Hack Like a Pro: How to Find  Exploits Using the Exploit Database in Kali « Null Byte :: WonderHowTo

Welcome back, my budding hackers!When we are looking for ways to hack a system, we need a specific exploit to take advantage of a certain vulnerability in the operating system, service, or application. Although I have shown you multiple ways to exploit systems here inNull Byte, there are still many more exploits available that I have not yet shown you.Remember, exploitation is very specific, there is no one silver bullet that will allow you to exploit all systems. You need to find an exploit that will specifically take advantage of a vulnerability in the system that you are attacking. That is where theExploit Databasecan be so incredibly useful.EDB is a project ofOffensive Security, the same folks who developedBackTrackandKali Linux, which includes exploits categorized by platform, type, language, port, etc. to help you find the exploit that will work in your particular circumstance. Then, if you feel it will work on your target, you can simply copy and paste it into Kali for your attack.Step 1: Fire Up Kali & Open a BrowserLet's start by firing up Kali and opening a browser, such as Iceweasel, the default browser in Kali (EDB can be reached from any browser, in any operating system). If we use the default browser in Kali, we can see that there is a built-in shortcut to the "Exploit-DB" in the browser shortcut bar, as seen below.When we click on it, it takes us to the Exploit Database, as seen below.If you are not using Iceweasel and its built-in shortcut, you can navigate to Exploit-DB by typingwww.exploit-db.comin the URL bar.Step 2: Search the Exploit DatabaseIf we look at the top menu bar in the Exploit Database website, second from the right is a menu item called "Search". When we click on it, it enables us to search the database of exploits and returns a search function screen similar to the screenshot below.Let's use this search function to find some recent Windows exploits (we are always looking for new Windows exploits, aren't we?). In the search function window, we can enter any of the following information;DescriptionFree Text SearchAuthorPlatform (this is the operating system)TypeLanguagePortOSVDB (theOpen Source Vulnerability Database)CVE (Common Vulnerability and Exploits)The last two fields can be used if you are specifically looking for an exploit that takes advantage of a known, numbered vulnerability in either of those databases.In the Platform field, enter "Windows", in the Type field, enter "remote", and in the Free Text Search box, enter "Office". When we do so, the Exploit Database returns a list and a link to all of the exploits that meet those criteria. Of course, you can put in whatever criteria you are searching for. I am only using these as an example.Step 3: Open an ExploitFrom the search results page, we can click on any of the two pages of search results and it will take us to the particular exploit. I clicked on the very first exploit in the list "Internet Explorer TextRange Use-After Free (MS14_012)". When I do so, I am brought to a screen that displays the exploit code like that below. I have circled the description in the code of the exploit.This exploit works against Internet Explorer that was built between August 2013 and March 2014. If you want to use it, you can simply copy and paste this text file and put it into the exploit directory inMetasploit(if you are using an up-to-date version of Metasploit, it is already included). This is a good example of how specific an exploit can be.Step 4: Open Up SearchsploitKali, having also been developed by Offensive Security, has built into it a local database of exploits based on the same Exploit Database. We can access it by going to Applications -> Kali Linux -> Exploitation Tools -> Exploit Database and clicking onsearchsploitas shown below.It will open a screen like that below that details the basic syntax on how to use searchsploit. Note that it explains that you must use lowercase search terms and that it searches a CSV (comma separated values) file from left to right, so search term order matters.Step 5: Search the Exploit Database with SearchsploitNow that we have opened a terminal for searchsploit, we can now use this tool to search our local copy of the Exploit Database. As you might expect, our local copy of the exploit database is much faster to search, but does NOT have all the updates that the online database does. Despite this, unless we looking for the very latest exploits, the local database works fast and is effective.One other note on its use. As the information is organized in CSV files, searches locally often will yield results slightly differently than the online database. In the screenshot below, I searched for "Windows" and "Office" and only received a single result, unlike what I received when I used the online database.Exploit Database is an excellent repository for exploits and other hacks that we might need, including new Google hacks, white papers on security and hacking, denial of service (DOS) attacks, and shellcode that you can use out the box or tailor for your unique attack.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image via Offensive Security,ShutterstockRelatedHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Top 10 Exploit Databases for Finding VulnerabilitiesHack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHow To:Hack WPA WiFi Passwords by Cracking the WPS PINHack Like a Pro:Metasploit for the Aspiring Hacker, Part 9 (How to Install New Modules)Hack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHack Like a Pro:How Windows Can Be a Hacking Platform, Pt. 1 (Exploit Pack)Hack Like a Pro:Hacking Windows XP Through Windows 8 Using Adobe Flash PlayerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)How To:Hack Your Kindle Touch to Get It Ready for Homebrew Apps & MoreHow To:Use MinGW to Compile Windows Exploits on Kali LinuxHack Like a Pro:How to Find Almost Every Known Vulnerability & Exploit Out ThereHow To:Hack Android Using Kali (Remotely)How To:Easily Find an Exploit in Exploit DB and Get It Compiled All from Your Terminal.Hack Like a Pro:How to Exploit Adobe Flash with a Corrupted Movie File to Hack Windows 7How to Hack Like a Pro:Getting Started with MetasploitHow To:Run an VNC Server on Win7Hack Like a Pro:How to Hack Web Apps, Part 7 (Finding Hidden Objects with DIRB)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 7 (Autopwn)How To:Perform Local Privilege Escalation Using a Linux Kernel ExploitHow To:Create a Metasploit Exploit in Few MinutesHow to Hack Databases:Cracking SQL Server Passwords & Owning the ServerHow To:The Art of 0-Day Vulnerabilities, Part3: Command Injection and CSRF VulnerabilitiesHack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)Hack Like a Pro:Exploring Metasploit Auxiliary Modules (FTP Fuzzing)Hack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHack Logs and Linux Commands:What's Going On Here?How Null Byte Injections Work:A History of Our NamesakeNews:Intel Core 2 Duo Remote Exec Exploit in JavaScriptGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsIPsec Tools of the Trade:Don't Bring a Knife to a Gunfight