ABSpider is a cutting-edge, browser-based reconnaissance dashboard crafted for security professionals, penetration testers, and bug bounty hunters. It offers a sleek UI, blazing-fast performance, and a powerful blend of passive-first and optional active modules, all powered by Vite + React.

Dive deep into web targets, gather actionable intelligence, and identify vulnerabilities with unparalleled ease.

Experience ABSpider Recon Dashboard in action right now!

🌐 Launch ABSpider Recon Dashboard

• 🕵️‍♂️ Intelligence-First Approach: Prioritizes passive data collection (WHOIS, CT Logs, GeoIP) to minimize footprint, with powerful active scans (SQLi, XSS, LFI, Port Scanning) available when authorized.
• 📊 Professional Reporting: Generate comprehensive, exportable PDF reports summarizing all findings, complete with severity, evidence, and remediation advice.
• 🔔 Real-time Notifications: Stay informed with Discord webhook notifications for instant scan updates and critical alerts.
• ⚙️ Seamless Configuration: Manage all scan parameters, proxies, and API keys directly through a secure, centralized Dashboard Settings UI.
• 🛡️ Intelligent Bypass: Overcome common web protections with built-in CORS & Cloudflare Bypass mechanisms.
• ⚡ Blazing Fast: Built with Vite + React for a lightning-fast development and user experience.
• ⏰ Client-Side Scheduling: Automate your reconnaissance tasks with flexible daily, weekly, or monthly scheduling (requires the browser tab to be open).

ABSpider employs a modular approach, offering both stealthy passive checks and comprehensive active vulnerability scans.

ABSpider leverages Supabase for robust and passwordless user authentication. Users gain access via a Magic Link sent to their email, eliminating the need to manage passwords and enhancing security. Access to the dashboard is strictly enforced, ensuring only authorized users can initiate scans and view sensitive data.

Our reports are designed for professional security analysis and include:

• Executive Summary and overall security grade.
• Module-by-Module Findings with raw evidence.
• Vulnerability severity & confidence scores.
• Reproducible steps & Proof-of-Concept (PoC) snippets.
• Actionable remediation recommendations for discovered flaws.

• Discord Webhooks: Real-time scan completion notifications and alerts.
• Local Storage: Persists scan history and settings locally within the browser for convenience.
• Export Options: Provides findings in PDF / JSON formats for triage and submission.

⚠️ CRITICAL WARNING: Client-Side Accessible API Key Storage API keys are stored in your Supabase database, but are still accessible client-side. This means any Cross-Site Scripting (XSS) vulnerability or physical access to your browser could expose these keys. DO NOT store sensitive, paid, or production API keys here. This feature is intended for testing with non-critical keys only. For production use, a secure backend for API key management is strongly recommended.

To start your development server, follow these simple steps:

# 1. Clone the repository
git clone https://github.com/zanesense/abspider-recon.git
cd abspider-recon

# 2. Install dependencies using npm or yarn
npm install
# or
yarn install

# 3. Start the development server
npm run dev
# or
yarn dev

Open your browser at http://localhost:5000. ⚙️ Note: All scan configurations (targets, proxies, webhooks) are managed exclusively through the Dashboard Settings UI.

ABSpider is strictly for authorized security testing only.

Unauthorized scanning of domains you do not own or do not have explicit written permission to test may be illegal. Always comply with applicable local, state, and international laws. Use responsibly.

⚠️ IMPORTANT WARNING: Authorized Use Only

• You may ONLY scan websites and systems you own or have explicit written authorization to test.
• Unauthorized scanning may be illegal in your jurisdiction.
• You are solely responsible for ensuring you have proper authorization. Keep documentation of authorization for all scans performed.
• Comply with all applicable laws including Computer Fraud and Abuse Act (CFAA), GDPR, and local regulations.
• Unauthorized access to computer systems is a criminal offense in most jurisdictions. Penalties may include fines, imprisonment, and civil liability.
• This tool does not grant permission to scan any system.

⚠️ WARNING: Internal Targets Scanning internal IP addresses or localhost without explicit authorization is highly discouraged and may be illegal. The tool will warn you if an internal target is detected.

⚠️ WARNING: Public CORS Proxy Risks Using public CORS proxies can expose your target URLs, headers, and response content to the proxy operators. For sensitive operations, consider setting up a self-hosted, trusted CORS proxy or using a direct fetch only mode. The security and reliability of these third-party services are not guaranteed.

Special thanks to the open-source community for empowering modern reconnaissance workflows.

© 2025 zanesense · Built for security professionals. 🚀