What is the Buffer API ?

API Endpoint

https://api.buffer.dk/

Buffer is a private little project that grew large over time. I think i have like 5TB data buffered :) It's not widely used nor known, so I'm not going to advertise to use it. It's simply there, if you have any use for it ... Then enjoy!

It all started back when a web page I accessed a lot to lookup ip range and whois detailed info was taken down. Luckily I found an archived version and crawled it and stored it locally. I think back then I did most of it with httrack on a linux box. Did this for many years when ever i found some data on the internet i was afraid would get lost. So i made a online web site buffer.dk where i could create like a buffered version of the data i found on the internet

Later some of the data would make sense to parse, index and build a small database around it. But then came the problem now I had to code something to access it. So over time I ended up with all these small scripts looking at data and or grabbing data from online sources. Some of it was utterly useless, some you can already do a million other places on the net, some made sense and others is simply unique :)

So as time went on a words like API became a thing, I saw the cool in creating a little website where you could access all these useful and useless scripts in a more unified solution. So this is basically what this is, I'm currently slowly converting these scripts and data into a api data endpoints

Donations

So far I just pay for it out of my own pocket, the ec2 instance is also not very big but that might change over time if we get to much traffic for it to handle. Any donations made to this BTC address will go into this project for future improvements or maintenance cost. Again, I don't expect any donations, but they are however recieved with open arms!

BTC Address - 31jzgaJZuzGhDZQYrDTHQzmRFYnvHhzr57

How to add data or api data endpoints

You can contact me on Github, via telepathy or Show Email :)

Security, Limits, Protection and Server Load

Again, this is a little private project on a small server. I'm not that important if you know what I mean :) If you really wanted to obstruct this service you could, why you wanted to though - I don't know.

I don't impose limits on the data and api calls. I mean the whole point of this site is to make it available. So if you decide to crawl everything, you can do so. I only ask you to be polite when "talking" to this service etc doing loops/crawl. Again, as the server is small it will see high load when there are many requests. I might eventually upgrade it along the way, might even put it behind a load balancer if needed. But I'm not paying for that - lol ! I put it behind CloudFlare just to catch the most obviously filth

There isn't much to this site, I don't have any security in place like oAuth or "secure" web tokens that you need to parse along to view specific data. It's all public.

I do have a IP whitelist that gives access to any API endpoint i have marked as "protected", you wont be able to see these unless you're whitelisted. This is only for internal use

Buffer API Statistics

We all love statistics, atleast i know i do!

I have tried to come up with what i think is fun to look at, i don't really know what to use this for but it's always cool to have :) I like that i calculate average execution time on each API also i like the bytes sent. The last call is perhaps not that important to show but i made it so that i can someday cleanup in unsused api's etc...

OVERALL NUMBERS

Total API Count	Total API Requests	Total Bytes Sent
10	4204	7.07MB

INDIVIDUAL API STATISTICS

API Name	Last Called	Count	GET	POST	PUT	DELETE	Sent	Avg Time
cve-lookup	2020-08-28	2	0	2	0	0	2.17kB	1ms
exploit-lookup	2024-11-18	345	307	38	0	0	5.94MB	457ms
google-search	2022-03-30	34	0	34	0	0	616.55kB	662ms
myip	2024-11-18	3457	3456	1	0	0	230.69kB	27ms
phone-lookup-scam	2020-10-11	87	0	87	0	0	247.71kB	330ms
portcheck	2021-01-31	73	73	0	0	0	19.44kB	2.9sec
tor-is-exitnode	2024-11-18	157	155	2	0	0	13.42kB	2.3sec
tor-onion-lookup	2020-08-28	19	0	19	0	0	6.13kB	6.2sec
trustpilot	2020-08-27	16	0	16	0	0	11.47kB	6ms

Buffer API overview

Ever wanted to know how to call us from a cli? Try cURL!

# Basic GET call
curl http://api.buffer.dk/api-name

# Basic POST call urlencoded
curl -X POST \
 -d "param1=value1&param2=value2" \
 http://api.buffer.dk/api-name

# Basic POST call json
curl -X POST \
 -d '{"key1":"value1", "key2":"value2"}' \
 -H "Content-Type: application/json" \
 http://api.buffer.dk/api-name
                

This is a overview list that shows all the API's that are currently active and public on the site. I know it might not be the best overview, but at least it's there. More text for search optimization etc.

INTERNAL Everything is happening internally. (Should always be working)
EXTERNAL Everything is happening externally. (Might break depending on source)
INT-CACHED Like INTERNAL, but we cache the results in an effort to make it faster!
EXT-CACHED Like EXTERNAL, but we cache the results in an effort to make it faster!
HARDWARE Talks to hardware, ie. microcontroller via serial (Might break depending on connections)

BUFFER API LIST

API Name	API Type	API Description
cve-lookup	INTERNAL	Lookup Common Vulnerabilities and Exposures (CVE)
exploit-lookup	INTERNAL	Search Exploit Database
google-search	EXTERNAL	Search Google for up to 10 results
myip	INTERNAL	Show your client IP address and reverse DNS
phone-lookup-scam	EXTERNAL	Get a quick overview if the phone number might be a scammer!
portcheck	INTERNAL	Check TCP or UDP if its open on the remote host
tor-is-exitnode	EXTERNAL	Lookup IP address to see if it's from Tor network
tor-onion-lookup	EXTERNAL	Lookup Tor Onion address, get title and http return code
trustpilot	INTERNAL	Search for Trustpilot (DK) reviews

/ cve-lookup

# Request method - POST
curl -X POST \
 -F 'fieldname=fieldvalue' \
 https://api.buffer.dk/cve-lookup
 

This is a lookup tool for Common Vulnerabilities and Exposures (CVE) it is lookup up the CVE cases in a local database that is updated every week.

API Type	INTERNAL
Avg Latency	1ms
Cached	No
Accepted methods	POST
Endpoint URL	https://api.buffer.dk/cve-lookup

Result example :
{
  "id": "148275",
  "cve_name": "CVE-2019-16220",
  "cve_status": "Candidate",
  "cve_description": "In WordPress before 5.2.3, validation and sanitization of a URL in ...",
  "cve_references": [
    "BUGTRAQ:20200108 [SECURITY] [DSA 4599-1] wordpress security update",
    "URL:https://seclists.org/bugtraq/2020/Jan/8",
    "DEBIAN:DSA-4599",
    "URL:https://www.debian.org/security/2020/dsa-4599",
    "DEBIAN:DSA-4677",
    "URL:https://www.debian.org/security/2020/dsa-4677",
    "MISC:https://core.trac.wordpress.org/changeset/45971",
    "MISC:https://github.com/WordPress/WordPress/commit/c86ee39ff4c1a79b93c967...",
    "MISC:https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-mainten.../",
    "MISC:https://wpvulndb.com/vulnerabilities/9863",
    "MLIST:[debian-lts-announce] 20191017 [SECURITY] [DLA 1960-1] wordpress sec...",
    "URL:https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html"
  ],
  "cve_phase": "Assigned (20190911)",
  "cve_votes": [
    "None (candidate not yet proposed)"
  ],
  "cve_comments": ""
}

POST :: QUERY PARAMETERS

Field	Type	Required	Default	Description
cve	String	Yes		CVE case number (Format cve-xxxx-xxxx to cve-xxxx-xxxxxxxxxx)

/ exploit-lookup

# Request method - GET
curl https://api.buffer.dk/exploit-lookup

# Request method - POST
curl -X POST \
 -F 'fieldname=fieldvalue' \
 https://api.buffer.dk/exploit-lookup
 

Search the very infamous exploit database, you can also view latest exploits. If no arguments are givin in GET mode, it will just show todays exploits. The ExploitDB is updateded every 30min 24/7. So it should always contain the latests exploits. This is only ment for research. If you want to download the files directly from us when searching, include the 'include-script' option. Or else you can visit the 'url' link and see the content there.

API Type	INTERNAL
Avg Latency	457ms
Cached	No
Accepted methods	GET, POST
Endpoint URL	https://api.buffer.dk/exploit-lookup

Result example :
[
   {
      "script" : false,
      "platform" : "php",
      "author" : "Riemann",
      "url" : "https://www.exploit-db.com/exploits/46982",
      "id" : "46982",
      "type" : "webapps",
      "date" : "2019-06-11",
      "title" : "phpMyAdmin 4.8 - Cross-Site Request Forgery"
   },
   {
      "script" : false,
      "platform" : "php",
      "title" : "phpMyAdmin 4.8.0 < 4.8.0-1 - Cross-Site Request Forgery",
      "url" : "https://www.exploit-db.com/exploits/44496",
      "author" : "revengsh",
      "type" : "webapps",
      "date" : "2018-04-23",
      "id" : "44496"
   },
   ...
]

GET :: QUERY PARAMETERS

Field	Type	Required	Default	Description
lastmonth	Boolean	No	false	Get all exploits from last month
thismonth	Boolean	No	false	Get all exploits from this month
today	Boolean	No	true	Get all exploits from today
yesterday	Boolean	No	false	Get all exploits from yesterday

POST :: QUERY PARAMETERS

Field	Type	Required	Default	Description
search	String	Yes		Search for exploit, accept [a-zA-Z0-9\-\.\s_]
include-script	Boolean	No	false	Include exploit script as base64 encoded
strict	Boolean	No	false	Do a strict search

/ google-search

# Request method - POST
curl -X POST \
 -F 'fieldname=fieldvalue' \
 https://api.buffer.dk/google-search
 

This is a quick and dirty way to search on Google for up to 10 results. It's directly parsing of their main page and might break if they change anything. This is a good way to avoid their protected API etc if you just need a quick little peek at a Google search result form a script or bot :)

API Type	EXTERNAL
Avg Latency	662ms
Cached	No
Accepted methods	POST
Endpoint URL	https://api.buffer.dk/google-search

Result example :
{
    "error": false,
    "found": 10,
    "results": [
        {
            "description": "Feb 27, 2009 - Return Values \u00b6. preg_match()  ...",
            "title": "preg_match - Manual - PHP",
            "url": "https://www.php.net/manual/en/function.preg-match.php"
        },
        {
            "description": "Definition and Usage. The preg_match() function returns ...",
            "title": "PHP preg_match() Function - W3Schools",
            "url": "https://www.w3schools.com/php/func_regex_preg_match.asp"
        },
        {
            "description": "Test PHP regular expressions live in your browser ...",
            "title": "PHP Live Regex",
            "url": "https://www.phpliveregex.com/"
        },
        ...
    ],
    "status": true
}

POST :: QUERY PARAMETERS

Field	Type	Required	Default	Description
search	String	Yes		Search string to search on Google for

/ myip

# Request method - GET
curl https://api.buffer.dk/myip
 

This simple api endpoint will show you your IP address and the reverse DNS of that ip address if it exists. Yes yes i know! So many sites out there can do this, but i like to keep it inhouse, hate asking others to show my ip :)

API Type	INTERNAL
Avg Latency	27ms
Cached	No
Accepted methods	GET
Endpoint URL	https://api.buffer.dk/myip

Result example :
{
   "ip":"111.111.111.111",
   "dns":"111-111-111-111-reverse.dns.isp.com"
}

/ phone-lookup-scam

# Request method - POST
curl -X POST \
 -F 'fieldname=fieldvalue' \
 https://api.buffer.dk/phone-lookup-scam
 

This utilized the 118.dk website to lookup a phone number and gather intel. We then show the parsed output in a nice little package. This might break depending on 118.dk if they change their html :)

API Type	EXTERNAL
Avg Latency	330ms
Cached	No
Accepted methods	POST
Endpoint URL	https://api.buffer.dk/phone-lookup-scam

Result example :
{
  "number": 20762861,
  "times_searched": "2427",
  "country_code": "DK",
  "country_name": "Denmark",
  "risk_pct": "80%",
  "risk_scale": "5",
  "risk_level": "Very high",
  "last_3months_activity_calls": 1315,
  "last_3months_activity_detailed": {
    "2020": {
      "August": {
        "31": "231",
        ...
        "1": "8"
      },
      "July ": {
        "31": "20",
        ...
        "1": "13"
      },
     ...
    }
  },
  "reported_number": 90,
  "reported_types": [
    {
      "type": "Svindel",
      "reports": "36"
    },
    {
      "type": "Telemarketing",
      "reports": "28"
    },
    ...
  ]
}

POST :: QUERY PARAMETERS

Field	Type	Required	Default	Description
number	String	Yes		Phone number (Can include country-code like +XX)
showdetails	Boolean	No	false	Show detailed info on reports and call activity

/ portcheck

# Request method - GET
curl https://api.buffer.dk/portcheck
 

This is a simple way to test if a specific port is open on a remote server either UDP or TCP

API Type	INTERNAL
Avg Latency	2.9sec
Cached	No
Accepted methods	GET
Endpoint URL	https://api.buffer.dk/portcheck

Result example :
{
  "target": "www.dr.dk",
  "port": 80,
  "target_ip": "23.210.252.96",
  "target_reverse_dns": "a23-210-252-96.deploy.static.akamaitechnologies.com",
  "port_status": "OPEN",
  "port_service": "tcp/http",
  "port_info": "succeeded!",
  "port_data": false
}

GET :: QUERY PARAMETERS

Field	Type	Required	Default	Description
port	String	Yes		Target port to check if open/reachable
target	String	Yes		Target hostname or IP
macro	Enum	No	disabled	Test known services on specific ports (disabled,smtp)
protocol	String	No	tcp	TCP or UDP
verbose	Boolean	No	false	Do we try to listen for data?

/ tor-is-exitnode

# Request method - GET
curl https://api.buffer.dk/tor-is-exitnode

# Request method - POST
curl -X POST \
 -F 'fieldname=fieldvalue' \
 https://api.buffer.dk/tor-is-exitnode
 

This will lookup a IP address on the torpoject website and see if it belongs to any exit nodes or relays. Please note the the exit node has to be at least 2 days old to show up. Also looks like they only accept IPv4 addresses for now. Use GET for client_ip and POST to specify ip address

API Type	EXTERNAL
Avg Latency	2.3sec
Cached	No
Accepted methods	GET, POST
Endpoint URL	https://api.buffer.dk/tor-is-exitnode

Result example :
{
   "ip":"185.220.100.243",
   "tor":true,
   "exitrelay":true,
   "nickname":"F3Netze",
   "fingerprint":"9D5A7A81BC6194555CE751F75FB196E4A3982CC5"
}

POST :: QUERY PARAMETERS

Field	Type	Required	Default	Description
ip	String	Yes		IP address to lookup

/ tor-onion-lookup

# Request method - POST
curl -X POST \
 -F 'fieldname=fieldvalue' \
 https://api.buffer.dk/tor-onion-lookup
 

You can check if a Tor Onion hostname / address is responding on the Tor Network. I will return the HTTP return-code and also the website title if i can find it. Also use follow field set to true to follow redirects. If you follow redirects there is a better chance to grab website title. I show individual status for both http and https. So toggle follow to get best data.

API Type	EXTERNAL
Avg Latency	6.2sec
Cached	No
Accepted methods	POST
Endpoint URL	https://api.buffer.dk/tor-onion-lookup

Result example :
{
   "onion_address":"facebookcorewwwi.onion",
   "follow":true,
   "valid":true,
   "url_http":{
      "return-code":200,
      "status":"up",
      "title":"Facebook - Log In or Sign Up",
   },
   "url_https":{
      "return-code":200,
      "status":"up",
      "title":"Facebook - Log In or Sign Up",
   }
}

POST :: QUERY PARAMETERS

Field	Type	Required	Default	Description
onionaddr	String	Yes		Tor Onion hostname / address
follow	Boolean	No	false	Toggle if we follow redirects

/ trustpilot

# Request method - POST
curl -X POST \
 -F 'fieldname=fieldvalue' \
 https://api.buffer.dk/trustpilot
 

Search for reviews on the danish Trustpilot website. This data is crawled and parsed about every 24 hour unless they change their website it might be older as the parser will fail. You can see the last updated date for your results. NOTE, The data is like 7 years old the scraper have not been running. Encoded in UTF-8 Unicode and ASCII.

API Type	INTERNAL
Avg Latency	6ms
Cached	No
Accepted methods	POST
Endpoint URL	https://api.buffer.dk/trustpilot

Result example :
[
   {
      "id":"330",
      "name":"legetojsgiganten.dk",
      "rating_cur":"6.6",
      "rating_min":"0",
      "rating_max":"10",
      "reviews":"36",
      "email":"[email protected]",
      "street":"H\u00f8gevej 8B",
      "zip":"3400",
      "city":"Hiller\u00f8d",
      "country":"Denmark",
      "website":"http://www.trustpilot.dk/review/legetojsgiganten.dk",
      "date_added":"2013-03-13 18:06:01",
      "date_updated":"2013-10-16 15:06:26",
      "category":"kids"
   },
   {
      "id":"487",
      "name":"www.elgiganten.dk",
      "rating_cur":"8.1",
      "rating_min":"0",
      "rating_max":"10",
      "reviews":"27445",
      "email":"[email protected]",
      "street":"Arne Jacobsens All\u00e9 16.2",
      "zip":"2300",
      "city":"K\u00f8benhavn S",
      "country":"Denmark",
      "website":"http://www.trustpilot.dk/review/www.elgiganten.dk",
      "date_added":"2013-03-13 18:08:04",
      "date_updated":"2013-10-16 15:38:46",
      "category":"mobile_internet"
   },
   ...
]

POST :: QUERY PARAMETERS

Field	Type	Required	Default	Description
search	String	Yes		Search string to look for in field type
type	Enum	No	name	Can be 'name' or 'email'