV -oX scan.xml 10.0.0.20

$ searchsploit --nmap scan.xml

↑ contents

06Searching your own stack

Turn searchsploit on your own inventory: for each service and version you run, check whether public exploit code exists. A hit means working exploit code is in every attacker's hands for that version, which moves patching it to the top of the list. This is a quick, concrete way to prioritise: not all vulnerabilities have public exploits, and the ones that do are the urgent ones.

» For every exposed service, search its exact version; a public exploit is a reason to patch now, not next cycle.

» Keep an accurate version inventory; you cannot search for exploits against software you did not know you were running.

» Reading the exploit shows you what it targets, which tells you what to monitor and what a successful attack would look like.

Research freely; deploy only against authorized targets.

↑ contents