CVE Hunter

Proxies the NIST NVD cves/2.0 endpoint. Supports keyword search, severity filter, and published-date range. If pubEndDate − pubStartDate > 120 days, the API automatically splits the request into 120-day windows, deduplicates by CVE ID, sorts by published descending, and paginates client-side via startIndex / resultsPerPage.

Query parameters

Responses

Success 200 application/json

{
  "resultsPerPage": 50,
  "startIndex": 0,
  "totalResults": 1284,
  "aggregated": true,
  "rawTotalFromNvd": 1284,
  "vulnerabilities": [
    {
      "cve": {
        "id": "CVE-2024-3400",
        "published": "2024-04-12T08:15:06.230",
        "lastModified": "2024-11-21T09:29:34.140",
        "descriptions": [...],
        "metrics": { "cvssMetricV31": [...] },
        "weaknesses": [...],
        "configurations": [...],
        "references": [...]
      }
    }
  ]
}

Fetches the live CISA KEV feed, extracts every cveID, and returns a flat array. Useful as a set-membership check when triaging a batch of CVEs.

Query parameters

None.

Responses

Success 200 application/json

[
  "CVE-2021-44228",
  "CVE-2023-23397",
  "CVE-2024-3400",
  ...
]

Proxies the upstream MITRE ATT&CK Enterprise STIX 2.1 bundle. The client filters attack-pattern objects to derive techniques, their tactics (kill-chain phases), and cross-references.

Query parameters

None.

Responses

Success 200 application/json

{
  "type": "bundle",
  "id": "bundle--...",
  "objects": [
    {
      "type": "attack-pattern",
      "name": "Command and Scripting Interpreter",
      "external_references": [
        { "source_name": "mitre-attack", "external_id": "T1059" }
      ],
      "kill_chain_phases": [
        { "kill_chain_name": "mitre-attack", "phase_name": "execution" }
      ]
    }
  ]
}

Runs a standard whois query via python-whois. datetime fields are stringified so the payload is JSON-safe.

Query parameters

Responses

Success 200 application/json

{
  "domain_name": "EXAMPLE.COM",
  "registrar": "RESERVED-Internet Assigned Numbers Authority",
  "creation_date": "1995-08-14 04:00:00",
  "expiration_date": "2025-08-13 04:00:00",
  "name_servers": ["A.IANA-SERVERS.NET", "B.IANA-SERVERS.NET"]
}

Error 400 / 500

{ "error": "Domain is required" }

Combines ipwhois RDAP lookup with ip-api.com geolocation. The geo block is nested under geo.

Query parameters

Responses

Success 200 application/json

{
  "asn": "15169",
  "asn_country_code": "US",
  "asn_description": "GOOGLE, US",
  "network": { "cidr": "8.8.8.0/24", ... },
  "geo": {
    "country": "United States",
    "city": "Mountain View",
    "lat": 37.406,
    "lon": -122.0785,
    "isp": "Google LLC"
  }
}

Resolves the requested record type via dnspython. Returns each answer as a string.

Query parameters

Responses

Success 200 application/json

{
  "domain": "example.com",
  "type": "MX",
  "records": ["0 ."]
}

Sends an HTTP HEAD request with redirects followed, returns the final response headers, status code and final URL.

Query parameters

Responses

Success 200 application/json

{
  "status": 200,
  "final_url": "https://example.com/",
  "headers": {
    "Content-Type": "text/html; charset=UTF-8",
    "Server": "ECS (dcb/7F3A)",
    "Cache-Control": "max-age=604800"
  }
}

Opens a TLS 1.2+ connection to port 443 and returns the peer certificate as parsed by Python's ssl module.

Query parameters

Responses

Success 200 application/json

{
  "subject": [[["commonName", "example.com"]]],
  "issuer": [[["commonName", "DigiCert Global G2 TLS RSA SHA256 2020 CA1"]]],
  "version": 3,
  "serialNumber": "075BCEF30689C8ADDF13E51AF4AFE187",
  "notBefore": "Jan 30 00:00:00 2024 GMT",
  "notAfter": "Mar  1 23:59:59 2025 GMT",
  "subjectAltName": [["DNS", "example.com"], ["DNS", "www.example.com"]]
}

Returns 200 with a tiny JSON payload when the service is up. Used by the Docker healthcheck.

Responses

Success 200 application/json

{
  "status": "ok",
  "time": "2026-04-24T14:32:11.123Z"
}