A state-aware, collaborative reconnaissance and ASM platform.
Spectra is a self-hosted, collaborative Attack Surface Management (ASM) ecosystem designed for red teams, bug bounty hunters, and security researchers. It goes beyond simple wrapper scripts by introducing State-Aware Diffing Logic—meaning it tracks the exact lifecycle of your assets, identifying what is newly discovered, what ports have been closed, and instantly flagging regressions in fixed vulnerabilities.
- Continuous Reconnaissance (Diff-Logic): Intelligently tracks active vs. dead assets (Subdomains, IPs, Ports, HTTP Services, Findings) across multiple scans.
- Project-Scoped RBAC: Granular Role-Based Access Control. Isolate your work into projects, invite team members securely with codes/passwords, and assign roles (Captain, Admin, Member).
- Real-Time Scan Telemetry: Watch your attack surface unfold live via a Socket.IO-powered dashboard.
- Enterprise UI/UX: A highly polished, data-dense interface built with Tailwind CSS, featuring dark mode (Void/Carbon) aesthetics and Intel Gold accents.
- Containerized by Default: Ready to deploy in seconds with persistent PostgreSQL and Redis volumes.
Watch assets and vulnerabilities populate live as the engine runs.
Get a high-level overview of exposed ports, active hosts, and critical CVEs.
Filter, search, and export your entire infrastructure state.
Spectra is fully containerized. You only need Docker and Docker Compose installed on your machine. All data (PostgreSQL, Redis) is strictly persistent out of the box, surviving reboots and container rebuilds safely.
git clone https://github.com/MoMhaidat05/Spectra.git
cd SpectraCreate a .env file in the root directory. You must define your own secure keys:
cp .env.example .envEnsure your .env contains at least:
SPECTRA_DOCKER_SECRET_KEY=your_super_secret_flask_key_here
SPECTRA_DOCKER_POSTGRES_PASSWORD=your_strong_database_passworddocker compose up --build -dNote: The first build might take a few minutes as it compiles Go-based ProjectDiscovery tools.
Navigate to http://localhost:8080 in your browser.
- Register a new account. (Only a unique username and password are required. Name is optional).
- Create a Project. The user who creates a project is automatically assigned the Captain role for that workspace.
- Invite your team using the generated Project Code and Password.
Spectra does not have global administrators. Every user acts within the scope of a specific Project.
| Role | Capabilities |
|---|---|
| Captain (Owner) | Absolute control over the project. Can add/modify/remove targets, launch/cancel scans, export data, manage team roles, edit project settings, and delete the project. |
| Admin | Technical powerhouse. Can add/modify/remove targets, run/cancel scans and export data. Cannot manage team members, access project settings or delete the project. |
| Member (Viewer) | Read-only access. Can view the live dashboard, explore the inventory, and read findings. Perfect for clients or junior analysts. |
Spectra's backend orchestrates the industry's best open-source security tools in a strict, self-healing pipeline:
subfinder: Passive perimeter mapping.dnsx: Target validation and IP resolution mapping.naabu: Fast port scanning (tracks dead/stale ports).httpx: HTTP service fingerprinting and smart cross-linking.nuclei: Template-based vulnerability scanning (with regression detection).
Results are normalized, hashed, and flushed into PostgreSQL, where the engine's diffing logic updates the live state of the project.
Architected and developed by Mohammad Al Musa, Tech Founder and Offensive Security Researcher.
Connect with me:
- LinkedIn: Mohammad Al Musa
- GitHub: @MoMhaidat05
"Don't just scan. Understand your spectrum."