Packet Storm

Threat Intelligence Feed (API) Overview
From Premium Services

Welcome to the Packet Storm Threat Intelligence Feed

Current development API: https://api.packetstormsecurity.com/v31337.20240702/dev-api
Current production API: https://api.packetstormsecurity.com/v31337.20240702/api

Note: This page is best viewed on a desktop browser.

Background and purpose

For the bulk of our existence, Packet Storm did not offer API access. This led to many organizations scraping data from the web site and overwhelming the RSS feeds in order to mine data. This sort of "integration" does not scale well for anyone involved. As demand for an API has increased significantly in recent times, we have listened, and the API is now available. Whether you want this intelligence feed for your own organization to mine, or to provide feeds to your SIEM system, we are here to help. Feel free to reach our to the staff for any assistance or to help solve any problems. If this is your first time looking at integrating with our API, we strongly suggest you try out the development interface to verify it meets your needs.

Rules

If you are repackaging the API data in your own service offering, there are some simple rules to follow. As noted in the Terms of Service, you cannot resell the feed verbatim.

If you are offering feed and search interaction to our API from a service offering, we expect that you handle authentication, authorization, and accounting (AAA) for your users and that the API secret for Packet Storm MUST stay resident on your systems. It's forbidden for your secret to be shared with your customers or third parties. If we notice an uptick in traffic that indicates this behavior, your key will be disabled without refund.

Note that if you provide functionality in your service that uses your API license to search the archive, your customers will be jointly limited to the ceiling of daily query allowances. This can be annoying for them. A better idea is to make it easy for a client to onboard a license key from Packet Storm inside of your product or service and have functionality built in to use the access.

Features

The API is designed to provide very similar functionality to the site being visited in a web browser. But there are some differences.

Available API requests include telemetry data-retrieval for smarter requests, normal news and file feeds, and searchable news and file feeds (with output available in both the newest and most relevant listings). You can also search via CVE number. Packet Storm is a regularly referenced datapoint in Mitre's CVE database, and we regularly sync our datasets to ensure consistency between the systems.

Available API requests do not include access to user data such as profiles, collections, favorites, etc. The only relevant data related to humans comes from the file requests when referencing a public source and links are provided back to the site for further information.

Data can be output in both JSON and XML formats to suit any programmatic parsing needs. Results are restricted to 25 items at a time, inline with how the current web site operates. This should cover all bases for an integration, but if you can think of a feature we are missing, we always like hearing new ideas. Please send us a note.

Tracking changes

As improvements, bug fixes, and/or features are added to the API, the version will change. The current version will always be noted at the top of this page. As changes may become quite frequent, we will do our best to ensure backwards compatibility to all prior releases and communicate to our customers any decommissioning. Changes for all of Packet Storm are tracked at our Changelog, including API updates.

API authentication

The API is inaccessible without your key. Production keys must be accessed and purchased via the API Manager. To gain access, the key must be passed as a header called "Apisecret".

In order to make it easier for our clients to integrate, an example of a client script written in Ruby is available here. Notice that the entry point noted on the API manager for production versus the development zone is different. The correct key must be used for the correct area in order to work.

Cost

Access to the development API for testing purposes is free. Access to the production API costs $5,000 USD for 30 days. All payment processing is performed via Stripe. Upon payment, you will be activated within 24 hours. Activation is usually very quick.

Access request limit

Access to the development API for testing is limited to 100 queries per day. Access to the API is limited to 1,000 queries per day during a 30-day production subscription license. Requests can be made to the server at a limit of 10 requests per minute. Please note that data in the development interface is restricted to December of 2023.

Request and response examples

The Packet Storm API accepts POST requests with the "Apisecret" header defined. The data submitted in the body should match the form submitted format of parameter=value with differing data being separated by an ampersand ("&"). Please review our example script for a better understanding.

Note: To show API access examples, please use a desktop browser.

Please click a flow below to find out more information in order to start building your client.

List areas (

)

Packet Storm is divided into functional areas. This query helps you identify available areas and provides you with the variables needed to make further requests.

Example payload:

list="areas"

Example server response:

{
  "api_version": "1.0",
  "response_timestamp": "2024-07-16T18:05:23.440+00:00",
  "format": "json",
  "areas": {
    "area1": "files",
    "area2": "news",
    "area3": "cve"
  }
}

API output key:

api_version	The current version of the API that you're using.
response_timestamp	The date and time the response was provided.
format	The output format, which should be either JSON or XML, depending on what was defined in the request. Output defaults to JSON if this is not defined in the original request.
areas	The subsection that lists available areas.
area#		A given area that can be used for additional queries.

List sections (

)

Each area contains sections you reference. This query defines how to get a list of available sections.

Example payload:

area="files"&list="sections"

Example server response:

{
  "api_version": "1.0",
  "response_timestamp": null,
  "format": "json",
  "area": "files",
  "sections": {
    "section1": "fileentry",
    "section2": "activex",
    "section3": "add_administrator",
    "section4": "advisory",
    "section105": "worm",
   ... example response truncated ...
    "section106": "x86",
    "section107": "xxe",
    "section108": "main",
  }
}

API output key:

api_version	The current version of the API that you're using.
response_timestamp	The date and time the response was provided.
format	The output format, which should be either JSON or XML, depending on what was defined in the request. Output defaults to JSON if this is not defined in the original request.
area	The area of the site you are referencing.
section	The section for the given area that was processed.
section#		An individual section available to query.
search			Search-related output options if a search is performed.
sort#				Valid sort methods for search output.

List files by CVE (

)

This flow defines how to find all files in the archive related to a given CVE identifier.

Example payload:

area=files&section=cve&id=CVE-2023-22518&page=1

Example server response:

{
  "api_version": "31337.20240702",
  "response_timestamp": "2024-08-12T18:44:18+00:00",
  "area": "files",
  "format": "json",
  "page": 1,
  "total_pages": 1,
  "section": "cve",
  "entry": "CVE-2023-22518",
  "detail": "All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. \n\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.",
  "date": "2023-10-31 00:00:00 UTC",
  "total_findings": 1,
  "files": {
    "file1": {
      "id": 176264,
      "meta": {
        "posted": "2023-12-19",
        "title": "Atlassian Confluence Improper Authorization / Code Execution",
        "detail": "This improper authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to the Confluence instance administrator. This Metasploit module uses the administrator account to install a malicious .jsp servlet plugin which the user can trigger to gain code execution on the target in the context of the of the user running the confluence server.",
        "file_name": "atlassian_confluence_unauth_backup.rb.txt",
        "file_sha256": "26d73b4952befcec0a56b50c408cd4fd4e5babeec09700eba379dfb85cf91c39",
        "file_download_link": "https://dl.packetstormsecurity.net/2312-exploits/atlassian_confluence_unauth_backup.rb.txt",
        "credits": {
          "credit1": {
            "name": "jheysel-r7",
            "url": "https://packetstorm.news/files/author/15682"
          },
          "credit2": {
            "name": "Atlassian",
            "url": "https://packetstorm.news/files/author/13027"
          }
        },
        "tags": {
          "tag1": {
            "name": "Code Execution",
            "url": "https://packetstorm.news/files/code_execution/1",
            "api": "area=files&section=code_execution&page=1"
          },
          "tag2": {
            "name": "Exploit",
            "url": "https://packetstorm.news/files/exploit/1",
            "api": "area=files&section=exploit&page=1"
          }
        },
        "cves": {
          "cve1": {
            "id": "CVE-2023-22518",
            "url": "https://packetstorm.news/files/cve/CVE-2023-22518",
            "api": "area=files&section=cve&id=CVE-2023-22518&page=1"
          }
  ... example response truncated ...
        }
      }
    }
  }
}

API output key:

api_version	The current version of the API that you're using.
response_timestamp	The date and time the response was provided.
area	The section of the site you are referencing.
format	The output format, which should be either JSON or XML, depending on what was defined in the request. Output defaults to JSON if this is not defined in the original request.
page	The current page of 25 data elements being returned. The newest data beings on the lowest page.
total_pages	The total amount of pages related to your query.
section	The section for the given area that was processed.
entry	The CVE identifier requested.
detail	The details surrounding the CVE.
date	The date for the CVE.
total_findings	A tally of total items found in relation to your query.
files	The data block that encompasses all metadata related to each file entry associated with the query.
	file#	Signifies a file entry is next. The # will be 1-25 for the given elements of the page of data.
		id	The database identifier for the file entry inside of Packet Storm.
			meta	The area where associated metadata for the entry lives.
				posted	The date the item was added to the archive.
				title	The title of the entry.
				detail	The description of the entry.
				file_name	The file's name.
				file_sha256	The SHA-256 checksum associated with the file. Used to provide an integrity check, if needed.
				file_download_link	The URL to directly download the file.
				credits	The section for any relevant source data, such as who provided the advisory or relevant research. If credits are not available, this will not be included.
					credit#	The unique entry for a given source. Files may have multiple attributed sources.
						name	The name of the source.
						url	The url to the source profile on Packet Storm.
				tags	The section where any tags related to the file are noted.
					tag#	The unique entry for a given tag. Files may have multiple tags associated with them.
						name	The is the name of the tag.
						url	The Packet Storm link showing all entries associated with a tag.
						api	The API payload used to reference data associated to the given tag.

List single file entry (

)

If telemetry for an exact file entry is needed, it can be retrieved using this flow.

Example payload:

area=files&section=fileentry&id=100000

Example server response:

{
  "api_version": "31337.20240702",
  "response_timestamp": "2024-08-12T18:38:19+00:00",
  "area": "files",
  "format": "json",
  "page": 1,
  "total_pages": 1,
  "section": "fileentry",
  "total_findings": 1,
  "files": {
    "file1": {
      "id": 100000,
      "meta": {
        "posted": "2011-04-02",
        "title": "Allomani News 1.0 Cross Site Request Forgery",
        "detail": "Allomani News version 1.0 suffers from a cross site request forgery vulnerability.",
        "file_name": "allomaninews-xsrf.txt",
        "file_sha256": "53bdf562be2f762b55f653bedf8c12c61b1420e21ef33c178c43138bd0ca41d8",
        "file_download_link": "https://dl.packetstormsecurity.net/1104-exploits/allomaninews-xsrf.txt",
        "credits": {
          "credit1": {
            "name": "AtT4CKxT3rR0r1ST",
            "url": "https://packetstorm.news/files/author/7811"
          }
        },
        "tags": {
          "tag1": {
            "name": "CSRF",
            "url": "https://packetstorm.news/files/csrf/1",
            "api": "area=files&section=csrf&page=1"
          },
          "tag2": {
            "name": "Exploit",
            "url": "https://packetstorm.news/files/exploit/1",
            "api": "area=files&section=exploit&page=1"
          }
        }
      }
    }
  }
}

API output key:

api_version	The current version of the API that you're using.
response_timestamp	The date and time the response was provided.
area	The section of the site you are referencing.
format	The output format, which should be either JSON or XML, depending on what was defined in the request. Output defaults to JSON if this is not defined in the original request.
page	The current page of 25 data elements being returned. The newest data begins on the lowest page.
total_pages	The total amount of pages related to your query.
section	The section for the given area that was processed.
total_findings	A tally of total items found in relation to your query.
files	The data block that encompasses all metadata related to each file entry associated with the query.
	file#	Signifies a file entry is next. The # will be 1-25 for the given elements of the page of data.
		id	The database identifier for the file entry inside of Packet Storm.
			meta	The area where associated metadata for the entry lives.
				posted	The date the item was added to the archive.
				title	The title of the entry.
				detail	The description of the entry.
				file_name	The file's name.
				file_sha256	The SHA-256 checksum associated with the file. Used to provide an integrity check, if needed.
				file_download_link	The URL to directly download the file.
				credits	The section for any relevant source data, such as who provided the advisory or relevant research. If credits are not available, this will not be included.
					credit#	The unique entry for a given source. Files may have multiple attributed sources.
						name	The name of the source.
						url	The url to the source profile on Packet Storm.
				tags	The section where any tags related to the file are noted.
					tag#	The unique entry for a given tag. Files may have multiple tags associated with them.
						name	The name of the tag.
						url	The Packet Storm link showing all entries associated with a tag.
						api	The API payload used to reference data associated with a tag.

List files (

)

This area shows you how to query a file list based on a particular section. Note that this query would return the latest 25 entries from the database, and increasing the page parameter will show the next 25 entries, and so forth. If you decide to not include the output variable, it will default to JSON. Please note that to get a list of the latest files in their order of addition to the archive, you can set section=main.

Example payload:

area=files&section=advisory&page=1&output=json

Example server response:

{
  "api_version": "31337.20240702",
  "response_timestamp": "2024-08-14T19:02:26+00:00",
  "area": "files",
  "format": "json",
  "page": 1,
  "total_pages": 3419,
  "section": "advisory",
  "total_findings": 85451,
  "files": {
    "file1": {
      "id": 178888,
      "meta": {
        "posted": "2024-05-31",
        "title": "Red Hat Security Advisory 2024-3527-03",
        "detail": "Red Hat Security Advisory 2024-3527-03 - Red Hat AMQ Streams 2.7.0 is now available from the Red Hat Customer Portal. Issues addressed include buffer overflow, denial of service, integer overflow, memory leak, and resource exhaustion vulnerabilities.",
        "file_name": "RHSA-2024-3527-03.txt",
        "file_sha256": "f7976b8e170be546f0ae90244875124b0d4dbae1498c74c776b4c1380ae64a0d",
        "file_download_link": "https://dl.packetstormsecurity.net/2405-advisories/RHSA-2024-3527-03.txt",
        "credits": {
          "credit1": {
            "name": "Red Hat",
            "url": "https://packetstorm.news/files/author/4676"
          }
        },
        "tags": {
          "tag1": {
            "name": "Advisory",
            "url": "https://packetstorm.news/files/advisory/1",
            "api": "area=files&section=advisory&page=1"
          },
          "tag2": {
            "name": "DoS",
            "url": "https://packetstorm.news/files/denial_of_service/1",
            "api": "area=files&section=denial_of_service&page=1"
          },
          "tag3": {
            "name": "Overflow",
            "url": "https://packetstorm.news/files/overflow/1",
            "api": "area=files&section=overflow&page=1"
          },
          "tag4": {
            "name": "Linux",
            "url": "https://packetstorm.news/files/os:linux/1",
            "api": "area=files&section=os:linux&page=1"
          },
          "tag5": {
            "name": "RedHat",
            "url": "https://packetstorm.news/files/os:redhat/1",
            "api": "area=files&section=os:redhat&page=1"
          },
          "tag6": {
            "name": "Vulnerability",
            "url": "https://packetstorm.news/files/vulnerability/1",
            "api": "area=files&section=vulnerability&page=1"
          },
          "tag7": {
            "name": "Memory Leak",
            "url": "https://packetstorm.news/files/memory_leak/1",
            "api": "area=files&section=memory_leak&page=1"
          }
        },
        "cves": {
          "cve1": {
            "id": "CVE-2021-3520",
            "url": "https://packetstorm.news/files/cve/CVE-2021-3520",
            "api": "area=files&section=cve&id=CVE-2021-3520&page=1"
          }
        }
      }
    },
    "file2": {
  ... example response truncated ...
     }
    }
  }
}

API output key:

api_version	The current version of the API that you're using.
response_timestamp	The date and time the response was provided.
area	The section of the site you are referencing.
format	The output format, which should be either JSON or XML, depending on what was defined in the request. Output defaults to JSON if this is not defined in the original request.
page	The current page of 25 data elements being returned. The newest data begins on the lowest page.
total_pages	The total amount of pages related to your query.
section	The section for the given area that was processed.
total_findings	A tally of total items found in relation to your query.
files	The data block that encompasses all metadata related to each file entry associated with the query.
	file#	Signifies a file entry is next. The # will be 1-25 for the given elements of the page of data.
		id	The database identifier for the file entry inside of Packet Storm.
			meta	The area where associated metadata for the entry lives.
				posted	The date the item was added to the archive.
				title	The is the title of the entry.
				detail	The description of the entry.
				file_name	The file's name.
				file_sha256	The SHA-256 checksum associated with the file. Used to provide an integrity check, if needed.
				file_download_link	The URL to directly download the file.
				credits	The section for any relevant source data, such as who provided the advisory or relevant research. If credits are not available, this will not be included.
					credit#	The unique entry for a given source. Files may have multiple attributed sources.
						name	The name of the source.
						url	The Packet Storm link showing all entries associated with a source.
				tags	The section where any tags related to the file are noted.
					tag#	The unique entry for a given tag. Files may have multiple tags associated with them.
						name	The name of the tag.
						url	The Packet Storm link showing all entries associated with a tag.
						api	The API payload that can used to reference data associated with a tag.

Search files (

)

Searching terms in the file section allows for alphanumeric characters, periods, dashes, underscores, and spaces (spaces are only allowed if the query is encapsulated by double quotes). There is a maximum of five search terms per query.

Example payload:

area=files&section=search&terms="race condition"+hacker&page=1&sort="newest"

Example server response:

{
  "api_version": "31337.20240702",
  "response_timestamp": "2024-08-12T18:48:55+00:00",
  "area": "files",
  "format": "json",
  "page": 1,
  "total_pages": 53,
  "section": "search",
  "sort": "newest",
  "terms": [
    "race condition",
    "hacker"
  ],
  "total_findings": 1313,
  "files": {
    "file1": {
      "id": 178842,
      "match": 1,
      "meta": {
        "posted": "2024-05-29",
        "title": "Ubuntu Security Notice USN-6795-1",
        "detail": "Ubuntu Security Notice 6795-1 - Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use-after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service. It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service.",
        "file_name": "USN-6795-1.txt",
        "file_sha256": "1263e2b9ac7045e640a955619fc9ec7e9ee0cee6811cce5ca858a631117df48d",
        "file_download_link": "https://dl.packetstormsecurity.net/2405-advisories/USN-6795-1.txt",
        "credits": {
          "credit1": {
            "name": "Ubuntu",
            "url": "https://packetstorm.news/files/author/3695"
          }
        },
        "tags": {
          "tag1": {
            "name": "Advisory",
     ... example response truncated ...
          }
        },
        "cves": {
          "cve1": {
            "id": "CVE-2024-2193",
            "url": "https://packetstorm.news/files/cve/CVE-2024-2193",
            "api": "area=files&section=cve&id=CVE-2024-2193&page=1"
          }
        }
      }
    }
  }
}

API output key:

api_version	The current version of the API that you're using.
response_timestamp	The date and time the response was provided.
area	The section of the site you are referencing.
format	The output format, which should be either JSON or XML, depending on what was defined in the request. Output defaults to JSON if this is not defined in the original request.
page	The current page of 25 data elements being returned. Data in the database has the newest data start at the lowest page.
total_pages	The total amount of pages related to your query.
section	The section for the given area that was processed.
sort	The chosen sort method. This will be either newest or relevant.
terms	The search terms provided.
total_findings	A tally of total items found in relation to your query.
files	The data block that encompasses all metadata related to each file entry associated with the query.
	file#	Signifies a file entry is next. The # will be 1-25 for the given elements of the page of data.
		id	The database identifier for the file entry inside of Packet Storm.
		match	The number of matches triggered for the given entry (related to the provided search terms).
			meta	The area where associated metadata for the entry lives.
				posted	The date the item was added to the archive.
				title	The title of the entry.
				detail	The description of the entry.
				file_name	The file's name.
				file_sha256	The SHA-256 checksum associated with the file. Used to provide an integrity check, if needed.
				file_download_link	The URL to directly download the file.
				credits	The section for any relevant source data, such as who provided the advisory or relevant research. If credits are not available, this will not be included.
					credit#	The unique entry for a given source. Files may have multiple attributed sources.
						name	The name of the source.
						url	The Packet Storm link showing all entries associated with a source.
				tags	The section where any tags related to the file are noted.
					tag#	The unique entry for a given tag. Files may have multiple tags associated with them.
						name	The name of the tag.
						url	The Packet Storm link showing all entries associated with a tag.
						api	The API payload used to reference data associated with a tag.

List single news entry (

)

If telemetry for an exact news entry is needed, it can be retrieved using this flow.

Example payload:

area=news&section=newsentry&id=34900

Example server response:

{
  "api_version": "31337.20240702",
  "response_timestamp": "2024-08-12T18:39:54+00:00",
  "area": "news",
  "format": "json",
  "page": 1,
  "total_pages": 1,
  "section": "newsentry",
  "total_findings": 1,
  "news": {
    "item1": {
      "id": 34900,
      "meta": {
        "posted": "2023-08-14",
        "title": "Illinois Just Made It Possible To Sue People For Doxxing Attacks",
        "url": "https://arstechnica.com/tech-policy/2023/08/illinois-just-made-it-possible-to-sue-people-for-doxxing-attacks/",
        "credit": "ars technica",
        "credit_url": "http://arstechnica.com/",
        "tags": {
          "tag1": {
            "name": "Headline",
            "url": "https://packetstorm.news/news/headline/1",
            "api": "area=news&section=headline&page=1"
          },
          "tag2": {
            "name": "Hacker",
            "url": "https://packetstorm.news/news/hacker/1",
            "api": "area=news&section=hacker&page=1"
          },
          "tag3": {
            "name": "Government",
            "url": "https://packetstorm.news/news/government/1",
            "api": "area=news&section=government&page=1"
          },
          "tag4": {
            "name": "Privacy",
            "url": "https://packetstorm.news/news/privacy/1",
            "api": "area=news&section=privacy&page=1"
          },
          "tag5": {
            "name": "USA",
            "url": "https://packetstorm.news/news/usa/1",
            "api": "area=news&section=usa&page=1"
          },
          "tag6": {
            "name": "Data Loss",
            "url": "https://packetstorm.news/news/data_loss/1",
            "api": "area=news&section=data_loss&page=1"
          }
        }
      }
    }
  }
}

API output key:

api_version	The current version of the API that you're using.
response_timestamp	The date and time the response was provided.
area	The section of the site you are referencing.
format	The output format, which should be either JSON or XML, depending on what was defined in the request. Output defaults to JSON if this is not defined in the original request.
page	The current page of 25 data elements being returned. Data in the database has the newest data being on the lowest page.
total_pages	The total amount of pages related to your query.
section	The section for the given area that was processed.
total_findings	A tally of total items found in relation to a query.
news	The data block that encompasses all metadata related to each news entry associated with the query.
	news#	Signifies a news entry is next. The # will be 1-25 for the given elements of the page of data.
		id	The database identifier for the news entry inside of Packet Storm.
			meta	The area where associated metadata for the entry lives.
				posted	The date the item was added to the archive.
				title	The title of the entry.
				url	The URL for the actual articles.
				credit	The source of the article.
				homepage	The homepage for the source of the article.
				tags	The section where any tags related to the article are noted.
					tag#	The unique entry for a given tag. Articles may have multiple tags associated with them.
						name	The name of the tag.
						url	The link to Packet Storm to see all news entries associated with a tag.
						api	The API payload that can used to reference data associated with a tag.

List news (

)

This area shows you how to query a news list based on a section. Note that this query would return the latest 25 entries from the database though increasing the page parameter will show the next 25, and so forth. If you decide to not include the output variable, it will default to JSON. Please note that to get a list of the latest news headlines in their order of addition to the archive, you can set section=main. This particular example demonstrates how XML output would look.

Example payload:

area=news&section=government&page=1&output=xml

This would return the latest 25 entries from the database. Using page=2 would select the second 25 entries, and so forth.

Example server response:

<?xml version="1.0" encoding="UTF-8"?>
<packet-storm>
  <api-version>31337.20240702</api-version>
  <response-timestamp type="dateTime">2024-07-16T20:04:25+00:00</response-timestamp>
  <area>news</area>
  <format>xml</format>
  <page type="integer">1</page>
  <total-pages type="integer">276</total-pages>
  <section>government</section>
  <total-findings type="integer">6900</total-findings>
  <news>
    <news1>
      <id type="integer">35951</id>
      <meta>
        <posted>2024-05-31</posted>
        <title>Information Of Hundreds Of European Politicians Found On Dark Web</title>
        <url>https://www.securityweek.com/information-of-hundreds-of-european-politicians-found-on-dark-web/</url>
        <credit>Security Week</credit>
        <homepage>https://www.securityweek.com/</homepage>
        <tags>
          <tag1>
            <name>Headline</name>
            <url>https://packetstorm.news/news/headline/1</url>
            <api>area=news&section=headline&page=1</api>
          </tag1>
          <tag2>
            <name>Hacker</name>
            <url>https://packetstorm.news/news/hacker/1</url>
            <api>area=news&section=hacker&page=1</api>
          </tag2>
          <tag3>
            <name>Government</name>
            <url>https://packetstorm.news/news/government/1</url>
            <api>area=news&section=government&page=1</api>
          </tag3>
          <tag4>
            <name>Privacy</name>
            <url>https://packetstorm.news/news/privacy/1</url>
            <api>area=news&section=privacy&page=1</api>
          </tag4>
        </tags>
      </meta>
    </news1>
    <news2>
      <id type="integer">35948</id>
      <meta>
        <posted>2024-05-31</posted>
        <title>CISA Warns Of Exploited Linux Kernel Vulnerability</title>
        <url>https://www.securityweek.com/cisa-warns-of-exploited-linux-kernel-vulnerability/</url>
        <credit>Security Week</credit>
        <homepage>https://www.securityweek.com/</homepage>
        <tags>
          <tag1>
   ... example response truncated ...
    </news25>
  </news>
</packet-storm>

API output key:

api_version	The current version of the API that you're using.
response_timestamp	The date and time the response was provided.
area	The section of the site you are referencing.
format	The output format, which should be either JSON or XML, depending on what was defined in the request. Output defaults to JSON if this is not defined in the original request.
page	The current page of 25 data elements being being returned. The newest data beings on the lowest page.
total_pages	The total amount of pages related to your query.
section	The section for the given area that was processed.
total_findings	A tally of total items found in relation to a query.
news	The data block that encompasses all metadata related to each news entry associated with the query.
	news#	Signifies a news entry is next. The # will be 1-25 for the given elements of the page of data.
		id	The database identifier for the news entry inside of Packet Storm.
			meta	The area where associated metadata for the entry lives.
				posted	The date the item was added to the archive.
				title	The title of the entry.
				url	The URL to the actual articles.
				credit	The source of the article.
				homepage	The homepage for the source of the article.
				tags	The section where any tags related to the article are noted.
					tag#	The unique entry for a given tag. Articles may have multiple tags associated with them.
						name	The name of the tag.
						url	The Packet Storm link showing all entries associated with a tag.
						api	The API payload that can used to reference data associated with a tag.

Search news (

)

Searching terms in the News section allows for alphanumeric characters, periods, dashes, underscores, and spaces (though spaces are only allowed if the query is encapsulated by double quotes). There are a maximum of five search terms allowed per query.

Example payload:

area=news&section=search&terms="hackers target"+microsoft&page=1&sort_method=relevant

Example server response:

{
  "api_version": "31337.20240702",
  "response_timestamp": "2024-08-12T19:07:47+00:00",
  "area": "news",
  "format": "json",
  "page": 1,
  "total_pages": 44,
  "section": "search",
  "sort": "relevant",
  "terms": [
    "hackers target",
    "microsoft"
  ],
  "total_findings": 1098,
  "news": {
    "news1": {
      "id": 17549,
      "match": 4,
      "meta": {
        "posted": "2010-07-01",
        "title": "Hackers Target Microsoft Windows XP Support System",
        "url": "http://news.bbc.co.uk/2/hi/technology/10473495.stm",
        "credit": "BBC News UK",
        "homepage": "http://www.bbc.com/",
        "tags": {
          "tag1": {
            "name": "Hacker",
            "url": "https://packetstorm.news/news/hacker/1",
            "api": "area=news&section=hacker&page=1"
          },
          "tag2": {
            "name": "Microsoft",
            "url": "https://packetstorm.news/news/microsoft/1",
            "api": "area=news&section=microsoft&page=1"
          }
        }
      }
    },
    "news2": { 
   ... example response truncated ...
    }
  }
}

API output key:

api_version	The current version of the API that you're using.
response_timestamp	The date and time the response was provided.
area	The section of the site you are referencing.
format	The output format, which should be either JSON or XML, depending on what was defined in the request. Output defaults to JSON if this is not defined in the original request.
page	The current page of 25 data elements being returned. The newest data begins on the lowest page.
total_pages	The total amount of pages related to your query.
section	The section for the given area that was processed.
sort	The chosen sort method. This will be either newest or most relevant.
terms	The search terms provided.
total_findings	A tally of total items found in relation to a query.
news	The data block that encompasses all metadata related to each news entry associated with the query.
	news#	Signifies a news entry is next. The # will be 1-25 for the given elements of the page of data.
		id	The database identifier for the news entry inside of Packet Storm.
		match	How many matches triggered for the given entry related to the provided search terms.
			meta	The area where associated metadata for the entry lives.
				posted	The date the item was added to the archive.
				title	The title of the entry.
				url	The URL for the actual articles.
				credit	The source of the article.
				homepage	The homepage for the source of the article.
				tags	The section where any tags related to the article are noted.
					tag#	The unique entry for a given tag. Articles may have multiple tags associated with them.
						name	The name of the tag.
						url	The Packet Storm link showing all entries associated with a tag.
						api	The API payload to reference data associated with a tag.

API Manager

Help Section

[ SPONSORED ]

	Get your new product or service noticed on Packet Storm today!
	Packet Storm now offers advertising. There's no better way to reach the security community. Try it out!

Beat your competitors and get API access integrated now!

Packet Storm is now offering API access to the entire archive. Try it out!

[ SPONSORED ]

System
About	Files	News	Vote
Help
Services
API	Advertise	Contact
Account
Join	Login