Finding Exploits

So, you’ve set up a Kali VM, you’ve used nmap to find open ports, now what? Well now you need to find a vulnerability you want to exploit. There are many ways to find exploits, so I will go over some.

The first method of finding exploits is with the terminal command ‘searchsploit’. After finding the software we want to exploit, we use ‘searchsploit [name of software]’

In this example from my nmap guide, I searched for exploits in a variety of software running on metasploitable. You could run these exploits from here or by adding it to metasploit, but that can wait till later. Right now we are just finding exploits.

Speaking of metasploit, you can use it to find exploits much like you used searchsploit. Metasploit is started with the command ‘msfconsole’.

Metasploit starts with an ASCII art banner, and a ‘msf5′ prompt. We can search for exploits with the ‘search’ command followed by the name of the software we want to find an exploit for. Searching for vsftpd 2.3.4 again outputs the following:

So out of these 5 exploits shown only number 3 is relevant to us. Metasploit shows us more information than searchsploit. Here we can see when the exploit was disclosed (made public), it’s rank, whether or not it is checked, and a description of it, however right now we are just looking at whether or not it is the right version.

There are also websites you can use to find exploits. The one I personally use the most is the Exploit Database, or exploit-db for short so this is the one I will use in this guide. There are lots of them so if you can’t find any exploits on one site, it may be worth looking on others.

On the home page we can see a list of relevant exploits, the sidebar gives more resources, and there is a search bar in the top right corner.

Searching for vsftpd again gives less results than metasploit. We get more information by clicking on the exploit.

This gives us the most information than the others. We can see the author of the exploit, the type (remote or local), the platform, and at the bottom is the source code of the exploit if you can code and want to learn how it works in better detail. You can also download the exploit, however we don’t need to because we have seen that we already have it installed on our box.

This has been a quick rundown on how to find potential exploits to use while hacking. A large amount of hacking is research, so hopefully I have shown you some resources to help you in your research. Like anything else in hacking, there is nothing like a hands on approach so I can’t recommend practicing on metasploitable or CTFs enough.