DB.
Courses

Locating Public Exploits
OSCP · Chapter 9

Locating Public Exploits

Once you have a lead (an outdated service version, a CMS plugin, a specific CVE), the next skill is efficiently locating a working, non-malicious proof-of-concept exploit and understanding what it actually does before you run it.

Key concepts

  • Searchsploit (offline Exploit-DB mirror) and the CVE/NVD database are the first stops for a version-specific lead.
  • Always read the exploit code before running it — public PoCs sometimes include miner payloads or reverse shells hardcoded to someone else's IP.
  • Cross-reference the exploit's prerequisites (exact version, auth requirements, target OS) against what your recon already confirmed.
  • Prefer well-known, actively maintained toolkits (Metasploit modules) over anonymous one-off scripts when both exist for the same CVE.

Example

searchsploit apache 2.4.49
searchsploit -m 50383   # mirror/copy the matching exploit locally for review

Try it yourself

Pick any CVE you recognize by name (e.g. Log4Shell, EternalBlue) and find its Exploit-DB or Metasploit module entry. Read the description and note which single precondition makes the target exploitable.

ReferenceSearch video walkthroughs

@ Daniel Burlacu