Exploit Radar — Website Attack Surface Monitor

Continuously watch your own domains for what real attackers actually look for first: named CVEs on your exact CMS/plugin/server version (with a public-exploit flag when one exists), forgotten subdomains, publicly-listable cloud buckets, exposed config files, and more. Run on a schedule; only exposures new since the last check are reported, never the full list dumped as "alerts" on the very first run.

What a row looks like

One newly-found exposure, straight from the dataset:

{
  "domain": "example.com",
  "category": "cms",
  "severity": "CRITICAL",
  "finding": "WordPress 6.4.2 — CVE-2024-31210 (public exploit available)",
  "detail": "Version disclosed in generator meta tag and /wp-includes/version.php. CVE-2024-31210: authenticated RCE via plugin upload. Public PoC on GitHub.",
  "checked_at": "2026-09-09T06:12:44Z"
}

One row per exposure, each with domain, category, severity, finding, detail and checked_at. The first run per domain is a silent baseline — rows start from the second run onward, so you only ever see what's new.

How it works

20 checks, all entirely passive — every single one does exactly what a normal browser or crawler already does when it visits a public page: plain GET requests, a standard TLS handshake, a public DNS lookup, or a read against an existing public threat-intel database (NVD, Shodan's free InternetDB, ransomware.live, certificate transparency logs). Nothing here sends a malicious payload, brute-forces a login, or attempts to bypass any protection — this is read-only reconnaissance of what a site is already broadcasting to the entire internet, not an attack. Use it only on domains you own or are authorized to audit.

Checks

• headers — missing security headers (HSTS, CSP, X-Frame-Options, etc.)
• tls — expired / self-signed / wrong-host certificate, weak protocol, or no HTTPS at all
• exposed_files — leaked config/backup files (.env, .git, credentials)
• cms — CMS/software version disclosure, cross-checked against named CVEs (with a public-exploit flag)
• wp_plugins — same for WordPress plugins specifically
• server_software — same for the web server itself (Apache/nginx version)
• dns_spoofing — missing SPF/DMARC (email spoofing protection)
• dns_hygiene — missing DNSSEC/CAA
• subdomains — forgotten subdomains found via public certificate records
• subdomain_takeover — a subdomain pointing at an unclaimed cloud service
• exposed_buckets — publicly-listable cloud storage buckets
• exposed_ports — risky open ports and known vulns via Shodan's public database
• breach_history — a confirmed past ransomware attack on this domain
• cookies — missing Secure/HttpOnly/SameSite flags
• cors — overly permissive cross-origin config
• http_downgrade — plain HTTP not redirected to HTTPS
• robots_disclosure — robots.txt tipping off sensitive paths
• js_libraries — outdated JS libraries cross-checked against named CVEs
• source_maps — publicly exposed .map files leaking source code
• db_admin_panels — exposed phpMyAdmin/Adminer database admin tools

Input

• Domains (required) — list of domains you own or are authorized to audit.
• Checks — which of the 20 checks to run (defaults to all).
• Request timeout.

Output

One row per newly-found exposure: domain, category, severity, finding, detail, checked_at.

Reliability notes

• A quiet run costs nothing. Its outcome is written to the run's key-value store (LAST_RUN_STATUS), never as a dataset item — every dataset item on this actor is a billed exposure.
• If a domain is briefly unreachable, a check fails, or a threat-intel source (NVD, Certspotter, Shodan InternetDB, ransomware.live) is rate-limited, the scan is treated as incomplete: findings it did return are reported, the stored state is merged rather than replaced, and nothing comes back as "new" just because a check was skipped. A domain that could not be checked at all is not charged.
• Anything held back by max_results is reported on the next run, not lost.
• CVE matching is version-range aware (NVD CPE match), so a CVE fixed in the version you run is not reported against you. Set NVD_API_KEY in the actor's environment to lift NVD's public rate limit on large scans.
• Sites fronted by a CDN/WAF skip the exposed_ports check: the public IP is the CDN's, and its ports are not yours.

Known constraints

• CVE matching relies on NVD's public keyword search, which can occasionally surface a loosely-related advisory for very generic product names — always double-check a CRITICAL finding's summary against the actual product before acting on it.
• First-ever check for a domain establishes a silent baseline (no rows) rather than dumping its existing exposures as if they just appeared — alerts start from the second run onward.
• exposed_ports/subdomain_takeover depend on the domain resolving to a public IP; a domain with no A/AAAA record at the apex will skip those specific checks for that run.