ExploitDB Scraper

Scrape OffSec's Exploit Database — the world's largest public archive of real-world exploits. Search exploits by title, CVE, author or content; browse by platform; fetch exact EDB-IDs with full detail pages and source code; and search the Google Hacking Database (GHDB) dorks. Also covers security papers and shellcodes. Pure HTTP — no auth, no login, free-plan friendly.

What this actor does

• Four modes: search, browseByPlatform, byIds, ghdbSearch
• Three collections: Exploits, Papers, Shellcodes
• Full filter surface: platform (77 options), type (DoS/Local/Remote/Shellcode/WebApps/Hardware/Papers), port (319 options), vulnerability tag (31 options), CVE, author, body-text, verified-only, has-vulnerable-app, exclude-Metasploit
• GHDB: browse all 14 dork categories, filter by keyword
• byIds: fetch any EDB-ID with optional raw source code attached
• Empty fields are omitted — every record carries sourceUrl, scrapedAt, recordType

Output fields

Exploits (recordType: "exploit")

• edbId — numeric EDB-ID
• title
• cveIds[] — associated CVE identifiers (e.g. CVE-2021-44228)
• osvdbIds[] — OSVDB reference numbers when present
• otherCodes[] — vendor bulletins and other references (e.g. MS03-031)
• type, typeDisplay — e.g. webapps / WebApps
• platform — e.g. PHP, Windows, Multiple
• author, authorId
• publishedDate — YYYY-MM-DD
• verified — EDB verification flag
• port — affected port when known
• tags[] — vulnerability tags (e.g. SQL Injection (SQLi))
• appPath, appUrl — downloadable vulnerable application
• screenshotUrl, screenshotThumbUrl — exploit screenshots when the entry ships them
• downloadUrl, rawCodeUrl, sourceUrl
• code — full source (mode=byIds with includeCode)

Papers (recordType: "paper") and Shellcodes (recordType: "shellcode")

• paperId / shellcodeId, title, platform, author, publishedDate, language (papers), verified (shellcodes), size (shellcodes, byIds), downloadUrl, sourceUrl

Google dorks (recordType: "ghdbDork")

• ghdbId, title (the dork), category, categoryId, categoryDescription, author, publishedDate, googleSearchUrl, sourceUrl

Every record also includes scrapedAt (UTC ISO timestamp) and recordType.

Input

Field	Type	Default	Description
mode	enum	search	search / browseByPlatform / byIds / ghdbSearch
searchQuery	string	wordpress	Title keyword (mode=search)
collection	enum	exploits	exploits / papers / shellcodes
platform	enum	–	77 platforms (mode=browseByPlatform, or search filter)
type	enum	–	dos / local / remote / shellcode / papers / webapps / hardware
port	enum	–	319 affected-port options
tag	enum	–	31 vulnerability tags
cveSearch	string	–	CVE filter, e.g. 2021-44228
authorName	string	–	Author filter
bodyText	string	–	Exploit content/body filter
paperLanguage	enum	–	26 languages (papers collection)
verifiedOnly	bool	false	EDB-verified exploits only
hasAppOnly	bool	false	With downloadable vulnerable app only
excludeMetasploit	bool	false	Drop Metasploit modules
containsKeyword	string	–	Client-side title substring filter
dateRangeFrom / dateRangeTo	string	–	Publication date window (YYYY-MM-DD)
exploitIds	array	–	EDB-IDs or URLs — exploits, shellcodes, GHDB dorks, papers (mode=byIds)
includeCode	bool	false	Attach raw source code (mode=byIds)
ghdbQuery	string	–	Dork title keyword (mode=ghdbSearch)
ghdbCategory	enum	–	14 GHDB categories
maxItems	int	50	Hard cap (1–1000)
proxyConfiguration	object	off	Optional Apify proxy (auto-engaged on 403/429)

Examples

Search verified WordPress exploits with CVE:

{
  "mode": "search",
  "searchQuery": "wordpress",
  "type": "webapps",
  "verifiedOnly": true,
  "maxItems": 20
}

All Windows remote exploits:

{
  "mode": "browseByPlatform",
  "platform": "windows",
  "type": "remote",
  "maxItems": 100
}

Fetch specific exploits with source code (any record type):

{
  "mode": "byIds",
  "exploitIds": [
    "50592",
    "https://www.exploit-db.com/shellcodes/14113",
    "https://www.exploit-db.com/ghdb/2",
    "https://www.exploit-db.com/docs/33429"
  ],
  "includeCode": true
}

byIds accepts exploits, shellcodes (/shellcodes/{id}), Google dorks (/ghdb/{id}) and papers (/docs/{id}). Bare numeric IDs try the exploit detail page first, then shellcode, then GHDB. Duplicate IDs are fetched once.

Google dorks about passwords:

{
  "mode": "ghdbSearch",
  "ghdbQuery": "password",
  "ghdbCategory": "9"
}

Use cases

• Vulnerability research — track proof-of-concept exploits per product, platform, or CVE
• Threat intelligence feeds — build enrichment pipelines keyed on EDB-ID / CVE
• Red-team tooling — bulk-download verified exploit source code
• Security education — collect papers and shellcodes by platform and language
• OSINT dorking — export Google Hacking Database dorks by category

FAQ

Do I need an account? No. Exploit-DB is fully public; the actor uses the same public endpoints the website uses, with no cookies or credentials.

Is this affiliated with Exploit-DB / OffSec? No — this is a third-party actor using the public Exploit Database endpoints and pages. It is not affiliated with or endorsed by OffSec.

What is an EDB-ID? The unique numeric identifier of each entry (e.g. 50592 for the Log4Shell PoC). Use it in byIds mode to fetch the full detail page.

What does verified mean? Exploit-DB staff manually verify many entries ("EDB Verified"). The flag is shown as a boolean on exploit and shellcode records.

Why are some CVEs missing? Older entries predate the CVE field; if the entry has no CVE, cveIds is omitted rather than filled with a placeholder.

Can I get the exploit source code? Yes — set includeCode: true in byIds mode and the raw code body (from /raw/{edb-id}) is attached to each record.

Is the paper PDF included? Papers are published as PDFs; the record carries the downloadUrl and sourceUrl (/docs/{id}) which serve the PDF.

What happens with an inverted date range (dateRangeFrom > dateRangeTo)? An inverted range can never match — the actor returns 0 records immediately with a status message instead of scanning the whole index.

How fast does the actor run? The daily test default (searchQuery: "wordpress", 5 records) completes in a few seconds — one paginated API call.

Data Source

All data is scraped from public pages and JSON endpoints of exploit-db.com (OffSec), including the DataTables JSON feeds behind the public search/browse pages, the /exploits/{id}, /ghdb/{id} and /shellcodes/{id} detail pages, and /raw/{id} code endpoints. The public index mirrors the GHDB. No authentication is used.

Limitations

• The GHDB endpoint does not support server-side keyword search; ghdbQuery is applied client-side to the dork title after paginated browsing (category filtering is server-side).
• Replacements (cast-change history inside byIds exploit detail pages) are not scraped; the detail page shows the original entry metadata.
• tags[] are only present on entries that have been tagged; many older entries have none and the field is omitted.
• The GHDB search filters on dork titles, not on Google results.
• Papers' full text is served as PDF (/docs/{id}); the actor emits the download URL, it does not parse the PDF content. In byIds mode, paper records carry paperId, sourceUrl and downloadUrl only — paper metadata is only available from the list feed.
• Exploit code is only attached in byIds mode with includeCode: true to keep search runs fast and light.
• Screenshots (screenshotUrl / screenshotThumbUrl) exist only for a minority of exploits (~9% of the archive); entries without them omit the fields.