> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/exploitation/exploits/searching-for-exploits.md). # Searching for Exploits ### Searching for Publicly Available Exploits * After identifying a potential vulnerability within a target or a service running on a target, the next logical step will involve searching for exploit code that can be used to exploit the vulnerability. * Exploit code can easily be found online, however, it is important to note that downloading and running exploit code against a target can be quite dangerous. It is therefore recommended to analyze the exploit code closely to ensure that it works as intended. * There are a handful of legitimate and vetted exploit databases that you should use when searching for exploits online: * Exploit-db * Rapid7 DEMO [Exploit-DB ](https://www.exploit-db.com/) * Verified exploit * Local - privilege escalation * Remote - for normal exploits * search "vsftpd 2.3.4" * It has vulnerable exploits * EDB-ID is important * It contains Google Hacking Databases * Searchsploit manual [ Rapid7](https://www.rapid7.com/db/) * Rapid7 is the company that built the Metasploit Framework * search "vsftpd v2.3.4" * it shows how to configure the metasploit module to exploit the certain vulnerability Google Dorks * search vsftpd 2.3.4 site:exploit-db.com * search vsftpd 2.3.4 site: github.com [Packet Storm](https://packetstormsecurity.com/) * Shows latest vulnerabilities and PoC * It has writeups and cybersecurity news as well *** ### Searching For Exploits with SearchSploit * In certain cases, you may not have access to online exploits and as a result, you must be able to use the exploit sources available locally/offline. * The entire Exploit-db database of exploits comes pre-packaged with Kali Linux, consequently providing you with all exploits locally. * The Exploit-db offline database of exploits can be accessed and queried with a tool called SearchSploit. DEMO * Installing and updating searchsploit ``` sudo apt-get update && sudo apt-get install exploitdb -y ``` * exploit-db files location ``` ls -al /usr/share/exploitdb ``` ``` ls -al /usr/share/exploitdb/exploits/... ``` ``` searchsploit ``` * to update searchsploit exploit db packages ``` searchsploit -u ``` ``` searchsploit vsftpd ``` * to copy exploit ``` searchsploit -m / ``` * color code of the query and case-sensitive ``` searchsploit -c OpenSSH ``` * Title search ``` searchsploit -t vsftpd ``` * Exact search ``` searchsploit -e "Windows XP" ``` ``` searchsploit -e "Windows XP" | grep -e "Microsoft Windows XP" ``` * Filtering the search ``` searchsploit remote windows smb ``` ``` searchsploit remote windows buffer ``` ``` searchsploit remote linux ssh ``` ``` searchsploit remote webapps wordpress ``` ``` searchsploit local windows | grep -e "Microsoft Windows" ``` * if you want to learn more about the exploit ``` searchsploit remote windows smb -w | grep -e "EternalBlue" ``` * copy exploit ``` sudo cp /usr/share/exploitdb/exploits/windows/remote/.py ```