# Exploit Radar — Website Attack Surface Monitor (`0xgollum/exploit-radar`) Actor

20 passive, legal checks that watch your domains for what attackers actually look for first: named CVEs with a public-exploit flag, exposed files/buckets, forgotten subdomains, weak SSL, and more. Only new exposures are reported after the baseline check.

- **URL**: https://apify.com/0xgollum/exploit-radar.md
- **Developed by:** [0xGollum](https://apify.com/0xgollum) (community)
- **Categories:** Automation, Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $250.00 / 1,000 exposure findings

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Exploit Radar — Website Attack Surface Monitor

Continuously watch your own domains for what real attackers actually look for first: named
CVEs on your exact CMS/plugin/server version (with a public-exploit flag when one exists),
forgotten subdomains, publicly-listable cloud buckets, exposed config files, and more. Run on
a schedule; only exposures new since the last check are reported, never the full list dumped
as "alerts" on the very first run.

### How it works

20 checks, all entirely passive — every single one does exactly what a normal browser or
crawler already does when it visits a public page: plain GET requests, a standard TLS
handshake, a public DNS lookup, or a read against an existing public threat-intel database
(NVD, Shodan's free InternetDB, ransomware.live, certificate transparency logs). Nothing here
sends a malicious payload, brute-forces a login, or attempts to bypass any protection — this
is read-only reconnaissance of what a site is already broadcasting to the entire internet, not
an attack. Use it only on domains you own or are authorized to audit.

### Checks

- **headers** — missing security headers (HSTS, CSP, X-Frame-Options, etc.)
- **tls** — expired/weak SSL certificate or protocol
- **exposed\_files** — leaked config/backup files (.env, .git, credentials)
- **cms** — CMS/software version disclosure, cross-checked against named CVEs (with a
  public-exploit flag)
- **wp\_plugins** — same for WordPress plugins specifically
- **server\_software** — same for the web server itself (Apache/nginx version)
- **dns\_spoofing** — missing SPF/DMARC (email spoofing protection)
- **dns\_hygiene** — missing DNSSEC/CAA
- **subdomains** — forgotten subdomains found via public certificate records
- **subdomain\_takeover** — a subdomain pointing at an unclaimed cloud service
- **exposed\_buckets** — publicly-listable cloud storage buckets
- **exposed\_ports** — risky open ports and known vulns via Shodan's public database
- **breach\_history** — a confirmed past ransomware attack on this domain
- **cookies** — missing Secure/HttpOnly/SameSite flags
- **cors** — overly permissive cross-origin config
- **http\_downgrade** — plain HTTP not redirected to HTTPS
- **robots\_disclosure** — robots.txt tipping off sensitive paths
- **js\_libraries** — outdated JS libraries cross-checked against named CVEs
- **source\_maps** — publicly exposed .map files leaking source code
- **db\_admin\_panels** — exposed phpMyAdmin/Adminer database admin tools

### Input

- **Domains** (required) — list of domains you own or are authorized to audit.
- **Checks** — which of the 20 checks to run (defaults to all).
- **Request timeout**.

### Output

One row per newly-found exposure: `domain`, `category`, `severity`, `finding`, `detail`,
`checked_at`.

### Known constraints

- CVE matching relies on NVD's public keyword search, which can occasionally surface a
  loosely-related advisory for very generic product names — always double-check a CRITICAL
  finding's summary against the actual product before acting on it.
- First-ever check for a domain establishes a silent baseline (no rows) rather than dumping
  its existing exposures as if they just appeared — alerts start from the second run onward.
- `exposed_ports`/`subdomain_takeover` depend on the domain resolving to a public IP; a domain
  with no A/AAAA record at the apex will skip those specific checks for that run.

# Actor input Schema

## `domains` (type: `array`):

Domains you own or are authorized to audit (no https://, no path). Checked over HTTPS. Run on a schedule - only exposures new since the last check are reported.

## `checks` (type: `array`):

headers = missing security headers. tls = SSL/TLS cert & protocol issues. exposed\_files = leaked config/backup files. cms = CMS/software version disclosure, cross-checked against real named CVEs (with public-exploit flag). dns\_spoofing = missing SPF/DMARC (email spoofing protection). subdomains = forgotten subdomains found via public certificate records. exposed\_buckets = publicly-listable cloud storage buckets. exposed\_ports = open ports/known vulns via Shodan's public database. breach\_history = confirmed past ransomware attack on this domain. cookies = missing Secure/HttpOnly/SameSite flags. cors = overly permissive cross-origin config. http\_downgrade = plain HTTP not redirected to HTTPS. robots\_disclosure = robots.txt tipping off sensitive paths. js\_libraries = outdated JS libraries cross-checked against real CVEs. subdomain\_takeover = dangling subdomain pointing at an unclaimed cloud service. dns\_hygiene = missing DNSSEC/CAA. server\_software = web server version cross-checked against real CVEs. source\_maps = publicly exposed .map files leaking source code. wp\_plugins = outdated WordPress plugins cross-checked against real CVEs. db\_admin\_panels = exposed phpMyAdmin/Adminer database admin tools.

## `request_timeout_secs` (type: `integer`):

HTTP request timeout per check.

## Actor input object example

```json
{
  "domains": [
    "example.com"
  ],
  "checks": [
    "headers",
    "tls",
    "exposed_files",
    "cms",
    "dns_spoofing",
    "subdomains",
    "exposed_buckets",
    "exposed_ports",
    "breach_history",
    "cookies",
    "cors",
    "http_downgrade",
    "robots_disclosure",
    "js_libraries",
    "subdomain_takeover",
    "dns_hygiene",
    "server_software",
    "source_maps",
    "wp_plugins",
    "db_admin_panels"
  ],
  "request_timeout_secs": 15
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("0xgollum/exploit-radar").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": ["example.com"] }

# Run the Actor and wait for it to finish
run = client.actor("0xgollum/exploit-radar").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "example.com"
  ]
}' |
apify call 0xgollum/exploit-radar --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,0xgollum/exploit-radar"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/oLYzjRxszyeXym1hB/builds/z0ZBqdMwh3orNMBnd/openapi.json