getsploit - Search and download public exploits from the Vulne

项目说明

<di="center">

Getsploit

**Search and download public exploits from the database —
online, or fully offline from a local index.**

![PyPI]()
![Python]()
![Downloads]()
![Stars]()
![CI]()
![CodeQL]()
![OpenSSF Scorecard]()
![Co]()
![Typed]()
![Ruff]()
![uv]()

Get an API key ·
search ·
Changelog ·
Architecture ·
Security policy

<img src="
alt="Getsploit searching online, building a local FTS5 index, then searching and mirroring offline"
width="900">

</div>

---

Why Getsploit

🔎 One query, every collection. Exploit-DB, Metasploit, Packet Storm, Zero Day

Initiati proof-of-concepts and more, as indexed by .

📴 Works with the network off. One --update builds a local SQLite FTS5 index of

the whole exploit corpus; every later search is a local query.

🧠 Searches for what you typed. wordpress 4.7, C and ms17-010

match literally, while a deliberate full-text expression still gets full FTS5 syntax.

📊 Progress you can trust. Every stage of an update reports real numbers, and the

two stages whose size cannot be known say so instead of in a percentage.

🧾 Pipe-friendly. JSON, JSON Lines, and stable tab-separated records when the

output is redirected. No colour or decoration e a machine format.

💾 Keeps the source. --mirror writes each exploit body to its own file.

🔐 Careful with your data. The key is never a command-line argument, the key file

is opened without following symlinks, and downloaded content is ne.

🧪 . 100% statement and branch co on Python 3.11 through 3.14, on

Linux, macOS and Windows.

---

Install

Getsploit needs Python 3.11 or newer.

API key

Create a key in your account, then expose it
through the en:

getsploit --set-key stores a key through a hidden confirmation prompt, in a private
file under the Getsploit home. The en takes precedence over that file and is
the better choice for automation. There is no --api-key option: a key passed on the
command line ends up in the shell history and in the process list.

Online search and --update need a key. --local and --status do not.

Usage

Online search

The query reaches unchanged, so its
Lucene syntax works as documented:

--count above 100 is paged transparently; a single API response ne more
than 100 documents.

Offline search

Ordinary search words are matched literally, so identifiers and numbers work as
typed: wordpress 4.7, C, ms17-010. A query that uses column filters,
boolean operators, quotes, parentheses, * or ^ is treated as an
SQLite FTS5 expression and reports its own error
when malformed:

Searchable columns are id, title, published, description and source_data. The
legacy sourceData: spelling is still accepted.

Saving exploit sources

Files land in a directory derived from the query, one file per exploit, created without
following symlinks and ne anything that already exists.

> [!WARNING]
> Mirrored files are untrusted third-party code. Read them before running them.

Machine-readable output

--json remains an alias for --format json.

Terminal control

Colour defaults to auto. A wide terminal gets a table, a narrow one gets stacked
records, and a redirected stream gets tab-separated — the same data in all three.

Run getsploit --help for the full option list.

The local database

| | |
| --- | --- |
| Location | ~/.getsploit/getsploit.db, or $GETSPLOIT_HOME |
| Format | SQLite with an external-content FTS5 index |
| Tokenizer | unicode61 remo 2 |
| Size | roughly 1.7 GB for the full corpus |
| Update | atomic: the new database replaces the old one in a single operation |

An update downloads the archive o parallel range connections, unpacks and
converts it beside the destination, it, and only then commits. Memory use does
not depend on the size of the archive. A search already running against the old database
finishes against it undisturbed.

Databases built by Getsploit 2.x remain searchable; the next --update migrates them
from FTS4 to FTS5. FTS4 proximity expressions such as one NEAR/5 two must be rewritten
in the FTS5 NEAR(...) form.

Compatibility

| | |
| --- | --- |
| Python | 3.11, 3.12, 3.13, 3.14 |
| Operating systems | Linux, macOS, Windows |
| SDK | 4.1 and newer 4.x |
| Runtime dependencies | click, rich, |

De

| Command | Purpose |
| --- | --- |
| make format | Format and autofix source files |
| make lint | Check formatting, lint, and types |
| make test | Run tests in parallel |
| make co | Enforce 100% statement and branch co |
| make leaks | Scan tracked files for secrets |
| make build | Build the wheel and source distribution |
| make release | Run every gate and both distributions |
| make check | E above that gates a merge |

CONTRIBUTING.md has the contribution rules and
ARCHITECTURE.md the module boundaries and database in.

A release is a pushed v<> tag. From there
the release workflow re-runs the full gate on the
tagged commit, publishes to PyPI through trusted publishing, and writes the GitHub
release from the changelog. No PyPI token exists to leak.

Security

Exploit source files are untrusted content: review them before opening or running them.
Getsploit itself ne what it downloads.

Releases are published from GitHub Actions through PyPI trusted publishing, so no
long-lived API token exists to leak, and every artifact carries a build pro
attestation. To report a in Getsploit, follow SECURITY.md.

License

MIT © Team and contributors.

项目信息

开发语言：Python

Star 数：1824

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Search and download public exploits from the Vulners database — online, or fully offline from a local SQLite FTS5 index.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。