_________                     __
 /   _____/_____   ____   _____/  |_____________
 \_____  \\____ \_/ __ \_/ ___\   __\_  __ \__  \
 /        \  |_> >  ___/\  \___|  |  |  | \// __ \_
/_______  /   __/ \___  >\___  >__|  |__|  (____  /
        \/|__|        \/     \/                 \/
  

Modified by : wanzxploit
Based on : Seeker by thewhiteh4t
Version : 2.0.3

spectra is a Proof of Concept and educational fork of Seeker by thewhiteh4t. It hosts a fake but realistic-looking website that asks for the target's Location Permission — exactly like many popular location-based websites do — and demonstrates just how much data a malicious website can silently collect about a visitor.

The concept is simple: just like phishing pages exist to steal credentials, a fake page can be hosted to steal your location by abusing the browser's Geolocation API with social engineering.

This tool is for educational purposes only. Spectra shows what data a malicious website can gather about you and your devices, and why you should not click on random links or allow critical permissions such as Location without thinking.

If the target allows the Location permission, Spectra can obtain:

Along with the location, Device Information is gathered without any permission:

• Unique ID via Canvas Fingerprinting
• Device Model — not always available
• Operating System
• Platform
• Number of CPU Cores — approximate
• Amount of RAM — approximate
• Screen Resolution
• GPU information
• Browser name & version
• Public IP Address
• Local IP Address
• Local Port

An automatic IP address reconnaissance is also performed once the above information is received.

• Most tools offer IP Geolocation, which is not accurate at all — it only gives the approximate location of the target's ISP, not the target.
• Spectra uses the HTML5 Geolocation API. Once the user grants permission, it grabs Longitude and Latitude using the GPS hardware in the device. It works best on smartphones.
• If the device has no GPS (e.g. a laptop) or GPS is broken, Spectra falls back to cached coordinates or IP geolocation.
• When location permission is accepted, accuracy is usually ~30 meters.
• Accuracy depends on factors you cannot always control:
  • Device — laptops or phones with broken GPS won't work well
  • Browser — some browsers block JavaScript
  • GPS calibration — uncalibrated GPS gives inaccurate results, this is very common

Each template is a self-contained fake page. The NearYou template (index 0) was fully modernized in this version: a clean glass-card UI with an animated CSS radar, no external CDN dependencies, and no jQuery — it works entirely offline.

This fork keeps the core engine of Seeker but brings a full rebrand, bug fixes, and modernization:

1. Rebranding — renamed seeker.py → spectra.py, updated metadata.json, and switched the whole theme to a red-dominant color scheme (banner, menu, notifications).
2. Full English output — removed leftover hardcoded Indonesian strings (e.g. the "Nama Jalan" row that was showing an inaccurate street name in the FULL ADDRESS report).
3. Clean terminal start — the terminal is cleared before the banner is printed so every run starts fresh.
4. Bug fix: PORT environment variable — PORT from the environment was treated as a string and crashed the socket connection. It is now converted to an integer.
5. Modernized NearYou template — self-contained single file (no CDN, no jQuery, no Worldmap/WarpSpeed), glass-card UI with an animated CSS radar.
6. Improved js/location.js — rewrote locate() to use getCurrentPosition with high accuracy first (timeout 12s, maximumAge 10s to allow cached fixes), with a low-accuracy fallback (timeout 10s) and retry logic. Also fixed a permissions.query() hop that could break the permission prompt in some browsers.
7. Consistent red theme everywhere — WhatsApp and Telegram message bodies, and the Discord webhook embed color, now use the red accent (#ff0000).
8. User-Agent updated — requests now identify as spectra-edu-demo/2.0.3.
9. Cleaner repository — removed unused assets (worldmap, warp speed animation, old CSS), and .gitignore now covers all generated files (index.html, location.js, PHP handlers, __pycache__, logs, db).

git clone https://github.com/wanzxploit/spectra.git
cd spectra/
chmod +x install.sh
./install.sh

If the repository is not live yet, clone your own copy and run install.sh.

# Debian / Ubuntu / Kali
sudo apt install -y python3 python3-pip python3-requests python3-packaging python3-psutil php

# Fedora
sudo dnf install -y python3 python3-pip python3-requests python3-packaging python3-psutil php

# Arch
sudo pacman -S python python-pip python-requests python-packaging python-psutil php

# Termux
apt install -y python php
pip install -U requests packaging psutil

docker build -t spectra .
docker run --rm -it -p 8080:8080 --name spectra spectra

python3 spectra.py -h

usage: spectra.py [-h] [-k KML] [-p PORT] [-u] [-v] [-t TEMPLATE]
                  [-d DEBUGHTTP] [-tg TELEGRAM] [-wh WEBHOOK]

options:
  -h, --help            show this help message and exit
  -k, --kml KML         KML filename
  -p, --port PORT       Web server port [ Default : 8080 ]
  -u, --update          Check for updates
  -v, --version         Prints version
  -t, --template TEMPLATE
                        Load template and loads parameters from env variables
  -d, --debugHTTP DEBUGHTTP
                        Disable HTTPS redirection for testing only
  -tg, --telegram TELEGRAM
                        Telegram bot API token [ Format -> token:chatId ]
  -wh, --webhook WEBHOOK
                        Webhook URL [ POST method & unauthenticated ]

Some options can be set via environment variables to avoid interactive mode:

# Step 1 : Start the server in one terminal
$ python3 spectra.py

# Step 2 : Start a tunnel in another terminal (ngrok / localhost.run / cloudflared)
$ ./ngrok http 8080

# Pre-select a template (0 = NearYou, 1 = Google Drive, ...)
$ python3 spectra.py -t 0

# Use a custom port
$ python3 spectra.py -p 1337

# Save results as a KML file for Google Earth
$ python3 spectra.py -k <filename>

# Run fully non-interactive with env variables
$ TEMPLATE=4 TELEGRAM=123456:ABC123 python3 spectra.py

Spectra serves a local HTTP server. To expose it to the internet use any tunnel:

# ngrok
./ngrok http 8080

# localhost.run
ssh -R 80:localhost:8080 [email protected]

• Kali Linux
• BlackArch Linux
• Ubuntu
• Fedora
• Kali Nethunter
• Termux
• Parrot OS
• OSX — Monterey v.12.0.1

This tool is a Proof of Concept and is for Educational Purposes Only. Spectra shows what data a malicious website can gather about you and your devices and why you should not click on random links and allow critical permissions such as Location. The author is not responsible for any misuse. Use it only against targets you own or have explicit permission to test.

• Original project: Seeker by thewhiteh4t
• Modified & maintained by: wanzxploit