Public exploit finder
Start with the exact product/component, version/build, platform and architecture. Search for a matching public PoC, then check its prerequisites in the linked procedure. A search result or missing-patch suggestion is a candidate, not confirmed exploitability.
Search for a public exploit
| Resource | What to look for |
|---|---|
| Exploit-DB | Product/version or CVE; narrow by platform and exploit type. SearchSploit searches a local Exploit-DB copy. |
| GitHub repository search | Exact CVE or product plus exploit / PoC. Prefer the researcher's original source; inspect code and prerequisites rather than trusting stars or a filename. |
| Packet Storm | Search Files by CVE or product for public exploits and original advisories. |
| Rapid7 database | CVE/product references and module descriptions. Reading a module is distinct from using Metasploit; its exam restrictions still apply. |
Search the precise version first, then the product/component and affected version range. If a CVE is known, search that identifier directly. No result does not rule out a misconfiguration or an exploit absent from that index.
Check the affected range: NVD CVE search, the vendor's original advisory, and for Windows MSRC / Update Catalog. These establish affected products and fixes; they are not guarantees that usable exploit code exists.
For offline search, code review and adaptation, use Review a public exploit candidate. Keep the original URL and any changes needed for reproduction. Follow the current exam restrictions when selecting a tool or feature.
Match host details to candidate exploits
| Resource | Selection cue | Notes |
|---|---|---|
| WES-NG Command options False-positive guidance | Analyze saved Windows systeminfo on Kali; verify build, installed KBs and supersedence. | Windows Privesc Windows Privesc |
| Linux Exploit Suggester 2 | Kernel-version candidates; distribution backports and configuration can invalidate a match. | Linux Privesc Linux Privesc |
| Watson — legacy alternative | Target-side .NET checks for the explicitly supported older Windows builds; not a second mandatory pass. | Windows Privesc Windows Privesc |
Exploit references already used in the notes
These links are collected from the owning track pages. Open Notes for prerequisites, commands and verification. The list includes public PoCs, legacy collections and conditional technique references; it does not recommend running every entry.
| Resource | Selection cue | Notes |
|---|---|---|
| Windows kernel exploit collection CVE-2018-8120 source CVE-2018-8120 x64 artifact | Legacy collection, including the existing CVE-2018-8120 example; check exact build/architecture and source. | Windows Privesc Windows Privesc |
| Juicy Potato and CLSID references CLSID list | Legacy COM/token path; compatible OS, token privilege and CLSID are required. | Windows Privesc Windows Privesc |
| Juicy Potato legacy CLSID site | Older supporting reference; use the repository CLSID list if unavailable. | Windows Privesc |
| PrintSpoofer | Conditional Windows token/print-spooler path; verify the owning procedure. | Windows Privesc Windows Privesc |
| Windows token privilege research | Privilege-specific mechanisms; a listed privilege alone is not a confirmed elevation. | Windows Privesc Windows Privesc |
| Event Viewer UAC bypass | Conditional UAC technique; existing administrator membership and build/context matter. | Windows Privesc Windows Privesc |
| AppLocker bypass references | Application-control context and allowed execution paths; not a universal bypass. | Transfer Files |
| ZeroLogon public PoC and recovery guidance | Legacy affected DCs only; follow the patch/configuration and recovery conditions. | AD Lateral Movement AD Lateral Movement |
| GTFOBins — permission-based techniques | Use a discovered sudo/SUID/capability condition; this is not a CVE or kernel exploit database. | Linux Privesc Linux Privesc |