E-SEA
searchsploit
Command-line search tool for a local mirror of Exploit-DB, matching a service or version against known public exploits.
OVERVIEW
searchsploit is the command-line client shipped with exploitdb (github.com/offensive-security/exploitdb, maintained by Offensive Security), and it works entirely offline against a local copy of the Exploit-DB archive: point it at a product name and version, and it returns matching exploit titles, the affected platform, and a path to the full proof-of-concept locally on disk, with no query ever leaving the machine.
Because it works offline, it's a natural fit right after Nmap version detection: pipe or paste a service banner in, get a candidate list of public exploits out, and read the actual PoC before deciding whether it's usable, safe to run, and relevant to the exact version in scope.
USE CASES
Practical use cases
- 01
Checking a service/version identified during Nmap enumeration against known public exploits.
- 02
Working offline, air-gapped, or on an internal network with no outbound access.
- 03
Reading a candidate exploit's full source/PoC locally before deciding whether to use it.
- 04
Cross-referencing CVE identifiers with searchsploit's local mirror during triage.
QUICK START
Once a service and version have been identified during enumeration, to quickly check whether a known public exploit already exists before writing anything custom.
- Install exploitdb via your package manager (it ships searchsploit) or clone the GitHub repo.
- Update the local mirror so results reflect recently disclosed exploits.
- Search by product name and version as identified during enumeration.
- Open the matching PoC file locally and read it before running anything against a target.
- Confirm the PoC's preconditions and version match the actual target before attempting exploitation.
searchsploit apache 2.4.49BEFORE YOU RUN IT
What to check before running it
Results are only as current as the last mirror update (searchsploit -u) — a stale local copy will miss recently disclosed exploits, so update it at the start of an engagement and note the mirror date in the report.
A PoC in Exploit-DB is unverified third-party code: read it fully before running it, and test in a lab or against a disposable target first when possible, since some entries are unreliable, incomplete, or intentionally weaponized against the runner.
Finding a matching title doesn't confirm exploitability — the target's exact version, patch level, and configuration still need to be validated before treating it as a live finding.