SPECTRE

Systematic Penetration, Enumeration, CVE Testing & Recon Engine

An interactive, modular web/API vulnerability scanner that chains together well-known open-source recon and exploitation tools (subfinder, httpx, nuclei, dalfox, sqlmap, ffuf, etc.) into 36 selectable scan modules. Point it at a URL, domain, IP, or a file of targets, pick which modules to run, and it drives each tool for you and writes everything to a timestamped output directory.

⚠️ For authorized security testing only. Only run this against systems you own or have explicit written permission to test (e.g. an active bug bounty program or pentest engagement scope). SPECTRE requires you to confirm authorization before it will run.

Features

• 36 scan modules, run individually, in combination, or all at once:

  #	Module	#	Module
  1	Subdomain Enumeration & Recon	19	Header Injection / Host Header
  2	XSS Hunting	20	Tech Detection & Screenshots
  3	SQL Injection	21	WAF Detection & Bypass
  4	SSRF Detection	22	XXE / XML Injection
  5	Local File Inclusion (LFI)	23	JWT Analysis
  6	Open Redirect	24	Cloud Storage Enumeration (S3/GCS/Azure)
  7	CORS Misconfiguration	25	Virtual Host Fuzzing
  8	SSTI Detection	26	File Upload Testing
  9	Directory & File Discovery	27	GraphQL Security
  10	.git / Source Exposure	28	NoSQL Injection
  11	JavaScript Analysis	29	Web Cache Poisoning
  12	Nuclei Template Scanning	30	CSRF / Cookie Security
  13	CVE / Known Vulnerability Checks	31	Security Headers Audit
  14	Port Scanning	32	HTTP Methods / WebDAV
  15	Subdomain Takeover	33	DNS Zone Transfer
  16	Prototype Pollution	34	SSL/TLS Deep Scan
  17	Sensitive File Discovery	35	CMS Detection & Scanning
  18	Parameter Discovery	36	Next.js RSC / CVE-2025-55182

• Flexible target input — single URL, single domain, single IP, or a file of URLs/hosts (menu-driven at startup)

• Live tool-availability dashboard — shows a ✓/✗ per tool at startup so you immediately see what's installed and what modules will be skipped

• OOB / Collaborator integration — configure a Burp Collaborator (or any interactsh-style) callback host once, and it's used automatically across SSRF, blind XSS, Log4Shell, XXE, and header-injection modules

• Optional integrations — XSS Hunter callback host, Knoxss API key, auto-detected wordlists (SecLists paths checked automatically)

• Session-based output — every run creates a timestamped directory (~/spectre_output/<target>_<timestamp>/) with per-module subfolders (subs/, xss/, sqli/, nuclei/, cves/, jwt/, graphql/, etc.) so results from different engagements never overwrite each other

• Shell-injection-safe input handling — every user-supplied domain, IP, URL, or file path is validated and shlex.quote()-escaped before being interpolated into the shell pipelines the modules run

• Resilient execution — each module wraps its underlying tools with timeouts and KeyboardInterrupt handling, so a slow or hanging tool (or a Ctrl-C) doesn't kill the whole session; failures in one module are caught so the rest of your selected modules still run

• Graceful degradation — every module checks whether its underlying tool is actually installed (via shutil.which) and skips cleanly with a warning if it isn't, rather than crashing

Requirements

SPECTRE orchestrates a large toolchain rather than reimplementing it. Use the included installer to set everything up:

python3 install_spectre_tools.py

This installs (or skips if already present):

• Go tools: subfinder, httpx, nuclei, naabu, dnsx, assetfinder, waybackurls, gf, qsreplace, anew, kxss, unfurl, httprobe, ffuf, dalfox, gau, subjs, Gxss, subjack, gowitness, hakrawler, cariddi, jsubfinder, gospider, nosqli, and more
• Python (pip) tools: sqlmap, wafw00f, droopescan, sslyze, arjun, dirsearch, uro, trufflehog, whatwaf, graphw00f
• Ruby gems: wpscan
• Rust (cargo) tools: x8, feroxbuster
• Git-cloned tools: jwt_tool, SecretFinder, LinkFinder, tplmap, ParamSpider, cloud_enum, joomscan, testssl.sh
• System packages: nmap, sslscan, openssl, jq, whatweb, amass, and more (via Homebrew on macOS or apt on Debian/Ubuntu)
• SecLists and gf patterns, auto-cloned if not already present
• Nuclei templates, auto-updated

It detects your OS (macOS/Homebrew or Debian-Ubuntu/apt), skips anything already installed, prints a pass/fail summary at the end, and offers to add Go's GOBIN to your shell PATH automatically.

Manual prerequisites

• Go, Python 3, git, pip — the installer will tell you if any are missing
• Homebrew (macOS) — required for several tools on macOS

Usage

python3 SPECTRE.py

1. Confirm you're authorized to test the target
2. Choose target type: single URL, single domain, single IP, or a file of URLs/IPs
3. Optionally configure OOB/Collaborator host, XSS Hunter, Knoxss API key, and wordlists
4. Pick modules by number (comma-separated, e.g. 1,2,5), or A for all
5. Results land in ~/spectre_output/<target>_<timestamp>/

Disclaimer

This tool actively sends payloads (SQLi, XSS, SSTI, SSRF, XXE, RCE probes, file upload attempts, etc.) to whatever target you point it at. Only use it against systems you own or are explicitly authorized to test. You are responsible for how you use it.