Scraping 1337day.com: 16,700 Exploits in One Archive

If you have ever worked with exploits (exploits), you cannot have missed the site https://1337day.com. It collects over 16,700 exploits going back to 1996. Because the site had (and still has) plenty of trouble with the law, the domains they buy keep getting shut down. For a long time the site was at inj3ct0r.com, later it would only open by IP (77.120.101.55), and for a while it was gone altogether. For exactly those reasons I decided to collect all the exploits from the site and share them here as text files. Another reason is that searching the MySQL table, which I have also uploaded here, is far more convenient and easy.

Download the site's content

The content you can download from the two links below was created purely for educational purposes. Use it at your own risk. As you would expect, I am not responsible for the consequences, or for the way you use it. The exploits are current as of 20 August 2011.

Have fun, Script Kiddies!

The bot's code

To build the bot that collected all the exploits I used C#. I also used my own HttpManager class, whose simple functionality you can follow even without seeing its code. I also used extension methods on the String class, which you can equally well write yourself. In case you are wondering what the three constants at the top of the class are for: they are there because of the code highlighter. And here is the code of the Exploit class, which does the main part of the work:

internal class Exploit
{
    private const string openPreTag = "<pre>";
    private const string closePreTag = "</pre>";
    private const string openATag = "<a";

    public int EID { get; set; }
    public string Link
    {
        get
        {
            return string.Format("http://www.1337day.com/exploits/{0}", this.EID);
        }
    }
    public string Title { get; set; }
    public string Content { get; set; }
    public string Date { get; set; }

    public Exploit()
    {
        this.EID = 0;
        this.Title = string.Empty;
        this.Content = string.Empty;
        this.Date = string.Empty;
    }

    public Exploit(int id)
        : this()
    {
        this.EID = id;
    }

    public Exploit(int eID, string title, string content, string date)
    {
        this.EID = eID;
        this.Title = title;
        this.Content = content;
        this.Date = date;
    }

    public static Exploit ParseExploit(int id)
    {
        Exploit exploit = new Exploit(id);
        HttpManager http = new HttpManager(Encoding.UTF8, UserAgents.GoogleBot21);
        http.RequestGET(exploit.Link);
        if (http.Result.Contains(""))
        {
            return null;
        }
        exploit.Title = http.Result.GetStringBetween("").Replace("| Inj3ct0r - exploit database : vulnerability : 0day : shellcode", string.Empty).HTMLDecodeSpecialChars().Trim();
        exploit.Content = http.Result.GetStringBetween(openPreTag.HTMLDecodeSpecialChars(), closePreTag.HTMLDecodeSpecialChars()).Replace(openATag.HTMLDecodeSpecialChars() + " href='http://www.1337day.com/'>1337day.com", "1337day.com").HTMLDecodeSpecialChars().Trim();
        exploit.Date = http.Result.GetStringBetween("# " + openATag.HTMLDecodeSpecialChars() + " href='http://www.1337day.com/'>1337day.com [", "]" + closePreTag.HTMLDecodeSpecialChars()).Trim();
        return exploit;
    }
}