> ## Documentation Index
> Fetch the complete documentation index at: https://community.rifteo.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Check Exploit
> Search known exploit databases and sources for a given service, version, or CVE, from searchsploit to Vulners, MSF, and beyond. Trigger when the user has identified a service/version and wants to know if public exploits exist, provides a CVE ID and wants PoC or weaponized exploit references, ran nmap/banner grabbing and wants to cross-reference exploit databases, wants to know if a vulnerability is actively exploited in the wild, or is preparing a pentest report needing exploit evidence references.
**Status:** Stable
**Version:** 1.0.0
**Author:** Rifteo
**Tags:** pentest, security, infrastructure
**Installation**
```bash theme={"system"}
rifteo-skills add check-exploit
```
***
## Summary
Given a service name, version, CVE ID, or technology stack, systematically search every major exploit source in priority order and return a triage table of findings.
* Normalizes the target into a consistent search query before hitting any source
* Searches across Searchsploit, Metasploit, Shodan CVEDB, Vulners, Sploitus, search\_vulns, Sploitify, PacketStorm, and Pompem in order
* Classifies each result by type, auth requirement, reliability, and active exploitation status (CISA KEV)
* Outputs a structured triage table and a ranked highest-severity finding with recommended next steps
***
## SKILL.md file
### Check Exploit
Given a service name, version, CVE ID, or technology stack, systematically search every major exploit source in priority order and return a triage table of findings.
#### What Does It Check?
The skill normalizes the target into a search string, then works through every major exploit source in priority order. For each source it records whether results were found, the exploit ID and title, and whether a working PoC or weaponized exploit exists.
**In scope:**
* Remote/local exploits, web app exploits, privilege escalation, DoS, info disclosure
* CISA KEV status for active exploitation confirmation
* End-of-life version detection via search\_vulns / endoflife.date
**Out of scope:**
* Running or adapting exploits this skill is for discovery and triage only
* Vulnerability scanning requires separate tooling
#### How It Works
**Phase 1: Build the Search Query**
Extract product name, version, and OS/platform from the input. Construct exact, broad, and CVE-based query variants. Identify the vulnerability class if inferable (RCE, LFI, auth bypass, privesc, DoS).
**Phase 2: Systematic Source Search**
Run `scripts/multi-search.py` as the starting point it executes searchsploit locally and generates ready-to-open URLs for all online sources. Then work through each source in order:
1. **Searchsploit** (Exploit-DB offline fastest)
2. **Metasploit** module search by product, platform, port, or CVE
3. **Shodan CVEDB** CVSS, EPSS, CISA KEV status, affected CPEs
4. **Vulners** aggregates NVD, Exploit-DB, packetstorm, vendor advisories
5. **Sploitus** searches Exploit-DB, GitHub PoCs, Packet Storm simultaneously
6. **search\_vulns** aggregates NVD, PoC-in-GitHub, GitHub Security Advisory, endoflife.date
7. **Sploitify** categorized exploits by vulnerability and service type
8. **PacketStorm** fallback for advisories and papers with PoC code
9. **Pompem** searches Exploit-DB, Packet Storm, and NVD in one pass
**Phase 3: Triage and Classify**
For each exploit found, classify by type, auth requirement, reliability (weaponized / PoC / theoretical), and complexity. Check CISA KEV for active exploitation. Priority: weaponized + no auth + remote → Critical.
**Phase 4: Output**
Produce a structured triage table, highest-severity finding summary, and recommended next steps (Metasploit command, PoC adaptation notes, or upgrade advice).
#### Output
| Status | Condition |
| -------- | -------------------------------------------- |
| Critical | Weaponized exploit, no auth required, remote |
| High | PoC published, no auth required, remote |
| Medium | Auth required or local only |
| Low/Info | DoS or information disclosure only |
Example output structure:
```
Target: Apache 2.4.49
Exploit Triage Table:
| Source | ID | Title | Type | Auth | Reliability |
|-------------|------------|------------------------|------------|------|--------------|
| Exploit-DB | EDB-50383 | Apache Path Traversal | Remote RCE | None | PoC |
| Metasploit | exploit/… | Apache Normalize RCE | Remote | None | Weaponized |
Highest-Severity Finding:
CVE: CVE-2021-41773 | Type: Remote RCE | CISA KEV: Listed
```
#### Known Limitations
* Searchsploit requires a local Exploit-DB copy run `searchsploit --update` if results seem stale
* `jku`/`x5u` online sources may be rate-limited or require an account (Vulners, Shodan)
* Google Dork results are unstructured and must be recorded manually
* Never invent exploit IDs, CVE numbers, or GitHub URLs if a source is not accessible
***
## Related skills
Complete SSTI detection and exploitation methodology across all major template engines
Complete XSS testing methodology reflected, stored, DOM, blind, CSP bypass, WAF evasion
Convert raw pentest notes into structured audit findings ready for reporting