Skip to main content
Status: Stable Version: 1.0.0 Author: Rifteo Tags: pentest, security, infrastructure
Installation

​
Summary

Given a service name, version, CVE ID, or technology stack, systematically search every major exploit source in priority order and return a triage table of findings.
  • Normalizes the target into a consistent search query before hitting any source
  • Searches across Searchsploit, Metasploit, Shodan CVEDB, Vulners, Sploitus, search_vulns, Sploitify, PacketStorm, and Pompem in order
  • Classifies each result by type, auth requirement, reliability, and active exploitation status (CISA KEV)
  • Outputs a structured triage table and a ranked highest-severity finding with recommended next steps

​
SKILL.md file

​
Check Exploit

Given a service name, version, CVE ID, or technology stack, systematically search every major exploit source in priority order and return a triage table of findings.

​
What Does It Check?

The skill normalizes the target into a search string, then works through every major exploit source in priority order. For each source it records whether results were found, the exploit ID and title, and whether a working PoC or weaponized exploit exists.In scope:
  • Remote/local exploits, web app exploits, privilege escalation, DoS, info disclosure
  • CISA KEV status for active exploitation confirmation
  • End-of-life version detection via search_vulns / endoflife.date
Out of scope:
  • Running or adapting exploits this skill is for discovery and triage only
  • Vulnerability scanning requires separate tooling

​
How It Works

Phase 1: Build the Search QueryExtract product name, version, and OS/platform from the input. Construct exact, broad, and CVE-based query variants. Identify the vulnerability class if inferable (RCE, LFI, auth bypass, privesc, DoS).Phase 2: Systematic Source SearchRun scripts/multi-search.py as the starting point it executes searchsploit locally and generates ready-to-open URLs for all online sources. Then work through each source in order:
  1. Searchsploit (Exploit-DB offline fastest)
  2. Metasploit module search by product, platform, port, or CVE
  3. Shodan CVEDB CVSS, EPSS, CISA KEV status, affected CPEs
  4. Vulners aggregates NVD, Exploit-DB, packetstorm, vendor advisories
  5. Sploitus searches Exploit-DB, GitHub PoCs, Packet Storm simultaneously
  6. search_vulns aggregates NVD, PoC-in-GitHub, GitHub Security Advisory, endoflife.date
  7. Sploitify categorized exploits by vulnerability and service type
  8. PacketStorm fallback for advisories and papers with PoC code
  9. Pompem searches Exploit-DB, Packet Storm, and NVD in one pass
Phase 3: Triage and ClassifyFor each exploit found, classify by type, auth requirement, reliability (weaponized / PoC / theoretical), and complexity. Check CISA KEV for active exploitation. Priority: weaponized + no auth + remote → Critical.Phase 4: OutputProduce a structured triage table, highest-severity finding summary, and recommended next steps (Metasploit command, PoC adaptation notes, or upgrade advice).

​
Output

Example output structure:

​
Known Limitations

  • Searchsploit requires a local Exploit-DB copy run searchsploit --update if results seem stale
  • jku/x5u online sources may be rate-limited or require an account (Vulners, Shodan)
  • Google Dork results are unstructured and must be recorded manually
  • Never invent exploit IDs, CVE numbers, or GitHub URLs if a source is not accessible

ssti-hunter

Complete SSTI detection and exploitation methodology across all major template engines

xss-hunter

Complete XSS testing methodology reflected, stored, DOM, blind, CSP bypass, WAF evasion

finding-writer

Convert raw pentest notes into structured audit findings ready for reporting