Where do you get your exploits from?

[m242]

Quick background example :
You are playing in a time limited CTF, or doing a pentest.
You need a working exploit, and you don’t have time to write and test one yourself.
Which site(s) do you get it from ?

Let me start by sharing the ones I use :

• PacketStorm
• Seebug A lot of exploits descriptions seem to be written in Chinese.
• CxSecurity
• Security Focus
• VulnCode-DB Still in alpha
• Exploit-DB

[EternalEclipse]

Exploit-DB and Metasploit, but honestly just Google.
After that I try to find the bug and understand it myself for practical reasons actually, exploits you find off the Internet are usually badly coded and unstable (if they even run), even when the versions match exactly you have like 75% of something going wrong.

[pry0cc (Leader & Offsec Engineer & Forum Daddy)]

https://sploitus.com/ Is really good.

It searches a bunch of different repositories. You should check out GitHub too if you’re really struggling.

Another tip, is when you’re searching software versions, just include the main version, so if it’s 2.4.23, just search “Software 2.4” or as high level as possible. The reason for this is that some exploits are named with > or < symbols, which your search engine might not understand.

[m242]

Thanks, I didn’t know sploitus

[fxbg (sunjester)]

Every one of those and more, mostly just google

[Narcodex]

I find them myself when I am bored toying with someone software or company