Pearson's OSCP Notebook

searchsploit

Properties1
tagssearchsploit, exploit-db, nmap, version-scan, public-exploit, msfconsole, oscp

4 min read

searchsploit — OSCP Workflow

Ctrl+F: searchsploit · -m · -x · EDB-ID · --cve · exploit-db

How Exploit-DB maps to searchsploit (IDs, paths, URLs): Exploit-DB and searchsploit

What is searchsploit?

searchsploit is a command-line front-end for Exploit-DB — a local copy of public exploits on Kali (/usr/share/exploitdb/). After Nmap finds a service version, searchsploit tells you if a known exploit exists and where the code lives.

OSCP workflow: nmap -sC -sV → note exact version string → searchsploit "service version" → read exploit → adapt or load in MetaSploit.

Install (Kali)

sudo apt update && sudo apt install -y exploitdb
sudo searchsploit -u    # update local Exploit-DB copy

Verify: searchsploit -h

Full install index → Installation - Kali Setup

Basic Syntax

searchsploit [options] search term ...

📌 1) Standard Workflow

# Step 1 — Nmap version scan
nmap -sC -sV -p22,80,443,445 TARGET -oN targeted.txt
 
# Step 2 — Search Exploit-DB (quote multi-word versions)
searchsploit "Apache 2.4.49"
searchsploit "vsftpd 2.3.4"
searchsploit "ProFTPD 1.3.5"
searchsploit "OpenSSH 7.2"
searchsploit "Microsoft IIS 7.5"
searchsploit "Samba 3.5.0"
 
# Linux kernel / distro version (privesc after uname / LES)
searchsploit ubuntu 4.4.0
searchsploit linux kernel 4.4
searchsploit -l ubuntu 4.4              # local privesc only
searchsploit -l "linux kernel" 5.4
searchsploit --cve CVE-2016-5195
 
# Step 3 — Examine results
searchsploit -x 50383          # View exploit in pager (path + code)
searchsploit -m 50383          # Mirror/copy exploit to current directory
searchsploit -m linux/local/5092   # By path slug — see [[Exploit-DB and searchsploit]]
 
# Windows XAMPP privesc
searchsploit xampp
searchsploit --cve CVE-2020-11107
searchsploit -m 50337          # → [[XAMPP - CVE-2020-11107 Privilege Escalation]]
 
# Step 4 — Search MSF for same vuln
msfconsole -q
search apache 2.4.49
search type:exploit name:vsftpd

📌 1b) Linux kernel / privesc search

After uname -a on target (or linux-exploit-suggester hit), search Exploit-DB by distro + kernel:

uname -r
# Linux target 4.4.0-116-generic #132-Ubuntu ...
 
searchsploit ubuntu 4.4.0
searchsploit ubuntu 4.4
searchsploit linux kernel 4.4
searchsploit -l ubuntu 4.4.0              # -l = local exploits only (privesc)
searchsploit -l "linux kernel" 4.4 --exclude="(DoS|PoC)"
 
# By CVE (from LES / LinPEAS)
searchsploit --cve CVE-2016-5195
searchsploit -m linux/local/40847

Pair with linux-exploit-suggester → dedicated notes (Dirty COW - CVE-2016-5195, Dirty Pipe - CVE-2022-0847, etc.) → Linux > 📌 9) Kernel Exploits

FlagDescription
-tTitle search only (default)
--cve CVE-2021-41773Search by CVE
-wWebapps only
-lLocal exploits only
-pPoC / shellcode
-m EDB-IDMirror exploit files to ./
-x EDB-IDExamine exploit (opens less)
-jJSON output
--exclude="(PoC|DOS)"Filter out PoC/DOS noise
-cExact match (case sensitive)

Examples

# Exclude DoS (usually useless on OSCP)
searchsploit "Apache 2.4.49" --exclude="(DoS|PoC)"
 
# Webapp exploits only
searchsploit -w "wordpress 5.0"
 
# By CVE
searchsploit --cve CVE-2020-1472
 
# Copy exploit locally to edit
searchsploit -m linux/local/37292

📌 3) Reading Output

------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                           |  Path
------------------------------------------------------------------------- ---------------------------------
Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution (RCE)| linux/webapps/50383.sh
------------------------------------------------------------------------- ---------------------------------
ColumnMeaning
TitleVulnerability description
PathLocation under /usr/share/exploitdb/exploits/
EDB-IDExploit-DB ID (use with -x / -m)

Full path example:

/usr/share/exploitdb/exploits/linux/webapps/50383.sh

📌 4) After Finding an Exploit

Manual exploit

searchsploit -m 50383
chmod +x 50383.sh
./50383.sh TARGET 'id'
# Read source first — adjust LHOST, port, paths

Metasploit module

msfconsole -q
search exploit-db 50383
use exploit/...
show options
set RHOSTS TARGET
set LHOST ATTACKER_IP
run

See Msfconsole and Auxiliary.

📌 5) When searchsploit Returns Nothing

No Results
Next stepTool
Generic service enumNikto, Gobuster, WPScan
Default creds / bruteHydra, manual login
Web logic bugsBurp Suite, manual testing
AD / WindowsCrackMapExec - nxc, Impacket, Responder
Version still interestingGoogle CVE + version; check Version CVEs

📌 6) OSCP Exam Tips

  • Match exact version strings from nmap -sV (including minor/build)
  • Always read exploit code before running — set LHOST, paths, architecture
  • Prefer Metasploit module when stable; manual when MSF fails or needs tweaking
  • Document: service, version, EDB-ID/CVE, exploit used (for report)
  • Don’t waste time on DoS exploits

📌 Quick Cheat Sheet

# Standard chain
nmap -sC -sV -p PORTS TARGET
searchsploit "SERVICE VERSION"
searchsploit -x EDB_ID
searchsploit -m EDB_ID
 
# MSF fallback
msfconsole -q → search SERVICE VERSION
 
# Kernel / privesc
searchsploit ubuntu 4.4.0
searchsploit -l ubuntu 4.4 --exclude="(DoS|PoC)"
searchsploit --cve CVE-XXXX-XXXX
# PoC repo (after CMS/version enum): https://github.com/trickest/cve/tree/main → [[Reference]]

Graph View

Backlinks