Vulnerabilities
List GitHub repositories that hold CVE PoC code
find-gh-poc is Trickest's open-source Go tool that finds CVE proof-of-concept exploits published on GitHub through configurable GraphQL search queries, the centerpiece of the Trickest CVE project.
installgo install -v github.com/trickest/find-gh-poc@latestdocker pull quay.io/trickest/find-gh-poc
Go · MIT license
overview
What find-gh-poc does
find-gh-poc pages a GitHub GraphQL search and writes the repositories that match. Place it after CVE discovery or triage so each identifier becomes a PoC availability check.
Pass the search in -query-string or -query-file, and authenticate with -token-string or -token-file. Without a token the run stalls on anonymous quotas.
Unlike searchsploit, it pulls live GitHub hits rather than a local Exploit-DB archive. Unlike nuclei, it locates PoC code; it does not probe hosts.
use cases
Where find-gh-poc fits
Confirm public PoCs for a CVE
Search a CVE identifier to find out whether working proof-of-concept code already exists on GitHub before deciding how urgently to patch or test it.
Build an exploit-availability feed
Schedule find-gh-poc behind a CVE source so newly disclosed issues are checked for public PoCs automatically and the matches land in a queryable output.
Gather repositories for offline review
Collect the matching repositories from a query so an analyst can clone and read the PoC code rather than trusting a CVE summary alone.
Sweep a class of vulnerabilities
Run a broader GraphQL search to pull every PoC repository matching a pattern, then triage the set instead of searching one CVE at a time.
reference
find-gh-poc inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| query-string | STRING | -query-string | GraphQL search query to run against GitHub. |
| query-file | FILE | -query-file | File to read the GraphQL search query from. |
| token-string | STRING | -token-string | GitHub token used to authenticate the search. |
| token-file | FILE | -token-file | File to read the GitHub token from. |
Showing key inputs. find-gh-poc exposes 4 inputs in total.
example
Run find-gh-poc
# search GitHub for a CVE's proof-of-concept repos, authenticated
find-gh-poc -query-string 'CVE-2023-3519 in:name,readme' -token-file ./gh-token.txthttps://github.com/example-user/CVE-2023-3519-PoC
https://github.com/redteam-lab/netscaler-adc-rce
https://github.com/appsec-notes/cve-2023-3519-scanner
https://github.com/sec-research-42/citrix-poc
https://github.com/blueteam-tools/CVE-2023-3519-detect
https://github.com/ctf-writeups-x/cve-2023-3519
… (18 repositories matched for the real query behind this page)guidance
Choosing find-gh-poc
Use find-gh-poc when you have a CVE or search pattern and need to know which public PoC repositories exist on GitHub. Pair it with a CVE source upstream and a clone or report stage downstream. Supply a token for the authenticated rate limit.
searchsploit
Searches the local Exploit-DB archive. find-gh-poc instead pulls live PoC repositories from GitHub.
nuclei
Tests hosts against CVE templates. find-gh-poc locates PoC code rather than running a check.
log4j-scan
A single-CVE scanner. find-gh-poc is generic and searches PoCs for any CVE you query.
faq
find-gh-poc questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
honeymcp
Black Hat Arsenal deception layer for MCP servers, exported as a schedulable ghost-tool catalog.
Run find-gh-poc yourself
A CVE query feeds find-gh-poc, which searches GitHub and writes the matching proof-of-concept repositories as a queryable output.
Facts on this page come from the live Trickest tool library.