Practical Web Penetration Testing

Finding exploits

Generally speaking, 99% of the time, the vulnerability scanner will tell you where to find the exploit in order to replicate it from your end. Here's where to find most of the exploits:

• Google it—it sounds simple, but it's my favorite method
• Exploit-db at http://www.exploit-db.com
• The searchsploit tool in Kali Linux
• Metasploit—use the search command to find it
• Security Focus at http://www.securityfocus.com
• Sometimes you will find them on GitHub, at http://www.github.com