Two minutes of scanning. No attack, no password guessed, nothing illegal - just public checks, the kind anyone can run. The result: the service used to upload files to the server (FTP) answered to any IP address on the planet. No firewall, no restriction. A door left wide open from the outside when it should only ever be reachable from the inside.
This isn't a one-off. It isn't even the result of some genius exploit. Most break-ins don't start with a clever zero-day - they start with a door nobody ever thought to check again after installing it. A site gets built once, configured once, and then nobody looks at it again. Attackers, on the other hand, scan continuously.
That's exactly the gap Exploit Radar fills: not a one-time audit you order once and forget, but monitoring that runs over time and only ever tells you what changed.
What it checks
20 checks, all passive and legal (never an intrusion attempt, ever):
- Missing security headers, expired or weak SSL certificate
- Sensitive files left exposed online (credentials, backups)
- CMS and WordPress plugin versions - cross-checked against real named CVEs, flagged if a public exploit already exists
- The web server's own version, same logic
- Missing email spoofing protection, unsigned DNS
- Forgotten subdomains (abandoned test servers) - and whether they point to a cloud service an attacker can claim
- Misconfigured, publicly-listable cloud storage
- Risky open ports (databases, remote access) and confirmed past ransomware history
- Poorly secured cookies, misconfigured CORS, HTTP not forced to HTTPS
- robots.txt files tipping off sensitive folders, source code exposed through debug files
- Publicly reachable database admin panels
Every finding comes with a plain-language explanation - not just "outdated version," but the actual named vulnerability, its real severity, and whether someone has already published how to exploit it.
What makes this different from a one-off audit
On the first scan, nothing is reported - listing everything that already exists as if it just showed up would be misleading. From the second scan onward, only what's genuinely new gets surfaced. The site changes, updates, an intern opens a port by mistake - Exploit Radar sees it before an automated scanning bot finds it first.
No exploitation is ever attempted, period. Every single check is equivalent to what a normal browser already does when visiting a public page: a GET request, a standard TLS handshake, a public DNS lookup. That line is clear and it doesn't move.
Available on Apify: https://apify.com/0xgollum/exploit-radar
Top comments (0)