Skip to content

About

SpectraScann is a high-performance, modular Python-based network security tool designed for rapid port scanning, service enumeration, OS fingerprinting, and vulnerability assessment. Built with a focus on speed and extensibility, it supports multiple scan types (TCP, SYN, UDP), rate limiting, and detailed reporting.

Topics

cyber-securitylinuxnetwork-monitoringnetworkingpingport-scannerpythonsecurityservice-discoverysocketwindows

Resources

Readme
License

Code of conduct

Code of conduct

Contributing

Contributing

Security policy

Security policy
Activity

Stars

1 star

Watchers

0 watching

Forks

0 forks
Report repository
BranchesTags

Repository files navigation

🕵️‍♂️ SpectraScan

Advanced Network Reconnaissance, Port Scanning & OSINT Intelligence Framework

License Python Platform Status Black PRs Welcome

One modular CLI for network scanning, service enumeration, OSINT, vulnerability correlation, protocol intelligence, and passive dark-web reconnaissance.

Why SpectraScan · Features · Installation · Quick Start · Architecture · Roadmap

📦 Current release: 2.2.0

The current main branch contains the 2.2.0 feature set. This release builds on 2.1.0 with an additive async TCP scanner, bounded optional NVD CVE correlation, stricter CLI validation, bounded CIDR scans, safer credential-checking defaults, and more reliable report exports. See CHANGELOG.md for detailed release notes and SECURITY.md for supported versions and vulnerability reporting.

Release integrity: this documents the main code state; it does not claim a GitHub Release or PyPI package has been published.

📑 Table of Contents

🎯 Why SpectraScan?

Reconnaissance usually means switching between several tools, formats, terminals, and output styles. SpectraScan brings a broad collection of reconnaissance and enumeration workflows into one modular Python CLI.

Need Typical Tooling SpectraScan
Fast port scanning Nmap, Masscan core.scanner
Web fingerprinting WhatWeb, Nikto core.http_enum
Domain / IP intelligence WHOIS, dig osint.domain, osint.ip
Email intelligence HIBP, emailrep osint.email
Phone intelligence NumVerify osint.phone
SMB / RDP / LDAP enumeration enum4linux, CrackMapExec protocols.*
Link / subdomain discovery LinkFinder, Sublist3r osint.link_sniffer
CVE correlation Vulners, SearchSploit attack.vuln_scanner
Web directory enumeration Dirb, Gobuster attack.web_enumerator
Onion reconnaissance Manual Tor tooling darkweb.*
Bitcoin address profiling Blockchain APIs darkweb.btc_first_seen

Everything is presented through a Rich-powered CLI, with persistent scan history and JSON / CSV / HTML reporting. The project aims to keep protocol logic transparent and modular rather than hiding everything behind a single black-box dependency.

✨ Features

🛠️ Core Scanning Engine

High-speed network enumeration and service identification.

  • 🔍 Multi-protocol scanning
    • TCP connect
    • SYN / raw-socket scanning
    • UDP probing
    • Configurable timing profiles from T0 to T5
  • 🛡️ Firewall / IDS heuristics
    • RST and ICMP behavior analysis
    • Open / filtered / dropped classification
  • 🕵️ OS fingerprinting
    • TTL
    • TCP window size
    • DF-bit heuristics
    • Linux / Windows / BSD / network-device families
  • 🔐 SSL/TLS analysis
    • Certificate chain inspection
    • Cipher-suite enumeration
    • Protocol-version checks
    • Expiration warnings
  • 🌐 HTTP enumeration
    • Server
    • X-Powered-By
    • Allowed methods
    • Common-path discovery such as /admin, /login, and /.git
  • 📡 Network discovery
    • ICMP sweeps
    • ARP table walking
    • Traceroute-related helpers
  • ⚡ Threaded execution
    • Dynamic ThreadPoolExecutor sizing
    • Default upper bound of min(512, ports × targets)

🕵️ OSINT Intelligence Suite

Designed for gathering publicly available intelligence around domains, IP addresses, emails, phones, images, and links.

  • 🌐 Domain intelligence
    • WHOIS
    • A / AAAA / MX / NS / TXT / SOA / CNAME
    • Host reachability
  • 📍 IP intelligence
    • GeoIP
    • ASN
    • WHOIS
    • Optional Shodan enrichment
  • 📞 Phone intelligence
    • Carrier
    • Line type
    • Country
    • Geo lookup via NumVerify
  • 📧 Email intelligence
    • Reputation
    • Breach flags
    • Disposable-mail detection
    • Free-provider classification
  • 🖼️ Metadata extraction
    • EXIF / IPTC / XMP
    • JPEG / PNG / TIFF
    • exiv2 / exiftool fallback
  • 🔗 Link sniffing
    • HackerTarget API
    • Optional depth-2 on-page spider
  • 👮 Public-record search helper
    • Generates U.S. state-specific public-record search links
    • Does not query private or restricted databases

⚔️ Attack & Vulnerability Modules

Active testing requires explicit authorization. Only use these modules against systems you own or are explicitly permitted to test.

  • 💥 Credential testing
    • Dictionary-based SSH / FTP testing
    • Rate limiting
    • Jitter
    • Lockout-aware back-off
  • 🛡️ CVE scanner
    • Matches detected service banners against the NVD CVE 2.0 API
    • Supports local CVE caching
  • 📂 Web enumeration
    • HTTP / HTTPS directory and file discovery
    • Custom wordlists
    • Recursive scanning
    • Status-code filtering

🔬 Protocol Enumeration

Protocol-aware service inspection implemented primarily in Python.

Protocol Module Detection / Heuristics
SMB/CIFS smb_enum SMBv1/v2/v3 negotiation, shares, anonymous auth, OS fingerprinting, EternalBlue heuristic
SNMP snmp_enum BER encoding, community checks, system information, snmpwalk fallback
LDAP/LDAPS ldap_enum Anonymous bind, Root DSE, user/group enumeration
RDP rdp_enum X.224 / TPKT handshake, NLA, BlueKeep heuristic
SMTP smtp_enum Banner, VRFY/EXPN, relay test, STARTTLS
DNS dns_zone AXFR attempts against discovered NS records
NFS nfs_enum RPC / MOUNTD inspection, export checks
VNC vnc_enum RFB handshake, authentication types, no-auth detection
Redis redis_enum RESP inspection, INFO / DBSIZE / RANDOMKEY sampling
MongoDB mongodb_enum OP_MSG, BSON parsing, unauthenticated-access detection
SIP sip_enum UDP OPTIONS probing
RTSP rtsp_enum DESCRIBE requests, SDP capture, auth checks
Databases database_enum MySQL / PostgreSQL / MSSQL version detection

🌑 Dark Web Recon

SpectraScan includes a dedicated passive reconnaissance module for .onion services and publicly observable dark-web references.

No marketplace interaction. No payload execution. No automatic Tor launch.

🔎 Automatic Target Detection

The module identifies likely target types before analysis:

Type Detection Confidence
.onion v3 56-character Base32 pattern 100%
.onion v2 16-character Base32 pattern 100%
BTC address Base58Check / Bech32 / Bech32m 100%
ETH address EIP-55 pattern 95%
XMR / LTC Format heuristic 75%
Email RFC-5322-lite pattern 95%
IPv4 Python ipaddress 95%
Hash MD5 / SHA-1 / SHA-256 90–95%
PGP block ASCII-armored header 100%
Phone International format heuristic 70%
Domain RFC-1035-lite pattern 80%
Username Heuristic 40%

🧅 Onion Recon

For supported .onion targets:

  • HTTPS / HTTP banner collection through Tor SOCKS5
  • TLS version and cipher suite
  • Certificate subject / issuer / SAN
  • SHA-1 and SHA-256 certificate fingerprints
  • Certificate expiration
  • HTTP status and selected headers
  • HTML <title> extraction
  • Custom port and scheme
  • Hard 30-second network timeout

💰 Bitcoin Address Profiling

The module can query public blockchain APIs using a fallback chain:

  1. Blockchair
  2. Blockstream
  3. Blockchain.info

Reported information can include:

  • First-seen timestamp
  • First-seen block
  • Address age
  • Total received
  • Total sent
  • Current balance
  • Transaction count
  • Heuristic risk indicators

🔍 Other Utilities

  • 🔗 Extract .onion links from arbitrary text
  • 🌐 Search Ahmia through clearnet
  • 🔌 Check local Tor SOCKS5 connectivity
  • 🧭 Verify the Tor exit connection through Tor Project's check endpoint

⚖️ Guardrails

  • ✅ Network timeouts capped at 30 seconds
  • ✅ Clearnet-first workflows where possible
  • ✅ No binary downloads
  • ✅ No marketplace interaction
  • ✅ No payload execution
  • ✅ No automatic Tor startup
  • ✅ No login / authentication attempts against dark-web services

📁 Report Management

SpectraScan keeps scan output organized and reusable.

  • 📊 Export reports as JSON, CSV, or HTML
  • 💾 Store reports under: ~/.local/share/SpectraScan/
  • 📂 List, inspect, delete, and re-export historical scans
  • ⏱️ Attach UTC timestamps and UUIDs to scan runs

🏗️ Architecture

                         ┌───────────────────────────────┐
                         │      SpectraScan.py           │
                         │   CLI + Rich + Dispatcher     │
                         └───────────────┬───────────────┘
                                         │
              ┌──────────────────────────┼──────────────────────────┐
              │                          │                          │
              ▼                          ▼                          ▼
      ┌──────────────┐          ┌────────────────┐         ┌────────────────┐
      │ Core Engine  │          │  OSINT Suite   │         │ Attack Modules │
      └──────┬───────┘          └───────┬────────┘         └───────┬────────┘
             │                          │                          │
             └──────────────────────────┼──────────────────────────┘
                                        │
                                        ▼
                              ┌────────────────────┐
                              │ Protocol Modules   │
                              │ SMB / SNMP / LDAP   │
                              │ RDP / SMTP / DNS    │
                              │ NFS / VNC / DB ... │
                              └─────────┬──────────┘
                                        │
                         ┌──────────────┴──────────────┐
                         ▼                             ▼
                ┌─────────────────┐          ┌──────────────────┐
                │ Third-party APIs│          │ Dark Web Recon   │
                │ WHOIS / Shodan  │          │ Tor / Ahmia      │
                │ NVD / emailrep  │          └────────┬─────────┘
                └─────────────────┘                   │
                                                     ▼
                                             ┌────────────────┐
                                             │ Bitcoin APIs   │
                                             └────────────────┘

Design Principles

  1. Modular — each capability lives in a focused module.
  2. Pure Python first — protocol functionality avoids unnecessary external binaries where practical.
  3. Fail-soft — external failures should degrade gracefully.
  4. Read-only by default — active capabilities are explicit opt-in features.
  5. Traceable output — scans produce timestamped, reusable reports.

📦 Installation

Prerequisites

Requirement Purpose Required?
Python 3.10+ Core runtime ✅
Root / Administrator Raw sockets for SYN scans Only for SYN mode
Tor on 127.0.0.1:9050 .onion operations Only for onion features
exiv2 or exiftool Image metadata Optional
shodan-cli Shodan enrichment Optional
nmap Banner/version correlation Optional

1. Clone

git clone https://github.com/ItsWanheda/SpectraScan.git
cd SpectraScan

2. Create a virtual environment

python -m venv venv

Linux / macOS

source venv/bin/activate

Windows PowerShell

.\venv\Scripts\Activate.ps1

3. Install dependencies

pip install -r requirements.txt

4. Optional dependencies

pip install pysocks cryptography

5. Optional system tools

Debian / Ubuntu

sudo apt install exiftool tor nmap

macOS

brew install exiftool tor nmap

Windows

choco install exiftool tor nmap

🧅 Tor Setup

sudo apt install tor
sudo systemctl start tor
sudo systemctl status tor

For Tor Browser, use port 9150 instead of 9050:

export TOR_PORT=9150

⚡ Quick Start

Interactive CLI

pip install rich
python SpectraScan.py

One-shot scan

python SpectraScan.py -t scanme.nmap.org -p 1-1000 -T T3

Only scan hosts you own or have explicit permission to test.

🚀 Usage

One-shot OSINT and protocol modules

The one-shot CLI now accepts the supported README options and rejects flags that do not apply to the selected mode:

python SpectraScan.py -e target@example.com -o email.json
python SpectraScan.py --phone "+14155552671" -o phone.json
python SpectraScan.py --image ./photo.jpg -o image.json
python SpectraScan.py -d example.com --links --dns-zone -o domain.json
python SpectraScan.py -i 8.8.8.8 --shodan -o ip.json
python SpectraScan.py -t 10.0.0.5 --smb -o smb.json
python SpectraScan.py -t 10.0.0.5 --ldap -o ldap.json

Credential-validation mode requires an explicit target, service, port, bounded password limit and --yes acknowledgement. SSH checks require trusted host keys or an optional SHA256 fingerprint pin. FTPS is the default for FTP service checks; plaintext FTP is available only with explicit --allow-insecure-ftp. Configure NUMVERIFY_KEY and SHODAN_API_KEY (or SHODAN_KEY) through environment variables. Never commit API keys to the repository.

🔍 Basic Reconnaissance

# Standard TCP scan
python SpectraScan.py -t 192.168.1.1

# OS detection + all ports
python SpectraScan.py -t example.com --os-detect -p- -T T4

# UDP probes
python SpectraScan.py -t 10.0.0.5 --scan-type udp -p 53,161,514

🕵️ OSINT

# Email reputation
python SpectraScan.py -e target@example.com

# Domain intelligence + link sniffing
python SpectraScan.py -d targetdomain.com --links

# IP intelligence + Shodan
python SpectraScan.py --ip 8.8.8.8 --shodan

# Phone lookup
python SpectraScan.py --phone "+14155552671"

# Image metadata
python SpectraScan.py --image ./photo.jpg

⚔️ Advanced Modules

# CVE correlation
python SpectraScan.py -t target.com --vuln-scan

# SSH / FTP credential testing
python SpectraScan.py -t 10.0.0.5 --brute-force --service ssh --port 22 --wordlist ./passwords.txt --max-attempts 100 --yes

# FTPS is used by default; plaintext FTP requires explicit opt-in:
python SpectraScan.py -t 10.0.0.5 --brute-force --service ftp --port 21 --wordlist ./passwords.txt --yes
# For a legacy plaintext FTP service only, add --allow-insecure-ftp

# Web directory enumeration
python SpectraScan.py -t example.com --web-enum --wordlist ./dirb_list.txt

# SMB enumeration
python SpectraScan.py -t 10.0.0.5 --smb

# DNS zone-transfer check
python SpectraScan.py -d target.com --dns-zone

# LDAP anonymous-bind check
python SpectraScan.py -t 10.0.0.5 --ldap

🌑 Dark Web Recon

Dark-web functionality is exposed through the interactive menu:

Main Menu
└── 3. Protocol Modules
    └── 14. Dark Web Recon

Available operations:

Option Action Tor
1 Auto-detect & analyze target Depends
2 HTTPS .onion banner grab ✅
3 BTC first-seen + heuristic analysis ❌
4 Extract .onion links from text ❌
5 Ahmia search ❌
6 Tor connectivity check ✅
7 Full recon Depends
8 Back —

Evidence-based CVE correlation

The optional NVD correlation mode is separate from local port/service heuristics so ordinary scans do not unexpectedly make external API calls:

python SpectraScan.py -t 127.0.0.1 -p 22,80,443 --cve-correlate -o findings.json
python SpectraScan.py -t 127.0.0.1 -p 22,80,443 --cve-correlate --max-cve-lookups 5 -o findings.json

Only distinct detected products with a usable version are queried; at most 3 lookups run by default (maximum 20). Configure NVD_API_KEY through the environment. Static CPE/version matches are classified as potential unless there is stronger evidence; they are not proof of exploitability.

📊 Reports

# View saved reports
python SpectraScan.py -r

# HTML report
python SpectraScan.py -t target.com -o report.html -f html

# JSON report
python SpectraScan.py -t target.com -o report.json -f json

🧭 CLI Menu

╭──────────────────────────────────────────────╮
│                 SpectraScan                  │
├──────────────────────────────────────────────┤
│  1. Port Scanner                             │
│  2. Advanced Modules                         │
│  3. Protocol Modules                         │
│  4. Exit                                     │
╰──────────────────────────────────────────────╯

Menu Overview

Menu Includes
1. Port Scanner TCP / SYN / UDP · timing profiles · port ranges / lists / top-N
2. Advanced Modules Domain · IP · Email · Phone · Image EXIF · Links · Reports
3. Protocol Modules SMB · SNMP · LDAP · RDP · SMTP · DNS · NFS · VNC · Redis · MongoDB · SIP · RTSP · Databases · Dark Web
4. Exit Clean shutdown and report flushing

⚙️ Configuration

Timing Profiles

The profiles follow an Nmap-style naming convention:

Profile Name Description
T0 Paranoid Extremely slow
T1 Sneaky Low-noise scanning
T2 Polite Conservative bandwidth usage
T3 Normal Default balanced profile
T4 Aggressive Faster, noisier
T5 Insane Maximum speed and noise

Output Verbosity

-v     INFO     Open ports and normal status
-vv    DEBUG    Detailed probes and raw banners
-q     QUIET    Final report only

📊 Output Examples

Port Scan

PORT    STATE    SERVICE    VERSION
22/tcp  open     ssh        OpenSSH 8.9p1
80/tcp  open     http       nginx 1.24.0
443/tcp open     https      nginx / TLS 1.3

Saved Reports

~/.local/share/SpectraScan/
├── SS-portscan-2026-06-27-11-13-44.json
├── SS-darkweb-btc-2026-06-27-11-15-22.json
├── SS-osint-domain-2026-06-27-11-20-01.html
└── SS-protocol-smb-2026-06-27-11-25-09.csv

🧩 Project Structure

SpectraScan/
├── SpectraScan.py
├── modules/
│   ├── __init__.py
│   ├── brute_forcer.py
│   ├── vuln_scanner.py
│   ├── web_enumerator.py
│   ├── phone_scanner.py
│   ├── smb_enum.py
│   ├── snmp_enum.py
│   ├── ldap_enum.py
│   ├── rdp_enum.py
│   ├── smtp_enum.py
│   ├── dns_zone.py
│   ├── nfs_enum.py
│   ├── vnc_enum.py
│   ├── redis_enum.py
│   ├── mongodb_enum.py
│   ├── sip_enum.py
│   ├── rtsp_enum.py
│   ├── database_enum.py
│   ├── network_services.py
│   └── darkweb.py
├── CHANGELOG.md
├── LICENSE
├── README.md
├── requirements.txt
└── .gitignore

⚡ Performance & Threading

Component Strategy Default
Port scanner ThreadPoolExecutor min(512, ports × targets)
Protocol enumeration One thread per protocol len(protocols)
Brute forcer Thread pool + semaphore 16
Web fuzzer ThreadPoolExecutor 32
DNS zone Serial 1
BTC lookup Serial fallback chain 1
Dark-web banner Serial / Tor-bound 1

Network Fairness

  • Modules can apply jitter between bursts.
  • Credential testing uses exponential back-off after repeated failures.
  • --throttle N provides a global millisecond delay override.

🌍 Environment Variables

Variable Default Purpose
TOR_HOST 127.0.0.1 Tor SOCKS5 host
TOR_PORT 9050 Tor SOCKS5 port
SPECTRASCAN_HOME ~/.local/share/SpectraScan Report directory
NUMVERIFY_KEY — NumVerify API key
SHODAN_API_KEY / SHODAN_KEY — Shodan API key
NVD_API_KEY — NVD API key
EMAILREP_KEY — emailrep.io key
HTTP_PROXY — Global outbound HTTP proxy

🆚 Comparison

SpectraScan is intended to complement established security tooling rather than replace every specialized tool.

Capability SpectraScan Nmap Recon-ng SpiderFoot
Port scanning ✅ ✅ ⚠️ ❌
OS fingerprinting ✅ ✅ ⚠️ ⚠️
OSINT suite ✅ ❌ ✅ ✅
SMB / LDAP / SNMP ✅ ⚠️ ⚠️ ❌
Credential testing ✅ ❌ ⚠️ ❌
CVE correlation ✅ ⚠️ ⚠️ ✅
Dark-web recon ✅ ❌ ⚠️ ✅
BTC profiling ✅ ❌ ❌ ⚠️
HTML reports ✅ ⚠️ ✅ ✅
Interactive CLI ✅ ❌ ✅ ❌

🩺 Troubleshooting

Problem Likely Cause Fix
Permission denied on SYN scan Missing privileges Run with appropriate administrator/root privileges
.onion connection hangs Tor unavailable / wrong port Check TOR_HOST and TOR_PORT
pysocks missing Optional dependency absent pip install pysocks
TLS parsing is limited cryptography missing pip install cryptography
BTC APIs fail Network / rate limit Retry later or review proxy settings
Rich UI looks broken Terminal capability issue Use a 256-color capable terminal
ModuleNotFoundError: requests Dependency missing Install project requirements
Windows SYN scan fails Raw-packet support unavailable Install a compatible Npcap setup
Reports use the wrong folder Custom path not configured Set SPECTRASCAN_HOME

Async Scanner Engine

SpectraScan now includes an additive AsyncPortScanner engine in modules/async_scanner.py. It uses asyncio for concurrent TCP probing and aiohttp for optional HTTP enrichment without replacing the legacy PortScanner API.

CLI usage:

python SpectraScan.py -t scanme.nmap.org --async-scan
python SpectraScan.py -t scanme.nmap.org --async-scan --async-concurrency 200 --async-timeout 0.75

CLI hardening notes

The one-shot CLI rejects unsupported arguments instead of silently ignoring them. Examples:

python SpectraScan.py -t scanme.nmap.org -p 1-1000 -T T3 --scan-type tcp
python SpectraScan.py -t scanme.nmap.org -p 80,443 -o report.json
python SpectraScan.py -t 192.168.1.1 --scan-type udp -p 53,161 -o udp-report.json
python SpectraScan.py -t 192.168.1.0/24 -p common --exclude 192.168.1.10 --yes -o network.json
python SpectraScan.py -d example.com -o domain.json
python SpectraScan.py -i 8.8.8.8 -o ip-intelligence.json

CIDR scans have a hard address limit set by --max-targets (default 1024), and scans over 64 addresses require explicit --yes confirmation. Exclusions can be repeated. UDP silence is reported as open|filtered, not confirmed open. Historical reports use SPECTRASCAN_HOME (default ~/.local/share/SpectraScan) and exports use atomic writes. SSH credential checks require known-host trust or a pinned SHA256 fingerprint and never store plaintext passwords.

🛣️ Roadmap

The items below are planned work, not claims of already-shipped functionality. Priorities favor correctness and consistent data models before expanding the module count.

Highest priority

  • Network scope and scan profiles — named `Quick`, `Full TCP`, `Web Assessment`, and `Local Network` profiles; explicit allowlists/exclusions, host caps, timeouts, concurrency and rate limits; show effective configuration and reject out-of-scope targets before scanning.
  • Evidence-based vulnerability findings — normalized product/CPE/version evidence; `Confirmed`, `Potential`, and `Informational` classifications; confidence rationale, affected version ranges, CVSS data, references, and remediation guidance. Banner matches alone are not proof of exploitability.
  • Deeper web/TLS audit — certificate validity/expiry and chain checks, protocol/cipher support, cookie flags, redirect behavior, and security-header analysis. Keep checks read-only by default and separate observations from confirmed vulnerabilities.
  • Historical scan comparison — compare authorized scan snapshots for new/resolved ports, changed service versions, and changed findings.
  • Unified reporting — JSON, CSV, HTML, Markdown, and SARIF generated from one normalized finding model.
  • Plugin/protocol interface — standard inputs, deadlines, cancellation, output schema, permissions, and error handling behind a module registry rather than continuing to grow the main entry point.
  • IPv6 support — integrate IPv6 targets and compatible discovery/probing into the same scan interface; improve UDP/service detection through shared result semantics.

Later candidates

  • Passive subdomain discovery and certificate-transparency monitoring
  • DNS security checks
  • Docker image and reproducible container workflow
  • Kerberos enumeration and AS-REP roasting detection
  • Subdomain permutation and email-to-username correlation
  • WebSocket / GraphQL introspection
  • Multi-user collaboration and scan sharing
  • Machine-learning anomaly detection, if validated against a useful baseline
  • CI coverage for supported operating systems and Python versions

🛡️ Security Notes

  • Scope first: scan only assets you own or are explicitly authorized to assess. Review targets, exclusions, and scan intensity before running active checks.
  • Credential testing is opt-in and uses bounded attempts, timeouts, throttling/back-off, and trusted SSH host keys or an explicitly pinned SHA-256 fingerprint. Never put passwords, API keys, or other secrets in source control or reports.
  • HTTPS certificate verification is enabled for async HTTP enrichment; do not disable TLS validation to work around target errors.
  • CIDR scans are bounded by `--max-targets` (default 1024); scans larger than 64 addresses require explicit `--yes` confirmation. UDP silence is reported as `open|filtered` rather than confirmed open.
  • NVD CVE correlation is optional and bounded. A CPE/version correlation is evidence to investigate, not proof that a target is exploitable. Version parsing has limits for vendor-specific and prerelease formats.
  • Reports may contain sensitive asset details, banners, addresses, and findings. Restrict filesystem access and sanitize before sharing.
  • External APIs and optional dependencies can fail or rate-limit; interpret incomplete results accordingly.
  • Dark Web Recon is intended for passive research; do not use it to access illegal content, interact with marketplaces, or conduct unauthorized activity.
  • Some features require elevated privileges or platform-specific support. Cross-platform support targets Linux, Windows, and macOS.
  • See SECURITY.md for supported versions and private vulnerability disclosure.

🤝 Contributing

Contributions, bug reports, documentation improvements, protocol modules, tests, and new legal OSINT data sources are welcome.

# Fork the repository

# Create a feature branch
git checkout -b feature/AmazingFeature

# Run tests
pytest tests/

# Format
black .

# Commit
git commit -m "feat: add AmazingFeature"

# Push
git push origin feature/AmazingFeature

💡 Contribution Ideas

  • New protocol enumeration modules
  • New free and legal OSINT sources
  • Markdown / SARIF report exporters
  • Bug fixes
  • Test fixtures
  • CI improvements
  • Documentation improvements

Please read CONTRIBUTING.md before opening a large PR. Report security vulnerabilities privately as described in SECURITY.md.

🙏 Acknowledgements

  • Nmap — timing-profile inspiration
  • Impacket — protocol references
  • Rich — terminal UI
  • Ahmia — clearnet dark-web search
  • Blockchair / Blockstream — public Bitcoin APIs
  • The Python security community ❤️

⚠️ Disclaimer

For educational and authorized security testing only.

SpectraScan is intended for security professionals, researchers, and learners testing systems they own or have explicit permission to assess.

Unauthorized scanning or enumeration may violate laws, contracts, network policies, or terms of service. The developers are not responsible for misuse.

By using SpectraScan, you agree to:

  1. Scan only systems you own or are explicitly authorized to test.
  2. Follow applicable local, national, and international laws.
  3. Avoid illegal content and unauthorized marketplace interaction.
  4. Respect service limits and applicable API policies.

📜 License

This project is licensed under the MIT License.

See LICENSE for the complete license text.

🕵️‍♂️ SpectraScan

Recon. Enumerate. Understand.

Made with ❤️ by ItsWanheda & An0nym0us

⬆ Back to top

About

SpectraScann is a high-performance, modular Python-based network security tool designed for rapid port scanning, service enumeration, OS fingerprinting, and vulnerability assessment. Built with a focus on speed and extensibility, it supports multiple scan types (TCP, SYN, UDP), rate limiting, and detailed reporting.

Topics

cyber-securitylinuxnetwork-monitoringnetworkingpingport-scannerpythonsecurityservice-discoverysocketwindows

Resources

Readme
License

Code of conduct

Code of conduct

Contributing

Contributing

Security policy

Security policy
Activity

Stars

1 star

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Used by

Contributors

Languages