Why Getsploit

• 🔎 One query, every collection. Exploit-DB, Metasploit, Packet Storm, Zero Day Initiative, GitHub proof-of-concepts and more, as indexed by Vulners.
• 📴 Works with the network off. One --update builds a local SQLite FTS5 index of the whole exploit corpus; every later search is a local query.
• 🧠 Searches for what you typed. wordpress 4.7, CVE-2024-3094 and ms17-010 match literally, while a deliberate full-text expression still gets full FTS5 syntax.
• 📊 Progress you can trust. Every stage of an update reports real numbers, and the two stages whose size cannot be known say so instead of inventing a percentage.
• 🧾 Pipe-friendly. JSON, JSON Lines, and stable tab-separated records when the output is redirected. No colour or decoration ever reaches a machine format.
• 💾 Keeps the source. --mirror writes each exploit body to its own file.
• 🔐 Careful with your data. The key is never a command-line argument, the key file is opened without following symlinks, and downloaded content is never executed.
• 🧪 Verified. 100% statement and branch coverage on Python 3.11 through 3.14, on Linux, macOS and Windows.

Install

Getsploit needs Python 3.11 or newer.

$ pipx install getsploit

$ uv tool install getsploit

$ python -m pip install getsploit

API key

Create a key in your Vulners account, then expose it through the environment:

$ export VULNERS_API_KEY="your-key"  # pragma: allowlist secret

$env:VULNERS_API_KEY = "your-key"  # pragma: allowlist secret

getsploit --set-key stores a key through a hidden confirmation prompt, in a private file under the Getsploit home. The environment takes precedence over that file and is the better choice for automation. There is no --api-key option: a key passed on the command line ends up in the shell history and in the process list.

Online search and --update need a key. --local and --status do not.

Usage

Online search

$ getsploit CVE-2024-3094
$ getsploit "wordpress 4.7 remote code execution" --count 25

The query reaches Vulners unchanged, so its Lucene syntax works as documented:

$ getsploit 'title:wordpress AND description:"code execution"'

--count above 100 is paged transparently; a single API response never carries more than 100 documents.

Offline search

$ getsploit --update                 # download the archive and build the FTS5 index
$ getsploit --status                 # where it is, how big, how many documents
$ getsploit --local wordpress 4.7

Ordinary search words are matched literally, so identifiers and version numbers work as typed: wordpress 4.7, CVE-2024-3094, ms17-010. A query that uses column filters, boolean operators, quotes, parentheses, * or ^ is treated as an SQLite FTS5 expression and reports its own error when malformed:

$ getsploit --local 'title:eternalblue AND NOT description:metasploit'

Searchable columns are id, title, published, description and source_data. The legacy sourceData: spelling is still accepted.

Saving exploit sources

$ getsploit --mirror wordpress 4.7
$ getsploit --local --mirror eternalblue

Files land in a directory derived from the query, one file per exploit, created without following symlinks and never overwriting anything that already exists.

[!WARNING] Mirrored files are untrusted third-party code. Read them before running them.

Machine-readable output

$ getsploit --format json CVE-2024-3094
$ getsploit --format jsonl wordpress | jq -r .id
$ getsploit wordpress > results.tsv       # redirected output is tab-separated

--json remains an alias for --format json.

Terminal control

$ getsploit --color always query | less -R
$ getsploit --color never query

Colour defaults to auto. A wide terminal gets a table, a narrow one gets stacked records, and a redirected stream gets tab-separated values — the same data in all three.

Run getsploit --help for the full option list.

The local database

An update downloads the archive over eight parallel range connections, unpacks and converts it beside the destination, verifies it, and only then commits. Memory use does not depend on the size of the archive. A search already running against the old database finishes against it undisturbed.

Databases built by Getsploit 2.x remain searchable; the next --update migrates them from FTS4 to FTS5. FTS4 proximity expressions such as one NEAR/5 two must be rewritten in the FTS5 NEAR(...) form.

Compatibility

Development

$ git clone https://github.com/vulnersCom/getsploit.git
$ cd getsploit
$ uv sync --all-groups
$ make check

CONTRIBUTING.md has the contribution rules and ARCHITECTURE.md the module boundaries and database invariants.

A release is a pushed v<version> tag. From there the release workflow re-runs the full gate on the tagged commit, publishes to PyPI through trusted publishing, and writes the GitHub release from the changelog. No PyPI token exists to leak.

Security

Exploit source files are untrusted content: review them before opening or running them. Getsploit itself never executes what it downloads.

Releases are published from GitHub Actions through PyPI trusted publishing, so no long-lived API token exists to leak, and every artifact carries a build provenance attestation. To report a vulnerability in Getsploit, follow SECURITY.md.

License

MIT © Vulners Team and contributors.