Show HN: Spectator – A programming language for Cybersecurity and Hacking
I've been building Spectator for the past year — a purpose-built scripting language for pentesters, red teamers, and security researchers.
Why another language? Most security work is a mix of Bash, Python, and random tools glued together. Spectator unifies that: one language with built-in security modules, a native GUI framework, and a package manager — all compiled into a single binary.
What makes it different:
High-level syntax — Python-like, f-strings, closures, goroutines (spawn). Recon scripts in 5 lines.
Built-in hacking modules — PortScan, SubdomainEnum, SQLiTest, PayloadGen, CORS/SSRF, HTTP fuzzing, crypto, encoding. No pip installs.
Native GUI framework (#Import Spec.GUI) — Desktop tools without Electron. Inputs, tables, tabs, output. Windows (WebView2), Linux (WebKitGTK), macOS (WKWebView).
Space package manager — Libraries like coffee (recon) and ghost (OSINT) are SHA-256 verified. Blocks supply-chain attacks.
Mission engine — Pentest workflow with HTML report generation.
Cross-compilation — spectator build script.str to app.exe for windows = standalone binaries.
Example — GUI port scanner (complete tool):
spectator #Import Spec.GUI open.window({"title": "Port Scanner", "bg": "#070b14", "accent": "#00d4aa"}) GUI.input("target", "Enter target...") GUI.button("Scan", "run_scan") GUI.progress("bar") GUI.output("out", {"height": 380})
GUI.on("run_scan", func() { target = GUI.get("target") GUI.print("out", "Scanning " + target) ports = [21,22,23,80,443,3306,8080] each p : ports { if hasPort(target, p) { GUI.print("out", "OPEN " + str(p)) } } }) end() Current state:
v2.0.0 — stable CLI/TUI across Windows, Linux, macOS
GUI fully functional on Windows; Linux/macOS GUI works (WebKit vs WebView2 differences)
~177 built-in functions, written in Go
Space registry live, anyone can publish
What I'd love feedback on:
Does the syntax feel intuitive? (string concat --> is unusual but I like it)
GUI approach — native desktop vs web-based?
Package manager security — SHA-256 verification enough?
What modules would make you actually use this?
I know the security tooling space is crowded, but there's room for a language built for this domain rather than adapted.
GitHub: https://github.com/CzaxStudio/Spectator Docs: https://github.com/CzaxStudio/SpectatorDocs/
Appreciate any thoughts, criticism, or wild ideas.