Exploit-DB / SearchSploit
Exploit-DB is a public archive of exploits and proof-of-concept code, and SearchSploit is its offline command-line search tool.
Legal & ethical use. Public exploit code is for education and authorised testing only; review code before running it. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Look up public exploits for a service version found in a lab
- Read PoC code to understand how a vulnerability works
Key features
- Offline searchable archive
- Links to CVEs
- Copy/examine entries
Installation
Install the exploitdb package (preinstalled on Kali) or clone the GitLab repository.
Beginner usage guide
Search by product and version, read the entry fully and never run unreviewed code outside an isolated lab.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Search for a product
searchsploit apache 2.4Lists archive entries matching the keywords.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Command flags checked against the real binary searchsploit (/usr/bin/searchsploit: illegal option -- -) on 2026-10-27.