ad-attacks
Active Directory attack reference — BloodHound Cypher queries, Kerberos attack decision tree, ACE/ACL abuse, ADCS ESC1-8, and AD…
@mukul975Install SkillSecurity
Skill
/exploit-db
Exploit-DB and searchsploit reference — EDB→Metasploit module mappings, PoC reliability rubric, CVSS tier quick reference, and searchsploit usage patterns
Claude Code
$ npx -y skills add mukul975/Threatswarm --skill exploit-db --agent claude-code
Codex
$ npx skills add mukul975/Threatswarm --skill exploit-db -a codex -y
Cursor
$ npx skills add mukul975/Threatswarm --skill exploit-db -a cursor -y
Gemini CLI
$ npx skills add mukul975/Threatswarm --skill exploit-db -a gemini-cli -y
GitHub Copilot
$ npx skills add mukul975/Threatswarm --skill exploit-db -a github-copilot -y
OpenCode
$ npx skills add mukul975/Threatswarm --skill exploit-db -a opencode -y
Windsurf
$ npx skills add mukul975/Threatswarm --skill exploit-db -a windsurf -y
SKILL.md
exploit-db.SKILL.mdname: exploit-db
description: Exploit-DB and searchsploit reference — EDB→Metasploit module mappings, PoC reliability rubric, CVSS tier quick reference, and searchsploit usage patterns
allowed-tools: Bash, Read
searchsploit Usage Patterns
# Text search in title/path
searchsploit apache 2.4
# Search by CVE
searchsploit --cve CVE-2021-41773
searchsploit --cve CVE-2021-44228
# JSON output for scripting
searchsploit apache --json | python3 -c "
import sys, json
data = json.load(sys.stdin)
for e in data.get('RESULTS_EXPLOIT', []):
print(e['EDB-ID'], e['Title'], e['Path'])
"
# Copy exploit to working dir
searchsploit -m 50383
# Update database
searchsploit -u
# Search by nmap XML output
searchsploit --nmap nmap_output.xml
# Filter by type (webapps, local, remote, dos)
searchsploit -t "remote" apache
# Search for specific OS
searchsploit windows 10 privilege escalation
# Show only exploits (not shellcodes/papers)
searchsploit wordpress --www-exploit-dbEDB → Metasploit Module Mapping (Top 40 Vulnerabilities)
| CVE / EDB-ID | Vulnerability | Metasploit Module | Reliability | |---|---|---|---| | CVE-2017-0144 / EDB-41891 | MS17-010 EternalBlue | `exploit/windows/smb/ms17_010_eternalblue` | Weaponized | | CVE-2021-44228 / EDB-50592 | Log4Shell RCE | `exploit/multi/http/log4shell_header_injection` | Weaponized | | CVE-2021-1675 / EDB-50265 | PrintNightmare | `exploit/windows/dcerpc/cve_2021_1675_printnightmare` | Weaponized | | CVE-2021-34473 / EDB-50243 | ProxyShell Exchange | `exploit/windows/http/exchange_proxyshell_rce` | Weaponized | | CVE-2020-1472 / EDB-49071 | ZeroLogon | `auxiliary/admin/dcerpc/cve_2020_1472_zerologon` | Weaponized | | CVE-2022-22965 / EDB-50798 | Spring4Shell | `exploit/multi/http/spring_framework_rce_spring4shell` | Weaponized | | CVE-2019-19781 / EDB-47901 | Citrix ADC Path Traversal | `exploit/linux/http/citrix_dir_traversal_rce` | Weaponized | | CVE-2020-5902 / EDB-48695 | F5 BIG-IP RCE | `exploit/linux/http/f5_bigip_tmui_rce` | Weaponized | | CVE-2021-26855 / EDB-49637 | ProxyLogon Exchange | `exploit/windows/http/exchange_proxylogon_rce` | Weaponized | | CVE-2022-26134 / EDB-51076 | Confluence OGNL RCE | `exploit/multi/http/atlassian_confluence_namespace_ognl_injection` | Weaponized | | CVE-2018-13379 / EDB-47288 | FortiOS Path Traversal | `auxiliary/gather/fortios_vpn_user_cred` | Functional | | CVE-2022-1388 / EDB-50919 | F5 iControl Auth Bypass | `exploit/linux/http/f5_icontrol_rce` | Weaponized | | CVE-2021-20038 / EDB-50882 | SonicWall SMA Stack Overflow | `exploit/linux/http/sonicwall_sma_overflow` | Functional | | CVE-2023-46604 / EDB-51880 | Apache ActiveMQ RCE | `exploit/multi/misc/apache_activemq_rce_cve_2023_46604` | Weaponized | | CVE-2021-3156 / EDB-49521 | Sudo Baron Samedit | `exploit/linux/local/sudo_baron_samedit` | Weaponized | | CVE-2021-4034 / EDB-50689 | PwnKit polkit LPE | `exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec` | Weaponized | | CVE-2022-0847 / EDB-50808 | Dirty Pipe Linux LPE | `exploit/linux/local/cve_2022_0847_dirtypipe` | Weaponized | | CVE-2016-5195 / EDB-40616 | Dirty COW Linux LPE | `exploit/linux/local/overlayfs_priv_esc` | Weaponized | | CVE-2014-6271 / EDB-34766 | Shellshock Bash RCE | `exploit/multi/http/apache_mod_cgi_bash_env_exec` | Weaponized | | CVE-2017-5638 / EDB-41570 | Apache Struts2 RCE | `exploit/multi/http/struts2_content_type_ognl` | Weaponized | | CVE-2019-0708 / EDB-47416 | BlueKeep RDP RCE | `exploit/windows/rdp/cve_2019_0708_bluekeep_rce` | Functional | | CVE-2020-0796 / EDB-48260 | SMBGhost RCE | `exploit/windows/smb/cve_2020_0796_smbghost` | Functional | | CVE-2018-7600 / EDB-44449 | Drupalgeddon2 RCE | `exploit/unix/webapp/drupal_drupalgeddon2` | Weaponized | | CVE-2019-0211 / EDB-46676 | Apache HTTPd LPE | `exploit/multi/http/apache_mod_cgi_bash_env_exec` | Functional | | CVE-2015-1701 / EDB-37367 | Windows Win32k LPE | `exploit/windows/local/ms15_051_client_copy_image` | Weaponized | | CVE-2020-14882 / EDB-49391 | Oracle WebLogic RCE | `exploit/multi/http/oracle_weblogic_admin_handle_rce` | Weaponized | | CVE-2021-22005 / EDB-50513 | vCenter File Upload | `exploit/linux/http/vmware_vcenter_uploadova_rce` | Weaponized | | CVE-2022-41040 / EDB-51917 | ProxyNotShell Exchange | `exploit/windows/http/exchange_proxynotshell_rce` | Functional | | CVE-2023-22515 / EDB-51899 | Confluence Priv Esc | Manual PoC required | Functional | | CVE-2024-21762 / EDB-51960 | FortiOS OOB Write | Manual PoC required | Weaponized | | CVE-2019-11510 / EDB-47297 | Pulse Secure Arb File Read | `auxiliary/gather/pulse_secure_file_read` | Weaponized | | CVE-2020-3452 / EDB-48577 | Cisco ASA Path Traversal | `auxiliary/gather/cisco_asa_local_file_inclusion` | Weaponized | | CVE-2021-40539 / EDB-50781 | ManageEngine RCE | `exploit/multi/http/manageengine_adselfservice_plusrce` | Weaponized | | CVE-2022-36537 / EDB-51327 | ZK Framework RCE | Manual PoC | Functional | | CVE-2023-4966 / EDB-51888 | Citrix Bleed Session Leak | Manual PoC | Weaponized | | CVE-2024-3400 / EDB-52023 | PAN-OS GlobalProtect RCE | Manual PoC | Weaponized | | CVE-2022-47966 / EDB-51518 | ManageEngine SAML RCE | `exploit/linux/http/zoho_manageengine_saml_rce` | Weaponized | | CVE-2023-27997 / EDB-51832 | FortiGate SSL-VPN Heap BOF | Manual PoC | Weaponized | | CVE-2023-20198 / EDB-51873 | Cisco IOS XE Priv Esc | Manual PoC | Weaponized | | CVE-2024-6387 / EDB-52098 | OpenSSH regreSSHion | Manual PoC (race) | DoS-only |
PoC Reliability Rubric
| Level | Label | Criteria | Action | |---|---|---|---| | 1 | **Weaponized** | Works out-of-box against target version, produces shell/access reliably | Test directly; log as `CONFIRMED` | | 2 | **Functional** | Requires minor adaptation (change URL, adjust offset) | Modify per target; log as `VERIFIED` | | 3 | **DoS-only** | Crashes service but no code exec | Confirm version, log as `CONFIRMED-DOS` | | 4 | **Theoretical** | Academic writeup, no working code | Write PoC fro
Read more
name: exploit-db description: Exploit-DB and searchsploit reference — EDB→Metasploit module mappings, PoC reliability rubric, CVSS tier quick reference, and searchsploit usage patterns allowed-tools: Bash, Read
searchsploit Usage Patterns
# Text search in title/path
searchsploit apache 2.4
# Search by CVE
searchsploit --cve CVE-2021-41773
searchsploit --cve CVE-2021-44228
# JSON output for scripting
searchsploit apache --json | python3 -c "
import sys, json
data = json.load(sys.stdin)
for e in data.get('RESULTS_EXPLOIT', []):
print(e['EDB-ID'], e['Title'], e['Path'])
"
# Copy exploit to working dir
searchsploit -m 50383
# Update database
searchsploit -u
# Search by nmap XML output
searchsploit --nmap nmap_output.xml
# Filter by type (webapps, local, remote, dos)
searchsploit -t "remote" apache
# Search for specific OS
searchsploit windows 10 privilege escalation
# Show only exploits (not shellcodes/papers)
searchsploit wordpress --www-exploit-dbEDB → Metasploit Module Mapping (Top 40 Vulnerabilities)
| CVE / EDB-ID | Vulnerability | Metasploit Module | Reliability | |---|---|---|---| | CVE-2017-0144 / EDB-41891 | MS17-010 EternalBlue | `exploit/windows/smb/ms17_010_eternalblue` | Weaponized | | CVE-2021-44228 / EDB-50592 | Log4Shell RCE | `exploit/multi/http/log4shell_header_injection` | Weaponized | | CVE-2021-1675 / EDB-50265 | PrintNightmare | `exploit/windows/dcerpc/cve_2021_1675_printnightmare` | Weaponized | | CVE-2021-34473 / EDB-50243 | ProxyShell Exchange | `exploit/windows/http/exchange_proxyshell_rce` | Weaponized | | CVE-2020-1472 / EDB-49071 | ZeroLogon | `auxiliary/admin/dcerpc/cve_2020_1472_zerologon` | Weaponized | | CVE-2022-22965 / EDB-50798 | Spring4Shell | `exploit/multi/http/spring_framework_rce_spring4shell` | Weaponized | | CVE-2019-19781 / EDB-47901 | Citrix ADC Path Traversal | `exploit/linux/http/citrix_dir_traversal_rce` | Weaponized | | CVE-2020-5902 / EDB-48695 | F5 BIG-IP RCE | `exploit/linux/http/f5_bigip_tmui_rce` | Weaponized | | CVE-2021-26855 / EDB-49637 | ProxyLogon Exchange | `exploit/windows/http/exchange_proxylogon_rce` | Weaponized | | CVE-2022-26134 / EDB-51076 | Confluence OGNL RCE | `exploit/multi/http/atlassian_confluence_namespace_ognl_injection` | Weaponized | | CVE-2018-13379 / EDB-47288 | FortiOS Path Traversal | `auxiliary/gather/fortios_vpn_user_cred` | Functional | | CVE-2022-1388 / EDB-50919 | F5 iControl Auth Bypass | `exploit/linux/http/f5_icontrol_rce` | Weaponized | | CVE-2021-20038 / EDB-50882 | SonicWall SMA Stack Overflow | `exploit/linux/http/sonicwall_sma_overflow` | Functional | | CVE-2023-46604 / EDB-51880 | Apache ActiveMQ RCE | `exploit/multi/misc/apache_activemq_rce_cve_2023_46604` | Weaponized | | CVE-2021-3156 / EDB-49521 | Sudo Baron Samedit | `exploit/linux/local/sudo_baron_samedit` | Weaponized | | CVE-2021-4034 / EDB-50689 | PwnKit polkit LPE | `exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec` | Weaponized | | CVE-2022-0847 / EDB-50808 | Dirty Pipe Linux LPE | `exploit/linux/local/cve_2022_0847_dirtypipe` | Weaponized | | CVE-2016-5195 / EDB-40616 | Dirty COW Linux LPE | `exploit/linux/local/overlayfs_priv_esc` | Weaponized | | CVE-2014-6271 / EDB-34766 | Shellshock Bash RCE | `exploit/multi/http/apache_mod_cgi_bash_env_exec` | Weaponized | | CVE-2017-5638 / EDB-41570 | Apache Struts2 RCE | `exploit/multi/http/struts2_content_type_ognl` | Weaponized | | CVE-2019-0708 / EDB-47416 | BlueKeep RDP RCE | `exploit/windows/rdp/cve_2019_0708_bluekeep_rce` | Functional | | CVE-2020-0796 / EDB-48260 | SMBGhost RCE | `exploit/windows/smb/cve_2020_0796_smbghost` | Functional | | CVE-2018-7600 / EDB-44449 | Drupalgeddon2 RCE | `exploit/unix/webapp/drupal_drupalgeddon2` | Weaponized | | CVE-2019-0211 / EDB-46676 | Apache HTTPd LPE | `exploit/multi/http/apache_mod_cgi_bash_env_exec` | Functional | | CVE-2015-1701 / EDB-37367 | Windows Win32k LPE | `exploit/windows/local/ms15_051_client_copy_image` | Weaponized | | CVE-2020-14882 / EDB-49391 | Oracle WebLogic RCE | `exploit/multi/http/oracle_weblogic_admin_handle_rce` | Weaponized | | CVE-2021-22005 / EDB-50513 | vCenter File Upload | `exploit/linux/http/vmware_vcenter_uploadova_rce` | Weaponized | | CVE-2022-41040 / EDB-51917 | ProxyNotShell Exchange | `exploit/windows/http/exchange_proxynotshell_rce` | Functional | | CVE-2023-22515 / EDB-51899 | Confluence Priv Esc | Manual PoC required | Functional | | CVE-2024-21762 / EDB-51960 | FortiOS OOB Write | Manual PoC required | Weaponized | | CVE-2019-11510 / EDB-47297 | Pulse Secure Arb File Read | `auxiliary/gather/pulse_secure_file_read` | Weaponized | | CVE-2020-3452 / EDB-48577 | Cisco ASA Path Traversal | `auxiliary/gather/cisco_asa_local_file_inclusion` | Weaponized | | CVE-2021-40539 / EDB-50781 | ManageEngine RCE | `exploit/multi/http/manageengine_adselfservice_plusrce` | Weaponized | | CVE-2022-36537 / EDB-51327 | ZK Framework RCE | Manual PoC | Functional | | CVE-2023-4966 / EDB-51888 | Citrix Bleed Session Leak | Manual PoC | Weaponized | | CVE-2024-3400 / EDB-52023 | PAN-OS GlobalProtect RCE | Manual PoC | Weaponized | | CVE-2022-47966 / EDB-51518 | ManageEngine SAML RCE | `exploit/linux/http/zoho_manageengine_saml_rce` | Weaponized | | CVE-2023-27997 / EDB-51832 | FortiGate SSL-VPN Heap BOF | Manual PoC | Weaponized | | CVE-2023-20198 / EDB-51873 | Cisco IOS XE Priv Esc | Manual PoC | Weaponized | | CVE-2024-6387 / EDB-52098 | OpenSSH regreSSHion | Manual PoC (race) | DoS-only |
PoC Reliability Rubric
| Level | Label | Criteria | Action | |---|---|---|---| | 1 | **Weaponized** | Works out-of-box against target version, produces shell/access reliably | Test directly; log as `CONFIRMED` | | 2 | **Functional** | Requires minor adaptation (change URL, adjust offset) | Modify per target; log as `VERIFIED` | | 3 | **DoS-only** | Crashes service but no code exec | Confirm version, log as `CONFIRMED-DOS` | | 4 | **Theoretical** | Academic writeup, no working code | Write PoC fro
Ships withthreatswarm
27 scope-enforced AI agents that run the full pentest kill-chain (recon → exploit → post-ex → DFIR → report) as a one-command Claude Code plugin. Backed by 754 MITRE-mapped skills.
975 skills27 agents
Stars on GitHub
Momentum
- stars in total
- 97
Other skills on threatswarm.
@mukul975Install Skillmitre-attack
MITRE ATT&CK framework reference — tactics, techniques, and tool-to-TTP mappings for pentest documentation and detection rule…
@mukul975Install Skillreport-templates
CVSS 3.1 vector examples, executive summary template, full technical finding template, and remediation language bank for pentest…
@mukul975Install SkillMore skills from other plugins.
api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
@zhaoxuya520Install Skillabusing-dpapi-for-cred…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
@mukul975Install Skillclean-user-facing-text
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…
@guillaumemeyerInstall Skill
Questions about exploit-db.
- Which coding agents can use exploit-db?
- exploit-db installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.