Vulnerabilities
Query Exploit-DB for published exploits by CVE or scan
Offline CLI search across the local Exploit-DB archive of exploits and shellcodes.
overview
What searchsploit does
searchsploit is the CLI for Exploit-DB. Pass a search term, a CVE via --cve, or Nmap XML via --nmap, and it returns matching exploits and shellcodes from a local archive copy.
Default matching is flexible. --title and --exact narrow titles, --strict turns off fuzzy version ranges, and --exclude drops pipe-separated noise. --json emits structured records for downstream parsing.
Use it after service detection when you need candidate exploit code, not a live vulnerability probe. Pair with nuclei or a scanner to confirm what still works against the target.
use cases
Where searchsploit fits
Map a service version to exploits
Feed an Nmap XML scan with --nmap so every detected service and version is checked against Exploit-DB, turning a port scan into a candidate-exploit list.
Look up exploits by CVE
Use --cve to search the archive directly for a Common Vulnerabilities and Exposures id and pull any published exploit code.
Narrow a broad search
Combine --title and --exact to find precise software-and-version entries, avoiding loose hits that a default fuzzy search returns.
Emit structured results
Set --json so each result becomes a record that a downstream node can parse, filter, and route into reporting.
reference
searchsploit inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| term | STRING | · | Search term. |
| cve | BOOLEAN | --cve | Search for a Common Vulnerabilities and Exposures (CVE) value. |
| nmap | FILE | --nmap | Check all results against an Nmap XML output with service versions. |
| json | BOOLEAN | --json | Show results in JSON format. |
| title | BOOLEAN | --title | Search only the exploit title (default matches title and file path). |
| exact | BOOLEAN | --exact | Perform an exact, ordered match on the exploit title. |
| strict | BOOLEAN | --strict | Strict search, disabling fuzzy matching for version ranges. |
| exclude | STRING | --exclude | Remove values from results, chaining multiple with a pipe. |
Showing key inputs. searchsploit exposes 15 inputs in total.
Full flag reference (15 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| id | BOOLEAN | --id | Display the EDB-ID value rather than local path |
| cve | BOOLEAN | --cve | Search for Common Vulnerabilities and Exposures (CVE) value |
| www | BOOLEAN | --www | Show URLs to Exploit-DB.com rather than the local path |
| case | BOOLEAN | --case | Perform a case-sensitive search (Default is inSEnsITiVe) |
| json | BOOLEAN | --json | Show result in JSON format |
| nmap | FILE | --nmap | Checks all results in Nmap's XML output with service version |
| path | BOOLEAN | --path | Show the full path to an exploit (and also copies the path to the clipboard if possible) |
| term | STRING | · | Search term |
| exact | BOOLEAN | --exact | Perform an EXACT & order match on exploit title (Default is an AND match on each term) [Implies "--title"] (e.g. "WordPress 4.1" would not be detect "WordPress Core 4.1") |
| title | BOOLEAN | --title | Search JUST the exploit title (Default is title AND the file's path) |
| strict | BOOLEAN | --strict | Perform a strict search, so input values must exist, disabling fuzzy search for version range (e.g. "1.1" would not be detected in "1.0 < 1.3") |
| exclude | STRING | --exclude | Remove values from results. By using "|" to separate, you can chain multiple values (e.g. "term1|term2|term3") |
| verbose | BOOLEAN | --verbose | Display more information in output |
| overflow | BOOLEAN | --overflow | Exploit titles are allowed to overflow their columns |
| disable-colour | BOOLEAN | --disable-colour | Disable colour highlighting in search results |
example
Run searchsploit
# title-only search with JSON outputsearchsploit --title --json apache 2.4---------------------------------------------------------------------------------------- Exploit Title | Path----------------------------------------------------------------------------------------Apache HTTP Server 2.4.49 - Path Traversal | linux/remote/50383.shApache 2.4.49 - Path Traversal / RCE | multiple/webapps/50406.rbApache 2.4.50 - Path Traversal / RCE | multiple/webapps/50850.pyApache mod_proxy - Reverse Proxy Exposure | linux/remote/20421.c----------------------------------------------------------------------------------------guidance
Choosing searchsploit
Reach for searchsploit when you have software, a version, or a CVE and want published Exploit-DB entries. It searches an offline archive rather than testing live targets, so confirm exploitability with nuclei or a direct scanner.
nuclei
Tests live targets against templates rather than searching an offline exploit archive.
nmap
Produces the service-version XML that searchsploit consumes with --nmap.
metasploit
Framework of working exploit modules for confirmed execution against targets.
faq
searchsploit questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run searchsploit yourself
An Nmap XML scan feeds SearchSploit, which checks every detected service version against Exploit-DB and writes the matching exploits as a queryable output.
Facts on this page come from the live Trickest tool library.