Medium Scraper

Medium Scraper is an advanced scraper that allows you to access and extract content from Medium, even for articles that usually require a subscription. This scraper uses bypass techniques to circumvent the "Subscribe now for uninterrupted access" restriction imposed by Medium.

🎯 Features

• Bypass Paywall: Access articles without a subscription.
• Complete Data Extraction: Includes title, author, publication date, and full article content.
• Structured Output Format: JSON format for easy further analysis.

🚀 How to Use

1. Run the Scraper: Use the Apify Console or API to run the scraper.
2. Get Results: Once scraping is complete, the data will be available in JSON format.

ℹ️ How To Get Post Id

1. First, take the URL for example https://medium.com/@mchklt/how-i-got-rce-on-redbull-from-recon-cve-2025-30406-f0e702d131ce
2. take the ID after the last dash f0e702d131ce

📌 Example Output

{
  "actor_input": {
    "post_id": "f0e702d131ce"
  },
  "__typename": "Post",
  "id": "f0e702d131ce",
  "readingTime": 1.4037735849056603,
  "creator": {
    "__typename": "User",
    "id": "e601ac360603",
    "imageId": "1*xki-w5VRkdrYr4S8ZKsGrg.png",
    "username": "mchklt",
    "name": "ABDELKARIM MOUCHQUELITA",
    "bio": "in allah we trust, the rest we test. www.mchklt.com",
    "tippingLink": "https://ko-fi.com/mchklt",
    "viewerEdge": {
      "isUser": false,
      "isFollowing": false,
      "isBlocking": false,
      "isMuting": false
    },
    "socialStats": {
      "followingCount": 67,
      "followerCount": 1070
    },
    "newsletterV3": {
      "__typename": "NewsletterV3",
      "id": "3b917b51d021",
      "viewerEdge": {
        "id": "newsletterId:3b917b51d021-viewerId:lo_82c01b889cb1",
        "isSubscribed": false
      }
    },
    "isFollowing": null,
    "mediumMemberAt": 0,
    "twitterScreenName": "mchklt"
  },
  "collection": null,
  "isLocked": true,
  "firstPublishedAt": 1753990580549,
  "latestPublishedVersion": "ca1f6002bf9c",
  "title": "How I got RCE on redbull from recon (CVE-2025–30406)",
  "visibility": "LOCKED",
  "postResponses": {
    "count": 7
  },
  "clapCount": 606,
  "viewerEdge": {
    "clapCount": 0
  },
  "detectedLanguage": "en",
  "mediumUrl": "https://mchklt.medium.com/how-i-got-rce-on-redbull-from-recon-cve-2025-30406-f0e702d131ce",
  "updatedAt": 1757777866950,
  "allowResponses": true,
  "isProxyPost": false,
  "isSeries": false,
  "previewImage": {
    "id": "1*jzbO2qU2j5tonqVYwy-wCg.png"
  },
  "inResponseToPostResult": null,
  "inResponseToMediaResource": null,
  "inResponseToEntityType": null,
  "canonicalUrl": "https://mchklt.medium.com/how-i-got-rce-on-redbull-from-recon-cve-2025-30406-f0e702d131ce",
  "previewContent": {
    "subtitle": "CVE-2025–30406 ViewState Exploit"
  },
  "pinnedByCreatorAt": 1757777866950,
  "linkMetadataList": [
    {
      "url": "https://x.com/mchklt",
      "alts": []
    },
    {
      "url": "https://github.com/mchklt/CVE-2025-30406",
      "alts": []
    },
    {
      "url": "https://github.com/mchklt/Nmap-Bomber",
      "alts": []
    },
    {
      "url": "https://mchklt.medium.com/how-i-got-rce-on-redbull-from-recon-cve-2025-30406-f0e702d131ce?sk=a00c1f4234f53568b203b26499e2c185",
      "alts": [
        {
          "type": "ANDROID_APPLINK",
          "url": "medium://p/f0e702d131ce"
        },
        {
          "type": "IOS_APPLINK",
          "url": "medium://p/f0e702d131ce"
        }
      ]
    },
    {
      "url": "https://www.linkedin.com/in/mchklt/",
      "alts": []
    }
  ],
  "highlights": [
    {
      "__typename": "Quote",
      "id": "anon_ee0a06d6ccba",
      "postId": "f0e702d131ce",
      "userId": "anon",
      "startOffset": 0,
      "endOffset": 177,
      "paragraphs": [
        {
          "__typename": "Paragraph",
          "id": "anon_ee0a06d6ccba_quote_0",
          "name": "6954",
          "href": null,
          "text": "subfinder -dL domains.txt -all -recursive -o subdomains.txt\ncat subdomains.txt | assetfinder -subs-only > asset.subs.txt\ncat asset.subs.txt subdomains.txt | sort -u > unique.txt",
          "iframe": null,
          "layout": null,
          "markups": [],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "PRE",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        }
      ],
      "quoteType": null
    }
  ],
  "responsesLocked": false,
  "tags": [
    {
      "__typename": "Tag",
      "id": "cybersecurity",
      "normalizedTagSlug": "cybersecurity",
      "displayTitle": "Cybersecurity",
      "followerCount": 1309526,
      "postCount": 124922
    },
    {
      "__typename": "Tag",
      "id": "red-bull",
      "normalizedTagSlug": "red-bull",
      "displayTitle": "Red Bull",
      "followerCount": 9,
      "postCount": 438
    },
    {
      "__typename": "Tag",
      "id": "ethical-hacking",
      "normalizedTagSlug": "ethical-hacking",
      "displayTitle": "Ethical Hacking",
      "followerCount": 5831,
      "postCount": 7769
    },
    {
      "__typename": "Tag",
      "id": "bugs",
      "normalizedTagSlug": "bugs",
      "displayTitle": "Bugs",
      "followerCount": 952,
      "postCount": 4939
    },
    {
      "__typename": "Tag",
      "id": "bug-bounty",
      "normalizedTagSlug": "bug-bounty",
      "displayTitle": "Bug Bounty",
      "followerCount": 12464,
      "postCount": 15514
    }
  ],
  "content": {
    "bodyModel": {
      "__typename": "RichText",
      "sections": [
        {
          "__typename": "Section",
          "name": "91dc",
          "startIndex": 0,
          "textLayout": null,
          "imageLayout": null,
          "videoLayout": null,
          "backgroundImage": null,
          "backgroundVideo": null
        }
      ],
      "paragraphs": [
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_0",
          "name": "e565",
          "href": null,
          "text": "How I got RCE on redbull from recon (CVE-2025–30406)",
          "iframe": null,
          "layout": null,
          "markups": [],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "H3",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_1",
          "name": "171e",
          "href": null,
          "text": "CVE-2025–30406 ViewState Exploit",
          "iframe": null,
          "layout": null,
          "markups": [],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "P",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_2",
          "name": "47df",
          "href": null,
          "text": "the free version: FREE",
          "iframe": null,
          "layout": null,
          "markups": [
            {
              "__typename": "Markup",
              "name": null,
              "type": "A",
              "start": 18,
              "end": 22,
              "href": "https://mchklt.medium.com/how-i-got-rce-on-redbull-from-recon-cve-2025-30406-f0e702d131ce?sk=a00c1f4234f53568b203b26499e2c185",
              "title": "",
              "rel": "",
              "anchorType": "LINK",
              "userId": null,
              "creatorIds": null
            }
          ],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "P",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_3",
          "name": "5c05",
          "href": null,
          "text": "السلام عليكم ورحمة الله.\nHi, it’s me again. This time I’m sharing how I got **remote code execution** on redbull just by doing recon, nothing else.",
          "iframe": null,
          "layout": null,
          "markups": [
            {
              "__typename": "Markup",
              "name": null,
              "type": "STRONG",
              "start": 78,
              "end": 99,
              "href": null,
              "title": null,
              "rel": null,
              "anchorType": null,
              "userId": null,
              "creatorIds": null
            }
          ],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "P",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_4",
          "name": "4db1",
          "href": null,
          "text": "Like usual, I started with **subdomain enumeration**. I grabbed the in-scope domains and ran:",
          "iframe": null,
          "layout": null,
          "markups": [
            {
              "__typename": "Markup",
              "name": null,
              "type": "STRONG",
              "start": 29,
              "end": 50,
              "href": null,
              "title": null,
              "rel": null,
              "anchorType": null,
              "userId": null,
              "creatorIds": null
            }
          ],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "P",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_5",
          "name": "6954",
          "href": null,
          "text": "subfinder -dL domains.txt -all -recursive -o subdomains.txt\ncat subdomains.txt | assetfinder -subs-only > asset.subs.txt\ncat asset.subs.txt subdomains.txt | sort -u > unique.txt",
          "iframe": null,
          "layout": null,
          "markups": [],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "PRE",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": {
            "lang": "bash",
            "mode": "AUTO"
          }
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_6",
          "name": "f23f",
          "href": null,
          "text": "After that, I used my own tool Nmap-Bomber to scan the subdomains and find open ports. The latest version of the script filters out possible honeypots and puts the real results in a file called good_ports.txt, which contains host:port lines. This file is ready to use directly with Nuclei.",
          "iframe": null,
          "layout": null,
          "markups": [
            {
              "__typename": "Markup",
              "name": null,
              "type": "A",
              "start": 31,
              "end": 42,
              "href": "https://github.com/mchklt/Nmap-Bomber",
              "title": "",
              "rel": "",
              "anchorType": "LINK",
              "userId": null,
              "creatorIds": null
            },
            {
              "__typename": "Markup",
              "name": null,
              "type": "STRONG",
              "start": 194,
              "end": 208,
              "href": null,
              "title": null,
              "rel": null,
              "anchorType": null,
              "userId": null,
              "creatorIds": null
            },
            {
              "__typename": "Markup",
              "name": null,
              "type": "STRONG",
              "start": 225,
              "end": 234,
              "href": null,
              "title": null,
              "rel": null,
              "anchorType": null,
              "userId": null,
              "creatorIds": null
            }
          ],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "P",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_7",
          "name": "c86c",
          "href": null,
          "text": "I launched Nuclei like this:",
          "iframe": null,
          "layout": null,
          "markups": [],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "P",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_8",
          "name": "dba0",
          "href": null,
          "text": "nuclei -t /root/nuclei_templates -es info,low -l good_ports.txt -o nuclei.out",
          "iframe": null,
          "layout": null,
          "markups": [],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "PRE",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": {
            "lang": "bash",
            "mode": "AUTO"
          }
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_9",
          "name": "b73d",
          "href": null,
          "text": "I got a lot of hits, but one of them stood out. a **critical finding**, CVE-2025–30406.",
          "iframe": null,
          "layout": null,
          "markups": [],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "P",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_10",
          "name": "4bfa",
          "href": null,
          "text": "After checking manually, I confirmed it was vulnerable, but honestly, exploiting it was way harder than finding it. I couldn’t find any working public exploit. There was one repo that explained the concept, but it didn’t help because it was just blind command injection and didn’t return any output.",
          "iframe": null,
          "layout": null,
          "markups": [],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "P",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_11",
          "name": "eba8",
          "href": null,
          "text": "So I started writing my own exploit. I spent about 6 hours developing a script that automates everything and makes it easier to trigger the RCE. At the end, I got a working exploit and remote code execution on redbull.",
          "iframe": null,
          "layout": null,
          "markups": [],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "P",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_12",
          "name": "6cf5",
          "href": null,
          "text": "",
          "iframe": null,
          "layout": "INSET_CENTER",
          "markups": [],
          "metadata": {
            "__typename": "ImageMetadata",
            "id": "1*jzbO2qU2j5tonqVYwy-wCg.png",
            "originalWidth": 1562,
            "originalHeight": 657,
            "focusPercentX": null,
            "focusPercentY": null,
            "alt": null
          },
          "mixtapeMetadata": null,
          "type": "IMG",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_13",
          "name": "f4a2",
          "href": null,
          "text": "and they fixed it almost directly after my report and got rewarded with some swags and 6trays of redubll 😎",
          "iframe": null,
          "layout": null,
          "markups": [],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "P",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_14",
          "name": "f3b2",
          "href": null,
          "text": "The exploit is now public and available here: \n🔗 CVE-2025–30406",
          "iframe": null,
          "layout": null,
          "markups": [
            {
              "__typename": "Markup",
              "name": null,
              "type": "A",
              "start": 50,
              "end": 64,
              "href": "https://github.com/mchklt/CVE-2025-30406",
              "title": "",
              "rel": "",
              "anchorType": "LINK",
              "userId": null,
              "creatorIds": null
            }
          ],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "P",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_15",
          "name": "81fb",
          "href": null,
          "text": "And that’s it. Thanks for your time, I hope you enjoyed the read .\n Feel free to follow me for more findings and tools:\n 🔗 LinkedIn\n 🐦 Twitter/X: @mchklt",
          "iframe": null,
          "layout": null,
          "markups": [
            {
              "__typename": "Markup",
              "name": null,
              "type": "A",
              "start": 124,
              "end": 132,
              "href": "https://www.linkedin.com/in/mchklt/",
              "title": "",
              "rel": "noopener",
              "anchorType": "LINK",
              "userId": null,
              "creatorIds": null
            },
            {
              "__typename": "Markup",
              "name": null,
              "type": "A",
              "start": 149,
              "end": 155,
              "href": "https://x.com/mchklt",
              "title": "",
              "rel": "",
              "anchorType": "LINK",
              "userId": null,
              "creatorIds": null
            }
          ],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "P",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        },
        {
          "__typename": "Paragraph",
          "id": "ca1f6002bf9c_16",
          "name": "700a",
          "href": null,
          "text": "See you in the next write-up!",
          "iframe": null,
          "layout": null,
          "markups": [],
          "metadata": null,
          "mixtapeMetadata": null,
          "type": "P",
          "hasDropCap": null,
          "dropCapImage": null,
          "codeBlockMetadata": null
        }
      ]
    },
    "validatedShareKey": ""
  }
}

🛠️ Support

If you encounter any issues or have questions, please reach out via the Apify Console or the Apify community forum.