Overview
Once you have identified a service and its version, the next step is to look for known public exploits. This page covers all major exploit databases and search tools.Search Strategy
Start with a Web Search
Use Searchsploit (Offline Exploit-DB)
searchsploit allows you to search the Exploit-DB from the command line — useful when you have no internet access:Exploit Databases and Resources
Exploit-DB / Searchsploit
The primary public exploit database. Use
searchsploit for offline CLI access or browse the web interface.Sploitus
Aggregates exploits from Exploit-DB, GitHub, and other databases with a clean unified search interface.
Vulners
Comprehensive vulnerability database including CVEs, exploits, and security advisories across many sources.
PacketStorm
Long-running security resource with exploits, advisories, papers, and tools not always indexed elsewhere.
Shodan Exploits
Search CVEs and exploits integrated with Shodan’s internet scanning data.
Sploitify
GTFOBins-style curated list with filters by vulnerability type (LPE, RCE, etc.), service, and OS. Includes links to practice labs.
search-vulns
Searches NVD, Exploit-DB, PoC-in-GitHub, GitHub Security Advisory, and endoflife.date in one query.
Pompem
Python tool to search for exploits across multiple databases from the CLI.
Specific Use Cases
Finding Exploits from Nmap Scans
Searching for CVEs by Service
Verifying Exploit Reliability
When you find an exploit, consider:- Date — When was it published? Is the service version affected?
- Type — Authenticated vs. unauthenticated, local vs. remote
- Reliability — Is it a PoC, a weaponized exploit, or a Metasploit module?
- Patch status — Has the target applied the relevant patches?
Always test exploits in a controlled lab environment before using them in a production penetration test. An unreliable exploit can cause service crashes or unexpected behavior that falls outside your engagement scope.
GitHub Exploit Repositories
Many exploits are published to GitHub before they appear in formal databases:search-vulns.com automatically index PoC-in-GitHub entries linked to CVE IDs, saving significant manual search time.