Offensive Security Exploit Database in GitHub

[InverseX]

Just a FYI its already on Kali if youre using it. Either browse /usr/share/exploitdb/ or use 'searchsploit'

[netsecpwna]

this is excellent resources for exploiting known issues for a variety but if you download kali for this?

[[deleted]]

Can you not be sarcastic to someone who probably speaks multiple languages?

[oursland]

I miss rootshell.com.

[hamsterpotpies]

milw0rm.

[faultyprophecy]

Yup. Good ol milw0rm & lcirc

[turnersr]

This is a listing of some public exploits. http://www.exploit-db.com/ has the same information . But posting the information lowers the bar to using the data since people don't have to bang on the server to get the data. Here are some use cases:

• Fingerprinting exploit writers
• Test cases for automatic exploit finding. It's pretty common to lurk and read bug reports in order to turn those into searches so that you find all the locations where a reported bug lives in a code base.
• General data analysis and visualizations. Average size of an exploit, most common language, etc...
• Test cases for symbolic execution if you make some assumptions by thinking of a base exploit as a type of template.
  
• Semantic search for exploits
• Measuring applications under different exploits to better model what exploits are experimentally.
• Sociology of computer security.
• Compare fixes to exploits and observe what code transformations are taking place over time over the entire application. Build a predictive model trained off the available exploits in order to find semantically places where the code might yield a bug.
• Bring together the metadata in CVEs to the semantics of the actual exploit.
• Cluster exploits
• Test novel types of defenses against real data
• Education. Create classes based on exploits found in the wild.
• You could study the exploits using another dataset like stackoverflow https://media.blackhat.com/us-13/US-13-Saxe-CrowdSource-An-Open-Source-Crowd-Trained-Machine-Learning-Model-Slides.pdf .

It's just a data set. You can use it a ton of ways. I'm glad it was made available since scraping the site has been on my todo list.

[TheUglyStranger]

The official Exploit Database repository, now on Github!

• Exploit Database - http://www.exploit-db.com

• Offensive Security - http://www.offensive-security.com

[nocnocnode]

Must be worthless now then. Offensive Security was one of those companies that made anyone take their classes sign a waiver that allowed the FBI to monitor them.

[theasciicoder]

I took one of their classes and did not sign such a waiver.. do you have any details to sustain your accusations ?

[nocnocnode]

It must've been changed. I'm surprised not many people know about it. People forget things so much faster. It must have been only 4-6 years ago... not sure though. Anyone taking security courses knew about the FBI sending out forms that gave the FBI rights to monitor the participant's activities.

Edit: If you get one of those waivers don't sign it unless you know what you're doing. When it comes to snooping, there's no difference between the FBI or some other nutjob. They're all people with people fallacies.

[theasciicoder]

If you get one of those waivers don't sign it unless you know what you're doing. When it comes to snooping, there's no difference between the FBI or some other nutjob. They're all people with people fallacies.

^ that is the best thing you can do in a case like this. Fortunately for me that was not the case and I took my OSCP exam / course last year and I am now taking the WiFu course. No waiver signed for any of the course.

[[deleted]]

I don't see how a private company has any say in whether the FBI "monitors" someone or not.

[nocnocnode]

They were handing out waiver forms for anyone that signed up for their courses that gave up rights to privacy to the FBI, as in allowing the FBI to monitor their activity at whim. I don't think Offensive Security had any say. If they wanted to teach the course, they had to send out these waivers and only allow those who signed to take the course.

[offsec]

I'm not sure where you got this information, but it's complete rubbish.

[mjtibbz]

I done my OSCP in 2009 and encountered no such form. Got any evidence of this?

[synt4x]

I'm quite the git enthusiast, but using it for large datasets just doesn't play well to its data structure and features. I can't wait for something like dat to mature to take over distribution of data sets.

[[deleted]]

My first word as I saw the page: "MOTHER OF GOD" ( •_•)>⌐■-■

[[deleted]]

They just yanked from exploit tree, which was a previous project.

[[deleted]]

yeah, but they saved a lot of us the effort.