searchsploit

Search & use Exploit-DB offline from the terminal

searchsploit Cheat Sheet

searchsploit is the command-line search tool for the offline Exploit-DB archive — find, read, and copy public exploits and shellcode locally. For authorized testing only.

1. Basic search

searchsploit apache 2.4                 # all terms must match the title/path
searchsploit wordpress plugin
searchsploit "Microsoft Windows" SMB
searchsploit oracle windows local       # combine product, platform, type

Search is AND-based across the title and path. Order doesn't matter; every term must appear.

2. Core flags

Flag	Meaning
`-t`	Search the title only (ignore the path)
`-e`	Exact-match the search string
`-s`	Strict — match exact version, no extra results
`-c`	Case-sensitive
`-w`	Show the Exploit-DB online URL
`-p`	Show the full local path (and copy it to clipboard)
`-x`	Examine (open) an exploit in the pager
`-m`	Mirror (copy) an exploit to the current directory
`-o`	Output / overflow into a clean table
`-j`	JSON output
`--id`	Show the Exploit-DB ID (EDB-ID) in results
`--cve <id>`	Search by CVE number
`--exclude="term"`	Exclude results matching a term
`-u`	Update the local Exploit-DB repo
`--nmap <file.xml>`	Search using an nmap `-oX` XML scan

3. Refine results

searchsploit -t openssh                 # title-only (fewer false positives)
searchsploit struts2 --exclude="dos"    # drop DoS entries
searchsploit linux kernel 4.4 --exclude="(PoC)|/dos/"
searchsploit --cve 2021-41773           # find exploits for a CVE
searchsploit -s "Apache 2.4.49"         # strict version match

4. Read & locate an exploit

searchsploit -x 50383                    # view EDB-ID 50383 in the pager
searchsploit -x exploits/linux/remote/50383.py
searchsploit -p 50383                    # print full path + copy to clipboard
searchsploit -w apache 2.4               # show exploit-db.com URLs

5. Copy an exploit locally (mirror)

searchsploit -m 50383                    # copy 50383 into the current dir
searchsploit -m linux/remote/47502.c     # mirror by path
searchsploit -m 42315 39446              # mirror several at once

Mirroring is safer than editing the file in-place inside /usr/share/exploitdb/.

6. Pipe an nmap scan straight in

nmap -sV -oX scan.xml 10.10.10.10
searchsploit --nmap scan.xml             # suggest exploits from detected versions
searchsploit --nmap scan.xml -v          # verbose

7. Update & maintain the database

searchsploit -u                          # update the local copy
# (when installed from git)
cd /opt/exploitdb && git pull

8. Other content

searchsploit -j apache 2.4               # JSON output for scripting
searchsploit --colour apache             # keep colour when piping
searchsploitterm() { searchsploit "$@" | less -R; }   # page long results

The archive also includes shellcode and papers under the Exploit-DB repo (/usr/share/exploitdb/).

9. Tips

Search broad, then narrow: start with the product, add the version, then -t/--exclude to trim.
Match the exploit's platform and version to the target before running anything.
Always read the exploit source (-x) — adjust offsets, IPs, and ports for your target; never blind-run.
Run searchsploit -u periodically so results reflect the latest Exploit-DB.
Note the EDB-ID (--id) to cross-reference at exploit-db.com.

Authorized testing only. Practice on the AYSEC challenges. See also the Metasploit and nmap cheat sheets.