Playbook: Finding exploits

Metasploit: search for the name of the software and/or version.

Google or other search engines: search for the name of the software and/or version, + "exploit"

Google the CVE + "poc" (proof of concept) to find code for the exploit. (Don't necessarily trust it - verify its functionality and safety.)