---
name: exploits-advisories
description: >-
  Vulnerability databases, CVE lookup, exploit research, default
  password databases, and security advisories. Use when the user
  wants to look up a CVE, find exploits, check default passwords,
  research vulnerabilities, or browse security advisories.
  Activates for "CVE", "exploit", "vulnerability", "advisory",
  "security bulletin", "default password", "NVD", "Exploit-DB".
user-invocable: false
---

# Exploits & Advisories

Vulnerability databases, CVE lookup, exploit research, default
password databases, and security advisories.

## Legal Notice

All tools use publicly available information only. Exploits and
vulnerability data are for authorized security testing and defensive
purposes only. Never use exploit information for unauthorized access.

## Tools Reference

Read `skills/exploits-advisories/references/tools.md` for the complete
list of 20 free tools in this category.

## Key Web Resources

| Resource | URL | Purpose |
| ---------- | ----- | --------- |
| NVD (NIST) | <https://nvd.nist.gov> | Official US vulnerability database, CVE details |
| Exploit-DB | <https://www.exploit-db.com> | Exploit archive with proof-of-concept code |
| CVE Details | <https://www.cvedetails.com> | CVE browsing by vendor, product, type |
| Vulners | <https://vulners.com> | Aggregated vulnerability intelligence |
| CIRCL CVE Search | <https://cve.circl.lu> | API-accessible CVE database |
| Default Passwords DB | <https://cirt.net/passwords> | Device default credentials |
| Default Password Info | <https://default-password.info> | Default password lookup |
| Router Passwords | <https://www.routerpasswords.com> | Router default credentials |
| Open Sez Me | <https://open-sez.me> | Default password search engine |
| VulDB | <https://vuldb.com> | Vulnerability intelligence and scoring |
| 0day.today | <https://0day.today> | Exploit marketplace and archive |
| Packet Storm | <https://packetstormsecurity.com> | Security tools and exploits |

## CLI / API Access

```bash
# Search NVD via API (no key required for basic queries)
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=apache" | jq '.vulnerabilities[].cve.id'

# Search CVE via CIRCL API
curl -s "https://cve.circl.lu/api/search/apache" | jq '.[].id'

# Search Exploit-DB via searchsploit (if installed)
# Install: apt install exploitdb
searchsploit apache 2.4

# Vulners API (free tier, key required)
curl -s "https://vulners.com/api/v3/search/lucene/?query=apache&apiKey=YOUR_KEY" | jq '.data.search[].title'
```

## Subcategories

- **Default Passwords** — Device and service default credential databases
- **CVE Databases** — NVD, CVE Details, CIRCL, VulDB vulnerability records
- **Exploit Archives** — Exploit-DB, 0day.today, Packet Storm proof-of-concept code
- **Security Advisories** — Vendor bulletins, CERT advisories, patch notifications
- **Vulnerability Scanners** — Web-accessible scanning and assessment tools

## Delegation

### Tool Lookup

```
Agent(
  subagent_type="osint-framework:osint-researcher",
  description="Exploits & Advisories tool search",
  prompt="Find OSINT tools for vulnerability and exploit research.\n
    Read skills/exploits-advisories/references/tools.md\n
    Return recommendations matching the user's specific need."
)
```

### Active Investigation

```
Agent(
  subagent_type="osint-framework:osint-investigator",
  description="Vulnerability research: [target]",
  prompt="Research vulnerabilities for: [target]\n\n
    Primary: Read skills/exploits-advisories/references/tools.md\n
    Secondary: Read skills/threat-intelligence/references/tools.md\n
    Query CVE databases, check default passwords if applicable,
    search exploit archives, report findings with severity ratings."
)
```

## Investigation Workflow

1. **Identify target**: Determine product, version, and vendor
2. **CVE search**: Query NVD and CVE Details for known vulnerabilities
3. **Exploit check**: Search Exploit-DB and Packet Storm for PoC code
4. **Default credentials**: Check default password databases if applicable
5. **Advisory review**: Check vendor security bulletins and CERT advisories
6. **Severity assessment**: Review CVSS scores and exploitability metrics
7. **Threat intel pivot**: Cross-reference with `threat-intelligence` for active exploitation
8. **Document**: Record findings with CVE IDs, severity, and remediation guidance

## Cross-Category Pivots

| Finding | Pivot To | Why |
| --------- | ---------- | ----- |
| Vulnerable service on IP | `ip-address-recon` | Check exposure, port scan |
| Malware exploiting CVE | `malicious-file-analysis` | Analyze associated samples |
| Active threat campaign | `threat-intelligence` | Check IOCs and threat feeds |
| Encoded/obfuscated exploit | `encoding-decoding` | Decode payload |
| Web application vuln | `domain-recon` | Assess target web infrastructure |

## OPSEC Notes

- **All web lookups are passive** — querying CVE databases does not touch the target
- Exploit-DB and NVD queries are logged by those services but carry no risk
- **searchsploit** runs locally against a downloaded database — fully offline
- Never execute exploit code against targets without explicit authorization
- Default password lookups are informational — using credentials without authorization is unauthorized access