HackerNews中文版

嗨 HN，过去一年里，我一直在构建 Spectator——一种专为渗透测试人员、红队成员和安全研究人员设计的脚本语言。为什么又要开发一种新语言？大多数安全工作都是 Bash、Python 和各种工具的混合体。Spectator 将它们统一起来：一种语言，具有内置的安全模块、原生 GUI 框架和包管理器——所有这些都编译成一个单一的二进制文件。它的与众不同之处：高级语法——类似 Python，f-strings，闭包，goroutines (spawn)。侦察脚本只需 5 行代码。内置黑客模块——PortScan, SubdomainEnum, SQLiTest, PayloadGen, CORS/SSRF, HTTP fuzzing, crypto, encoding。无需 pip 安装。原生 GUI 框架 (#Import Spec.GUI)——无需 Electron 即可创建桌面工具。输入框、表格、标签页、输出。Windows (WebView2), Linux (WebKitGTK), macOS (WKWebView)。 Space 包管理器——像 coffee (侦察) 和 ghost (OSINT) 这样的库都经过 SHA-256 验证。阻止供应链攻击。任务引擎——具有 HTML 报告生成的渗透测试工作流程。跨平台编译——spectator build script.str to app.exe for windows = 独立二进制文件。示例——GUI 端口扫描器（完整工具）： spectator #Import Spec.GUI open.window({"title": "Port Scanner", "bg": "#070b14", "accent": "#00d4aa"}) GUI.input("target", "Enter target...") GUI.button("Scan", "run_scan") GUI.progress("bar") GUI.output("out", {"height": 380}) GUI.on("run_scan", func() { target = GUI.get("target") GUI.print("out", "Scanning " + target) ports = [21,22,23,80,443,3306,8080] each p : ports { if hasPort(target, p) { GUI.print("out", "OPEN " + str(p)) } } }) end() 当前状态： v2.0.0 — 在 Windows、Linux、macOS 上稳定运行 CLI/TUI GUI 在 Windows 上功能齐全；Linux/macOS GUI 可用（WebKit 与 WebView2 的差异）约 177 个内置函数，用 Go 编写 Space 注册表已上线，任何人都可以发布我希望得到的反馈：语法是否直观？（字符串连接 --> 方式不寻常，但我喜欢） GUI 方法——原生桌面 vs 基于 Web？包管理器安全性——SHA-256 验证足够了吗？哪些模块会让你真正使用它？我知道安全工具领域竞争激烈，但为这个领域构建的语言而不是改编的语言还有空间。 GitHub: https://github.com/CzaxStudio/Spectator 文档: https://github.com/CzaxStudio/SpectatorDocs/ 感谢您的任何想法、批评或疯狂的想法。

查看原文

Hey HN,I've been building Spectator for the past year — a purpose-built scripting language for pentesters, red teamers, and security researchers.Why another language? Most security work is a mix of Bash, Python, and random tools glued together. Spectator unifies that: one language with built-in security modules, a native GUI framework, and a package manager — all compiled into a single binary.What makes it different:High-level syntax — Python-like, f-strings, closures, goroutines (spawn). Recon scripts in 5 lines.Built-in hacking modules — PortScan, SubdomainEnum, SQLiTest, PayloadGen, CORS/SSRF, HTTP fuzzing, crypto, encoding. No pip installs.Native GUI framework (#Import Spec.GUI) — Desktop tools without Electron. Inputs, tables, tabs, output. Windows (WebView2), Linux (WebKitGTK), macOS (WKWebView).Space package manager — Libraries like coffee (recon) and ghost (OSINT) are SHA-256 verified. Blocks supply-chain attacks.Mission engine — Pentest workflow with HTML report generation.Cross-compilation — spectator build script.str to app.exe for windows = standalone binaries.Example — GUI port scanner (complete tool):spectator #Import Spec.GUI open.window({"title": "Port Scanner", "bg": "#070b14", "accent": "#00d4aa"}) GUI.input("target", "Enter target...") GUI.button("Scan", "run_scan") GUI.progress("bar") GUI.output("out", {"height": 380})GUI.on("run_scan", func() { target = GUI.get("target") GUI.print("out", "Scanning " + target) ports = [21,22,23,80,443,3306,8080] each p : ports { if hasPort(target, p) { GUI.print("out", "OPEN " + str(p)) } } }) end() Current state:v2.0.0 — stable CLI/TUI across Windows, Linux, macOSGUI fully functional on Windows; Linux/macOS GUI works (WebKit vs WebView2 differences)~177 built-in functions, written in GoSpace registry live, anyone can publishWhat I'd love feedback on:Does the syntax feel intuitive? (string concat --> is unusual but I like it)GUI approach — native desktop vs web-based?Package manager security — SHA-256 verification enough?What modules would make you actually use this?I know the security tooling space is crowded, but there's room for a language built for this domain rather than adapted.GitHub: <a href="https://github.com/CzaxStudio/Spectator" rel="nofollow">https://github.com/CzaxStudio/Spectator</a> Docs: <a href="https://github.com/CzaxStudio/SpectatorDocs/" rel="nofollow">https://github.com/CzaxStudio/SpectatorDocs/</a>Appreciate any thoughts, criticism, or wild ideas.

Show HN: Spectator – 面向网络安全与黑客技术的编程语言