Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mukul975/threatswarm/exploit-dbnpx skills add mukul975/Threatswarm --skill exploit-dbgit clone --depth 1 https://github.com/mukul975/ThreatswarmWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mukul975/threatswarm/exploit-db)<a href="https://agentmods.dev/skills/mukul975/threatswarm/exploit-db"><img src="https://agentmods.dev/badge/skills/mukul975/threatswarm/exploit-db.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00040 | $0.03179 |
| Opus 5 | $0.00020 | $0.01589 |
| Sonnet 5 | $0.00008 | $0.00636 |
| Haiku 4.5 | $0.00004 | $0.00318 |
Grade A, and why
exploit-db scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 189 lines — stays where its author put it; the contents beside it link to each section on GitHub.
searchsploit Usage Patterns
# Text search in title/path
searchsploit apache 2.4
# Search by CVE
searchsploit --cve CVE-2021-41773
searchsploit --cve CVE-2021-44228
# JSON output for scripting
searchsploit apache --json | python3 -c "
import sys, json
data = json.load(sys.stdin)
for e in data.get('RESULTS_EXPLOIT', []):
print(e['EDB-ID'], e['Title'], e['Path'])
"
# Copy exploit to working dir
searchsploit -m 50383
# Update database
searchsploit -u
# Search by nmap XML output
searchsploit --nmap nmap_output.xml
# Filter by type (webapps, local, remote, dos)
searchsploit -t "remote" apache
# Search for specific OS
searchsploit windows 10 privilege escalation
# Show only exploits (not shellcodes/papers)
searchsploit wordpress --www-exploit-db
EDB → Metasploit Module Mapping (Top 40 Vulnerabilities)
| CVE / EDB-ID | Vulnerability | Metasploit Module | Reliability |
|---|---|---|---|
| CVE-2017-0144 / EDB-41891 | MS17-010 EternalBlue | exploit/windows/smb/ms17_010_eternalblue |
Weaponized |
| CVE-2021-44228 / EDB-50592 | Log4Shell RCE | exploit/multi/http/log4shell_header_injection |
Weaponized |
| CVE-2021-1675 / EDB-50265 | PrintNightmare | exploit/windows/dcerpc/cve_2021_1675_printnightmare |
Weaponized |
| CVE-2021-34473 / EDB-50243 | ProxyShell Exchange | exploit/windows/http/exchange_proxyshell_rce |
Weaponized |
| CVE-2020-1472 / EDB-49071 | ZeroLogon | auxiliary/admin/dcerpc/cve_2020_1472_zerologon |
Weaponized |
| CVE-2022-22965 / EDB-50798 | Spring4Shell | exploit/multi/http/spring_framework_rce_spring4shell |
Weaponized |
| CVE-2019-19781 / EDB-47901 | Citrix ADC Path Traversal | exploit/linux/http/citrix_dir_traversal_rce |
Weaponized |
| CVE-2020-5902 / EDB-48695 | F5 BIG-IP RCE | exploit/linux/http/f5_bigip_tmui_rce |
Weaponized |
| CVE-2021-26855 / EDB-49637 | ProxyLogon Exchange | exploit/windows/http/exchange_proxylogon_rce |
Weaponized |
| CVE-2022-26134 / EDB-51076 | Confluence OGNL RCE | exploit/multi/http/atlassian_confluence_namespace_ognl_injection |
Weaponized |
| CVE-2018-13379 / EDB-47288 | FortiOS Path Traversal | auxiliary/gather/fortios_vpn_user_cred |
Functional |
| CVE-2022-1388 / EDB-50919 | F5 iControl Auth Bypass | exploit/linux/http/f5_icontrol_rce |
Weaponized |
| CVE-2021-20038 / EDB-50882 | SonicWall SMA Stack Overflow | exploit/linux/http/sonicwall_sma_overflow |
Functional |
| CVE-2023-46604 / EDB-51880 | Apache ActiveMQ RCE | exploit/multi/misc/apache_activemq_rce_cve_2023_46604 |
Weaponized |
| CVE-2021-3156 / EDB-49521 | Sudo Baron Samedit | exploit/linux/local/sudo_baron_samedit |
Weaponized |
| CVE-2021-4034 / EDB-50689 | PwnKit polkit LPE | exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec |
Weaponized |
| CVE-2022-0847 / EDB-50808 | Dirty Pipe Linux LPE | exploit/linux/local/cve_2022_0847_dirtypipe |
Weaponized |
| CVE-2016-5195 / EDB-40616 | Dirty COW Linux LPE | exploit/linux/local/overlayfs_priv_esc |
Weaponized |
| CVE-2014-6271 / EDB-34766 | Shellshock Bash RCE | exploit/multi/http/apache_mod_cgi_bash_env_exec |
Weaponized |
| CVE-2017-5638 / EDB-41570 | Apache Struts2 RCE | exploit/multi/http/struts2_content_type_ognl |
Weaponized |
| CVE-2019-0708 / EDB-47416 | BlueKeep RDP RCE | exploit/windows/rdp/cve_2019_0708_bluekeep_rce |
Functional |
| CVE-2020-0796 / EDB-48260 | SMBGhost RCE | exploit/windows/smb/cve_2020_0796_smbghost |
Functional |
| CVE-2018-7600 / EDB-44449 | Drupalgeddon2 RCE | exploit/unix/webapp/drupal_drupalgeddon2 |
Weaponized |
| CVE-2019-0211 / EDB-46676 | Apache HTTPd LPE | exploit/multi/http/apache_mod_cgi_bash_env_exec |
Functional |
| CVE-2015-1701 / EDB-37367 | Windows Win32k LPE | exploit/windows/local/ms15_051_client_copy_image |
Weaponized |
| CVE-2020-14882 / EDB-49391 | Oracle WebLogic RCE | exploit/multi/http/oracle_weblogic_admin_handle_rce |
Weaponized |
| CVE-2021-22005 / EDB-50513 | vCenter File Upload | exploit/linux/http/vmware_vcenter_uploadova_rce |
Weaponized |
| CVE-2022-41040 / EDB-51917 | ProxyNotShell Exchange | exploit/windows/http/exchange_proxynotshell_rce |
Functional |
| CVE-2023-22515 / EDB-51899 | Confluence Priv Esc | Manual PoC required | Functional |
| CVE-2024-21762 / EDB-51960 | FortiOS OOB Write | Manual PoC required | Weaponized |
| CVE-2019-11510 / EDB-47297 | Pulse Secure Arb File Read | auxiliary/gather/pulse_secure_file_read |
Weaponized |
| CVE-2020-3452 / EDB-48577 | Cisco ASA Path Traversal | auxiliary/gather/cisco_asa_local_file_inclusion |
Weaponized |
| CVE-2021-40539 / EDB-50781 | ManageEngine RCE | exploit/multi/http/manageengine_adselfservice_plusrce |
Weaponized |
| CVE-2022-36537 / EDB-51327 | ZK Framework RCE | Manual PoC | Functional |
| CVE-2023-4966 / EDB-51888 | Citrix Bleed Session Leak | Manual PoC | Weaponized |
| CVE-2024-3400 / EDB-52023 | PAN-OS GlobalProtect RCE | Manual PoC | Weaponized |
| CVE-2022-47966 / EDB-51518 | ManageEngine SAML RCE | exploit/linux/http/zoho_manageengine_saml_rce |
Weaponized |
| CVE-2023-27997 / EDB-51832 | FortiGate SSL-VPN Heap BOF | Manual PoC | Weaponized |
| CVE-2023-20198 / EDB-51873 | Cisco IOS XE Priv Esc | Manual PoC | Weaponized |
| CVE-2024-6387 / EDB-52098 | OpenSSH regreSSHion | Manual PoC (race) | DoS-only |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 189 lines · 40 tokens per session scan A 3ffdc07bfeae
exploit-db is a skill published in the GitHub repository mukul975/Threatswarm (77 stars, last pushed 4mo ago), licensed MIT. It adds 40 tokens to every session and 3,179 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
credential-attack
Password spray methodology for bug bounty — when to do it vs web-vuln hunting, the wordlist-gen + breach-check + osint-employees + spray pipeline, mode selection (http-form / oauth / o365 / okta), rate-limit + lockout tactics, BBP legal guardrails, success detection, and the spray → authenticated /hunt chain pattern.…
mobile-pentest
Mobile app pentest for bug bounty (Android APK + iOS IPA) — runtime-first workflow: install app, proxy through Burp/mitmproxy, drive the UI, capture packets, then test the API exactly like a web target; escalate to decompile (apktool/jadx) and Frida/objection only when traffic is SSL-pinned, encrypted, or absent.…
argus
Argus — the all-seeing scanner suite. Six automated scanners for high-value web + LLM bug classes — CORS misconfiguration (origin reflection / null / credentialed read), CRLF & host-header injection, NoSQL injection (operator auth-bypass / $where blind), JWT attacks (alg:none / RS256→HS256 confusion / secret crack)…
bugcrowd-reporting
Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints…
enterprise-vpn-attack
External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials…
hunt-api-misconfig
Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {isadmin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this…