searchsploit: A command-line tool for searching Exploit-DB’s public exploits

1. Tool Introduction

SearchSploit is the official command-line search utility for the Exploit Database (Exploit-DB), maintained by Offensive Security. It ships with a locally mirrored copy of the entire Exploit-DB archive, allowing penetration testers to search for public exploits, proof-of-concept (PoC) code, shellcode, and Google Hacking Database (GHDB) entries entirely offline. Because it works against a local copy of the database, SearchSploit is fast, works without internet access (useful on isolated engagement networks), and integrates directly with Metasploit and other tools for quick exploit triage after a version-fingerprinting scan (e.g., via Nmap’s -sV).

SearchSploit is bundled as part of the exploitdb package and is preinstalled on Kali Linux.

2. How to Install

# Preinstalled on Kali, but to (re)install or update:
sudo apt update
sudo apt install exploitdb -y

# Update the local exploit database mirror
searchsploit -u

# Verify installation
searchsploit -h

On non-Kali systems (via git clone):

git clone https://gitlab.com/exploit-database/exploitdb.git /opt/exploitdb
ln -sf /opt/exploitdb/searchsploit /usr/local/bin/searchsploit
searchsploit -u

3. Syntax

searchsploit [options] <search term(s)>

Multiple terms are treated as an AND search by default.

4. Command-Line Options (Kali Linux)

Option	Description
-c, --case	Perform a case-sensitive search
-e, --exact	Perform an exact match on the search query
-h, --help	Show help
-j, --json	Show output in JSON format
-m, --mirror <EDB-ID>	Mirror (copy) an exploit to the current directory
-o, --overflow	Do not truncate lines in the terminal output
-p, --path <EDB-ID>	Show the full path to an exploit and copy it to clipboard (if xclip installed)
-t, --title	Search the exploit title only (not full text)
-u, --update	Check for and install any exploitdb package updates
-w, --www	Show the exploit-db.com URL alongside the local path
-x, --examine	Examine (view) an exploit file using $PAGER
--colour / --nocolour	Enable or disable colored output
--id	Display the EDB-ID and/or CVE alongside results
--nmap <file.xml>	Check all results in an Nmap XML file (-oX) for potential exploits
--exclude="term"	Remove specific terms/results from the search results
-v, --verbose	Verbose output
--disable-colour	Alias to disable colour output

5. Basic Usage (Expected Output in Bash)

$ searchsploit apache 2.4.49

------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                  |  Path
------------------------------------------------------------------------------- ---------------------------------
Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution              | multiple/webapps/50383.py
Apache HTTP Server 2.4.49/2.4.50 - Path Traversal                              | multiple/remote/50406.py
------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

6. Practical Examples with Output

Example 1 – Basic keyword search

$ searchsploit wordpress plugin
------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                      |  Path
------------------------------------------------------------------- ---------------------------------
WordPress Plugin Contact Form 7 - Arbitrary File Upload             | php/webapps/48730.rb
WordPress Plugin Duplicator < 1.3.26 - Remote Code Execution        | php/webapps/50702.py

Example 2 – Title-only exact match

$ searchsploit -t -e "vsftpd 2.3.4"
------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                      |  Path
------------------------------------------------------------------- ---------------------------------
vsftpd 2.3.4 - Backdoor Command Execution                           | unix/remote/49757.py

Example 3 – Displaying full path of an exploit

$ searchsploit -p 49757
  Exploit: vsftpd 2.3.4 - Backdoor Command Execution
      URL: https://www.exploit-db.com/exploits/49757
     Path: /usr/share/exploitdb/exploits/unix/remote/49757.py
File Type: Python script, ASCII text executable

Example 4 – Mirroring (copying) an exploit locally

$ searchsploit -m 49757
  Exploit: vsftpd 2.3.4 - Backdoor Command Execution
      URL: https://www.exploit-db.com/exploits/49757
     Path: /usr/share/exploitdb/exploits/unix/remote/49757.py
File Type: Python script, ASCII text executable

Copied to: /home/kali/49757.py

Example 5 – Examining an exploit file directly

$ searchsploit -x 49757

[opens the exploit source code in $PAGER for review before use]

Example 6 – JSON output for scripting

$ searchsploit -j "eternalblue" | head -20
{
  "SEARCHSPLOIT_DB": "...",
  "RESULTS_EXPLOIT": [
    {
      "Title": "Microsoft Windows - 'EternalBlue' SMB Remote Code Execution",
      "EDB-ID": "42315",
      "Path": "windows/remote/42315.py"
    }
  ]
}

Example 7 – Checking an Nmap scan for matching exploits

$ nmap -sV -oX scan.xml 10.10.10.5
$ searchsploit --nmap scan.xml
[i] /usr/bin/searchsploit --nmap scan.xml
[i] Reading: 'scan.xml'
[i] Port 445/tcp - Checking 'Microsoft Windows netbios-ssn'
------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                      |  Path
------------------------------------------------------------------- ---------------------------------
Microsoft Windows - 'EternalBlue' SMB RCE (MS17-010)                | windows/remote/42315.py

Example 8 – Excluding noisy/irrelevant results

$ searchsploit apache --exclude="DoS"
------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                      |  Path
------------------------------------------------------------------- ---------------------------------
Apache HTTP Server 2.4.49 - Path Traversal & RCE                    | multiple/webapps/50383.py

Example 9 – Searching with case sensitivity

$ searchsploit -c "OpenSSH"
------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                      |  Path
------------------------------------------------------------------- ---------------------------------
OpenSSH 7.2 - Denial of Service                                     | linux/dos/40888.txt

Example 10 – Updating the local database

$ searchsploit -u
Copyright (c) Offensive Security
Checking for updates ...
Exploit Database Update: Complete!
Extra recon and OSINT tools have been added! Type 'searchsploit -h' for more information.

7. Common Use Cases

• Rapidly cross-referencing service banners from Nmap version scans against known public exploits.
• Offline exploit research on isolated/air-gapped assessment networks.
• Retrieving PoC source code for manual review and adaptation before controlled testing.
• Complementing Metasploit — checking if a public standalone exploit exists for a CVE not yet ported to an MSF module.
• Quickly validating whether a specific software version has known, documented vulnerabilities during a vulnerability assessment.

8. Automation with Bash

#!/bin/bash
# scan_and_search.sh - Nmap scan then auto-correlate with SearchSploit

TARGET=$1
OUT="nmap_scan.xml"

if [ -z "$TARGET" ]; then
  echo "Usage: $0 <target-ip>"
  exit 1
fi

echo "[*] Running Nmap version scan against $TARGET..."
nmap -sV -Pn -oX "$OUT" "$TARGET"

echo "[*] Correlating results with SearchSploit..."
searchsploit --nmap "$OUT" | tee searchsploit_results.txt

echo "[*] Done. Results saved to searchsploit_results.txt"

#!/bin/bash
# bulk_search.sh - Search SearchSploit for a list of software/versions from a file

INPUT_FILE="services.txt"   # one "product version" per line

while IFS= read -r line; do
  echo "=== Searching: $line ==="
  searchsploit -t "$line"
  echo
done < "$INPUT_FILE"

9. Tips and Best Practices

• Run searchsploit -u regularly (e.g., weekly, or at the start of every engagement) to keep the local mirror current.
• Use -t (title-only) for quick, low-noise triage before doing a full-text search.
• Always read exploit source (-x) before executing it against a target — public PoCs frequently contain placeholder values, bugs, or require modification.
• Combine --nmap with your recon phase to automatically shortlist candidate exploits right after scanning.
• Use --exclude to filter out DoS-only or unrelated results when you specifically need RCE/PrivEsc exploits.
• Treat SearchSploit results as a starting point for manual verification, not a guaranteed working exploit — success rates vary by exact target patch level and configuration.

10. Troubleshooting

Problem	Cause	Solution
searchsploit: command not found	exploitdb package not installed	sudo apt install exploitdb
No results for a known CVE	Local database out of date	Run searchsploit -u
--nmap shows no matches	Nmap XML lacks version detection	Re-scan with -sV (and possibly -A)
Colored output garbled in logs/pipes	Terminal escape codes	Use --nocolour when redirecting to a file
-m mirror fails to copy	No write permission in current directory	cd to a writable directory or use sudo carefully

11. References

• Exploit Database: https://www.exploit-db.com
• GitLab repository: https://gitlab.com/exploit-database/exploitdb
• Kali Linux tool page: https://www.kali.org/tools/exploitdb/
• Offensive Security SearchSploit manual: https://www.exploit-db.com/searchsploit