# ExploitDB Scraper (`crawlerbros/exploitdb-scraper`) Actor

Scrape OffSec's Exploit Database - exploits, papers, shellcodes, and Google Hacking Database dorks with full metadata: EDB-ID, CVEs, platform, type, author, verification status, and source code.

- **URL**: https://apify.com/crawlerbros/exploitdb-scraper.md
- **Developed by:** [Crawler Bros](https://apify.com/crawlerbros) (community)
- **Categories:** Automation, Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $3.00 / 1,000 results

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## ExploitDB Scraper

Scrape [OffSec's Exploit Database](https://www.exploit-db.com/) — the world's largest public archive of real-world exploits. Search exploits by title, CVE, author or content; browse by platform; fetch exact EDB-IDs with full detail pages and source code; and search the Google Hacking Database (GHDB) dorks. Also covers security **papers** and **shellcodes**. Pure HTTP — no auth, no login, free-plan friendly.

### What this actor does

- **Four modes:** `search`, `browseByPlatform`, `byIds`, `ghdbSearch`
- **Three collections:** Exploits, Papers, Shellcodes
- **Full filter surface:** platform (77 options), type (DoS/Local/Remote/Shellcode/WebApps/Hardware/Papers), port (319 options), vulnerability tag (31 options), CVE, author, body-text, verified-only, has-vulnerable-app, exclude-Metasploit
- **GHDB:** browse all 14 dork categories, filter by keyword
- **byIds:** fetch any EDB-ID with optional raw source code attached
- **Empty fields are omitted** — every record carries `sourceUrl`, `scrapedAt`, `recordType`

### Output fields

#### Exploits (`recordType: "exploit"`)

- `edbId` — numeric EDB-ID
- `title`
- `cveIds[]` — associated CVE identifiers (e.g. `CVE-2021-44228`)
- `osvdbIds[]` — OSVDB reference numbers when present
- `otherCodes[]` — vendor bulletins and other references (e.g. `MS03-031`)
- `type`, `typeDisplay` — e.g. `webapps` / `WebApps`
- `platform` — e.g. `PHP`, `Windows`, `Multiple`
- `author`, `authorId`
- `publishedDate` — `YYYY-MM-DD`
- `verified` — EDB verification flag
- `port` — affected port when known
- `tags[]` — vulnerability tags (e.g. `SQL Injection (SQLi)`)
- `appPath`, `appUrl` — downloadable vulnerable application
- `screenshotUrl`, `screenshotThumbUrl` — exploit screenshots when the entry ships them
- `downloadUrl`, `rawCodeUrl`, `sourceUrl`
- `code` — full source (mode=byIds with `includeCode`)

#### Papers (`recordType: "paper"`) and Shellcodes (`recordType: "shellcode"`)

- `paperId` / `shellcodeId`, `title`, `platform`, `author`, `publishedDate`, `language` (papers), `verified` (shellcodes), `size` (shellcodes, byIds), `downloadUrl`, `sourceUrl`

#### Google dorks (`recordType: "ghdbDork"`)

- `ghdbId`, `title` (the dork), `category`, `categoryId`, `categoryDescription`, `author`, `publishedDate`, `googleSearchUrl`, `sourceUrl`

Every record also includes `scrapedAt` (UTC ISO timestamp) and `recordType`.

### Input

| Field | Type | Default | Description |
|---|---|---|---|
| `mode` | enum | `search` | `search` / `browseByPlatform` / `byIds` / `ghdbSearch` |
| `searchQuery` | string | `wordpress` | Title keyword (mode=search) |
| `collection` | enum | `exploits` | `exploits` / `papers` / `shellcodes` |
| `platform` | enum | – | 77 platforms (mode=browseByPlatform, or search filter) |
| `type` | enum | – | dos / local / remote / shellcode / papers / webapps / hardware |
| `port` | enum | – | 319 affected-port options |
| `tag` | enum | – | 31 vulnerability tags |
| `cveSearch` | string | – | CVE filter, e.g. `2021-44228` |
| `authorName` | string | – | Author filter |
| `bodyText` | string | – | Exploit content/body filter |
| `paperLanguage` | enum | – | 26 languages (papers collection) |
| `verifiedOnly` | bool | `false` | EDB-verified exploits only |
| `hasAppOnly` | bool | `false` | With downloadable vulnerable app only |
| `excludeMetasploit` | bool | `false` | Drop Metasploit modules |
| `containsKeyword` | string | – | Client-side title substring filter |
| `dateRangeFrom` / `dateRangeTo` | string | – | Publication date window (`YYYY-MM-DD`) |
| `exploitIds` | array | – | EDB-IDs or URLs — exploits, shellcodes, GHDB dorks, papers (mode=byIds) |
| `includeCode` | bool | `false` | Attach raw source code (mode=byIds) |
| `ghdbQuery` | string | – | Dork title keyword (mode=ghdbSearch) |
| `ghdbCategory` | enum | – | 14 GHDB categories |
| `maxItems` | int | `50` | Hard cap (1–1000) |
| `proxyConfiguration` | object | off | Optional Apify proxy (auto-engaged on 403/429) |

#### Examples

**Search verified WordPress exploits with CVE:**

```json
{
  "mode": "search",
  "searchQuery": "wordpress",
  "type": "webapps",
  "verifiedOnly": true,
  "maxItems": 20
}
```

**All Windows remote exploits:**

```json
{
  "mode": "browseByPlatform",
  "platform": "windows",
  "type": "remote",
  "maxItems": 100
}
```

**Fetch specific exploits with source code (any record type):**

```json
{
  "mode": "byIds",
  "exploitIds": [
    "50592",
    "https://www.exploit-db.com/shellcodes/14113",
    "https://www.exploit-db.com/ghdb/2",
    "https://www.exploit-db.com/docs/33429"
  ],
  "includeCode": true
}
```

`byIds` accepts exploits, shellcodes (`/shellcodes/{id}`), Google dorks (`/ghdb/{id}`) and papers (`/docs/{id}`). Bare numeric IDs try the exploit detail page first, then shellcode, then GHDB. Duplicate IDs are fetched once.

**Google dorks about passwords:**

```json
{
  "mode": "ghdbSearch",
  "ghdbQuery": "password",
  "ghdbCategory": "9"
}
```

### Use cases

- **Vulnerability research** — track proof-of-concept exploits per product, platform, or CVE
- **Threat intelligence feeds** — build enrichment pipelines keyed on EDB-ID / CVE
- **Red-team tooling** — bulk-download verified exploit source code
- **Security education** — collect papers and shellcodes by platform and language
- **OSINT dorking** — export Google Hacking Database dorks by category

### FAQ

**Do I need an account?** No. Exploit-DB is fully public; the actor uses the same public endpoints the website uses, with no cookies or credentials.

**Is this affiliated with Exploit-DB / OffSec?** No — this is a third-party actor using the public Exploit Database endpoints and pages. It is not affiliated with or endorsed by OffSec.

**What is an EDB-ID?** The unique numeric identifier of each entry (e.g. `50592` for the Log4Shell PoC). Use it in `byIds` mode to fetch the full detail page.

**What does `verified` mean?** Exploit-DB staff manually verify many entries ("EDB Verified"). The flag is shown as a boolean on exploit and shellcode records.

**Why are some CVEs missing?** Older entries predate the CVE field; if the entry has no CVE, `cveIds` is omitted rather than filled with a placeholder.

**Can I get the exploit source code?** Yes — set `includeCode: true` in `byIds` mode and the raw code body (from `/raw/{edb-id}`) is attached to each record.

**Is the paper PDF included?** Papers are published as PDFs; the record carries the `downloadUrl` and `sourceUrl` (`/docs/{id}`) which serve the PDF.

**What happens with an inverted date range (`dateRangeFrom` > `dateRangeTo`)?** An inverted range can never match — the actor returns 0 records immediately with a status message instead of scanning the whole index.

**How fast does the actor run?** The daily test default (`searchQuery: "wordpress"`, 5 records) completes in a few seconds — one paginated API call.

### Data Source

All data is scraped from public pages and JSON endpoints of **exploit-db.com** (OffSec), including the DataTables JSON feeds behind the public search/browse pages, the `/exploits/{id}`, `/ghdb/{id}` and `/shellcodes/{id}` detail pages, and `/raw/{id}` code endpoints. The public index mirrors the GHDB. No authentication is used.

### Limitations

- The **GHDB** endpoint does not support server-side keyword search; `ghdbQuery` is applied client-side to the dork title after paginated browsing (category filtering is server-side).
- **Replacements** (cast-change history inside `byIds` exploit detail pages) are not scraped; the detail page shows the original entry metadata.
- `tags[]` are only present on entries that have been tagged; many older entries have none and the field is omitted.
- The GHDB search filters on **dork titles**, not on Google results.
- Papers' full text is served as PDF (`/docs/{id}`); the actor emits the download URL, it does not parse the PDF content. In `byIds` mode, paper records carry `paperId`, `sourceUrl` and `downloadUrl` only — paper metadata is only available from the list feed.
- Exploit **code** is only attached in `byIds` mode with `includeCode: true` to keep search runs fast and light.
- **Screenshots** (`screenshotUrl` / `screenshotThumbUrl`) exist only for a minority of exploits (~9% of the archive); entries without them omit the fields.

# Actor input Schema

## `mode` (type: `string`):

What to fetch.

## `searchQuery` (type: `string`):

Title keyword — matches against the exploit/paper/shellcode title (mode=search).

## `collection` (type: `string`):

Which Exploit-DB collection to search or browse (modes=search, browseByPlatform).

## `platform` (type: `string`):

Platform to filter/browse by (mode=browseByPlatform, or filter in mode=search).

## `type` (type: `string`):

Exploit type filter (mode=search).

## `port` (type: `string`):

Filter by affected port number (mode=search).

## `tag` (type: `string`):

Filter by vulnerability tag, e.g. SQL Injection or Buffer Overflow (mode=search).

## `cveSearch` (type: `string`):

Filter by CVE identifier, e.g. `2021-44228` (mode=search).

## `authorName` (type: `string`):

Filter by exploit author name, e.g. `rgod` (mode=search).

## `bodyText` (type: `string`):

Keyword that must appear in the exploit body/code content (mode=search).

## `paperLanguage` (type: `string`):

Language filter when collection=papers (modes=search, browseByPlatform).

## `verifiedOnly` (type: `boolean`):

Only emit EDB-verified exploits (mode=search).

## `hasAppOnly` (type: `boolean`):

Only emit exploits that ship a downloadable vulnerable app (mode=search).

## `excludeMetasploit` (type: `boolean`):

Drop Metasploit Framework (MSF) modules from results (mode=search).

## `containsKeyword` (type: `string`):

Client-side filter — title must contain this substring (case-insensitive).

## `dateRangeFrom` (type: `string`):

Only emit records published on or after this date.

## `dateRangeTo` (type: `string`):

Only emit records published on or before this date.

## `exploitIds` (type: `array`):

EDB-IDs or full URLs. Accepts exploits (`50592`, `.../exploits/50592`), shellcodes (`.../shellcodes/14113`), Google dorks (`.../ghdb/2`) and papers (`.../docs/33429`). Bare numeric IDs try the exploit detail page first, then shellcode, then GHDB.

## `includeCode` (type: `boolean`):

Also fetch and attach the raw exploit code body (mode=byIds).

## `ghdbQuery` (type: `string`):

Keyword the Google dork title must contain, e.g. `inurl`, `intitle`, `password` (the GHDB table ignores server-side text search, so this filters client-side).

## `ghdbCategory` (type: `string`):

GHDB category filter (mode=ghdbSearch).

## `maxItems` (type: `integer`):

Hard cap on emitted records.

## `proxyConfiguration` (type: `object`):

Optional Apify proxy. Only engaged automatically if Exploit-DB returns 403/429 on the default connection.

## Actor input object example

```json
{
  "mode": "search",
  "searchQuery": "wordpress",
  "collection": "exploits",
  "verifiedOnly": false,
  "hasAppOnly": false,
  "excludeMetasploit": false,
  "exploitIds": [],
  "includeCode": false,
  "maxItems": 50,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# Actor output Schema

## `exploits` (type: `string`):

Dataset containing all scraped Exploit-DB records.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "mode": "search",
    "searchQuery": "wordpress",
    "collection": "exploits",
    "verifiedOnly": false,
    "hasAppOnly": false,
    "excludeMetasploit": false,
    "exploitIds": [],
    "includeCode": false,
    "maxItems": 50,
    "proxyConfiguration": {
        "useApifyProxy": false
    }
};

// Run the Actor and wait for it to finish
const run = await client.actor("crawlerbros/exploitdb-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "mode": "search",
    "searchQuery": "wordpress",
    "collection": "exploits",
    "verifiedOnly": False,
    "hasAppOnly": False,
    "excludeMetasploit": False,
    "exploitIds": [],
    "includeCode": False,
    "maxItems": 50,
    "proxyConfiguration": { "useApifyProxy": False },
}

# Run the Actor and wait for it to finish
run = client.actor("crawlerbros/exploitdb-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "mode": "search",
  "searchQuery": "wordpress",
  "collection": "exploits",
  "verifiedOnly": false,
  "hasAppOnly": false,
  "excludeMetasploit": false,
  "exploitIds": [],
  "includeCode": false,
  "maxItems": 50,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}' |
apify call crawlerbros/exploitdb-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,crawlerbros/exploitdb-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/YWaEcHYVnZt5HEfsG/builds/BLxGFPTY5ddlqWfey/openapi.json