Exploit Radar — Website Attack Surface Monitor

Continuously watch your own domains for what real attackers actually look for first: named CVEs on your exact CMS/plugin/server version (with a public-exploit flag when one exists), forgotten subdomains, publicly-listable cloud buckets, exposed config files, and more. Run on a schedule; only exposures new since the last check are reported, never the full list dumped as "alerts" on the very first run.

How it works

20 checks, all entirely passive — every single one does exactly what a normal browser or crawler already does when it visits a public page: plain GET requests, a standard TLS handshake, a public DNS lookup, or a read against an existing public threat-intel database (NVD, Shodan's free InternetDB, ransomware.live, certificate transparency logs). Nothing here sends a malicious payload, brute-forces a login, or attempts to bypass any protection — this is read-only reconnaissance of what a site is already broadcasting to the entire internet, not an attack. Use it only on domains you own or are authorized to audit.

Checks

• headers — missing security headers (HSTS, CSP, X-Frame-Options, etc.)
• tls — expired/weak SSL certificate or protocol
• exposed_files — leaked config/backup files (.env, .git, credentials)
• cms — CMS/software version disclosure, cross-checked against named CVEs (with a public-exploit flag)
• wp_plugins — same for WordPress plugins specifically
• server_software — same for the web server itself (Apache/nginx version)
• dns_spoofing — missing SPF/DMARC (email spoofing protection)
• dns_hygiene — missing DNSSEC/CAA
• subdomains — forgotten subdomains found via public certificate records
• subdomain_takeover — a subdomain pointing at an unclaimed cloud service
• exposed_buckets — publicly-listable cloud storage buckets
• exposed_ports — risky open ports and known vulns via Shodan's public database
• breach_history — a confirmed past ransomware attack on this domain
• cookies — missing Secure/HttpOnly/SameSite flags
• cors — overly permissive cross-origin config
• http_downgrade — plain HTTP not redirected to HTTPS
• robots_disclosure — robots.txt tipping off sensitive paths
• js_libraries — outdated JS libraries cross-checked against named CVEs
• source_maps — publicly exposed .map files leaking source code
• db_admin_panels — exposed phpMyAdmin/Adminer database admin tools

Input

• Domains (required) — list of domains you own or are authorized to audit.
• Checks — which of the 20 checks to run (defaults to all).
• Request timeout.

Output

One row per newly-found exposure: domain, category, severity, finding, detail, checked_at.

Known constraints

• CVE matching relies on NVD's public keyword search, which can occasionally surface a loosely-related advisory for very generic product names — always double-check a CRITICAL finding's summary against the actual product before acting on it.
• First-ever check for a domain establishes a silent baseline (no rows) rather than dumping its existing exposures as if they just appeared — alerts start from the second run onward.
• exposed_ports/subdomain_takeover depend on the domain resolving to a public IP; a domain with no A/AAAA record at the apex will skip those specific checks for that run.