loading
Loading content
loading
Vulnerabilities
Locate public CVE proof-of-concept repositories on GitHub.
overview
find-gh-poc pages a GitHub GraphQL search and writes the repositories that match. Place it after CVE discovery or triage so each identifier becomes a PoC availability check.
Pass the search in -query-string or -query-file, and authenticate with -token-string or -token-file. Without a token the run stalls on anonymous quotas.
Unlike searchsploit, it pulls live GitHub hits rather than a local Exploit-DB archive. Unlike nuclei, it locates PoC code; it does not probe hosts.
use cases
Search a CVE identifier to find out whether working proof-of-concept code already exists on GitHub before deciding how urgently to patch or test it.
Schedule find-gh-poc behind a CVE source so newly disclosed issues are checked for public PoCs automatically and the matches land in a queryable output.
Collect the matching repositories from a query so an analyst can clone and read the PoC code rather than trusting a CVE summary alone.
Run a broader GraphQL search to pull every PoC repository matching a pattern, then triage the set instead of searching one CVE at a time.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| query-string | STRING | -query-string | GraphQL search query to run against GitHub. |
| query-file | FILE | -query-file | File to read the GraphQL search query from. |
| token-string | STRING | -token-string | GitHub token used to authenticate the search. |
| token-file | FILE | -token-file | File to read the GitHub token from. |
Showing key inputs. find-gh-poc exposes 4 inputs in total.
example
# search GitHub for a CVE's proof-of-concept repos, authenticatedfind-gh-poc -query-string 'CVE-2023-3519 in:name,readme' -token-file ./gh-token.txthttps://github.com/example-user/CVE-2023-3519-PoChttps://github.com/redteam-lab/netscaler-adc-rcehttps://github.com/appsec-notes/cve-2023-3519-scannerhttps://github.com/sec-research-42/citrix-pochttps://github.com/blueteam-tools/CVE-2023-3519-detecthttps://github.com/ctf-writeups-x/cve-2023-3519… (18 repositories matched for the real query behind this page)guidance
Use find-gh-poc when you have a CVE or search pattern and need to know which public PoC repositories exist on GitHub. Pair it with a CVE source upstream and a clone or report stage downstream. Supply a token for the authenticated rate limit.
Searches the local Exploit-DB archive. find-gh-poc instead pulls live PoC repositories from GitHub.
Tests hosts against CVE templates. find-gh-poc locates PoC code rather than running a check.
A single-CVE scanner. find-gh-poc is generic and searches PoCs for any CVE you query.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
Subdomain takeover checks driven by can-i-take-over-xyz response fingerprints.
A CVE query feeds find-gh-poc, which searches GitHub and writes the matching proof-of-concept repositories as a queryable output.
Facts on this page come from the live Trickest tool library.