Searchsploit Cheat Sheet
Searchsploit an exploit search tool by Offensive Security, Unix Ninja & G0tmi1k. It allows you to take a copy of Exploit Database with you. SearchSploit gives you the power to perform detailed off-line searches through your locally checked-out copy of the repository. This capability is particularly useful for security assessments on segregated or air-gapped networks without Internet access.
Installation Kali Linux / Linux
If you are using the standard GNOME build of Kali Linux, the “exploit-DB” package is already included by default! However, if you are using the Kali Light variant or your own custom-built ISO, you can install the package manually as follows:
root@kali:~# apt update && apt -y install exploitdb
You may wish to install some other related packages, “exploit-DB-papers” and “exploit-DB-bin-sploits”.
Installation Apple OS X/macOS
If you have homebrew (package, formula) installed, running the following will get you set up:
user@MacBook:~$ brew update && brew install exploitdb
Alternatively, if you do not have brew installed, you can install it with Git
If you are using Kali Linux, you can expect the exploit-DB package to be updated weekly. If you are using Homebrew or Git, you can expect daily updates (at 05:05 UTC).
Regardless of how you installed SearchSploit, all you need to do in order to update it is run the following:
$ searchsploit -u
If you are using the Kali Linux package and haven’t updated since before 20 September 2016 (shame on you), you will first need to update the package in the traditional manner:
root@kali:~# apt update && apt -y full-upgrade
Please note, we do not recommend you use GitHub’s .zip or the legacy archive.tar.bz2 packages to update.
-h, you can see all the features and options that are available to you:
Simply add any number of search terms you wish to look for:
Note, SearchSploit uses an AND operator, not an OR operator. The more terms that are used, the more the results will be filtered out.
Pro Tip: Do not use abbreviations (use SQL Injection, not SQLi).
Pro Tip: If you are not receiving the expected results, try searching more broadly by using more general terms (use Kernel 2.6 or Kernel 2.x, not Kernel 2.6.25).
By default, searchsploit will check BOTH the title of the exploit as well as the path. Depending on the search criteria, this may bring up false positives (especially when searching for terms that match platforms and version numbers). Searches can be restricted to the titles by using the
Removing Unwanted Results
you can remove unwanted results by using the
--exclude option. We are also able to remove multiple terms by separating the value with a
| (pipe). This can be demonstrated by the following:
Pro Tip: By doing:
searchsploit linux kernel --exclude="(PoC)|/dos/" | grep ' 3.2', you’ll get even “cleaner” output (sorted based on the version without any heading/footers).
Piping Output (Alternative Method of Removing Unwanted Results)
The output from searchsploit can be piped into any other program, which is especially useful when outputting the results in JSON format (using the
-j option). With this, it is possible to remove any unwanted exploits by using grep. In the following example, we use grep to filter out any “Denial of Service (DoS)” results.
Pro Tip: We recommend using “/poc/” with grep rather than “poc” so the filter is applied to the path, rather than the title.
Copy To Clipboard
So now that we have found the exploit we are looking for, there are various ways to access it quickly.
-p, we are able to get some more information about the exploit, as well as copy the complete path to the exploit onto the clipboard:
Copy To Folder
I recommend that you do not alter the exploits in your local copy of the database. Instead, make a copy of ones that are of interest and use them from a working directory. By using the
-m option, we are able to select as many exploits we like to be copied into the same folder that we are currently in:
The Exploit Database repository is the main core of Exploit-DB, making SearchSploit efficient and easy to use. However, some of the exploit metadata (such as screenshots, setup files, tags, and vulnerability mappings) are not included. To access them, you will need to check the website.
You can quickly generate the links to exploits of interest by using the
Examining Nmap result
Nmap has a feature that let you save its output result in .xml format and we can identify each exploit associated with the Nmap XML file.
Nmap -Pn -n IP -oX output.xml
With the help of above command, we have saved the scanning result of Nmap in an XML file, so that we can search the exploit related to scanned port/services.
searchsploit -x --nmap output.xml
Examine an Exploit
Using —examine option enables examine parameter to read the functionality of that exploit with the help of $PAGER.
searchsploit 9542 --examine