DEV Community: Czax225

Title: Ferrum Studio: A Native IDE Built Exclusively for Nim (No Electron, ~12MB)

Czax225 — Sat, 02 May 2026 13:02:56 +0000

Every IDE that supports Nim does it as an afterthought. You install a language server plugin, bolt it onto VS Code or Sublime, and hope the latest update didn't break something.

I wanted something different.

So I built Ferrum Studio — a lightweight, native desktop IDE built from the ground up exclusively for Nim.

https://github.com/user-attachments/assets/621bf84f-a3b5-4f1c-a7d4-85e3b3e83247

No Electron. No bundled Chromium. No 300MB of RAM just to open a file.

Cold start: < 1 second

RAM usage (idle): ~35 MB

Binary size: ~12 MB (Windows)

Built with Go + Wails, not JavaScript + Node. The backend is compiled Go, the frontend is a native WebView, and the whole thing talks across an auto-generated bridge.

What Makes Ferrum Different?

Most editors treat Nim as a plugin. Ferrum treats Nim as the only thing that matters.

Every feature — snippets, error messages, templates, shortcuts — is designed around how Nim developers actually work.

Editor Features
Nim syntax highlighting (kept current with new keywords)

Smart indentation (whitespace-aware)

Dot-aware autocomplete

Snippets support

Inline error squiggles

Multi-tab editing

Quick open (Ctrl+P)

Nim Integration

F5 → Run (nim c -r)

F6 → Run with arguments

F7 → Build

F8 → Test

Format via nim pretty

Fast diagnostics via nim check

Interactive stdin support

Problems Panel
Clean error explanations with fix suggestions. Click any error to jump directly to the line. No more cryptic compiler output — Ferrum translates common errors into plain English.

Templates

One-click project templates for:

CLI App

Library

Web App

Async App

Metaprogramming examples

Terminal

Integrated terminal with ANSI colors, command history, and full interactive input support. Plus a "Nim Treasure Map" sidebar with curated code gems for common patterns.

Contributing

Contributions are welcome. The best places to help:

Add more error explanations in enhancements.js

Keep the syntax highlighter updated with new Nim keywords

Test on macOS/Linux

Build a light theme

Note on AI usage: The frontend UI was partially assisted by AI tools. The core backend and architecture were implemented manually.

Links

Repository: https://github.com/CzaxStudio/Ferrum-Studio
Website: https://czaxstudio.github.io/Ferrum-Studio/

Building Your First Cybersecurity Tool with Spectator: A New Language for Pentesters

Czax225 — Wed, 29 Apr 2026 05:39:14 +0000

The Problem We All Face
Let's be honest: when you're in the middle of a penetration test or red team engagement, the last thing you want to do is wrestle with boilerplate code. You need to scan, exploit, and report — fast.

Python is great, but:

You need to install dependencies

Virtual environments everywhere

"It works on my machine" syndrome

GUI tools? That means Electron (hello, 200MB hello world)

Bash is powerful but... let's not talk about parsing JSON.

Enter Spectator — a new programming language built from the ground up for cybersecurity work.

What Is Spectator?
Spectator is an interpreted scripting language (written in Go) that puts security operations front and center.

Example

# This is all it takes to recon a target
target = "scanme.nmap.org"
ips = resolve(target)
Trace("IPs: " --> join(ips, ", "))
do --> PortScan(target, 1, 1024)
do --> SSLInfo(target)

Your First Spectator Tool: A Smart Port Scanner

Step 1: Installation
Download the binary from releases:

Linux/macOS

chmod +x spectator
./spectator version

Windows

Spectator.exe version

Step 2: Create Your First Script

Save this as smart_scan.str

target = Capture("Target IP or domain: ")
Trace("\n[+] Scanning: " --> target)

## Define common ports and their services
ports = [21, 22, 23, 25, 80, 443, 445, 3306, 3389, 5432, 8080, 8443, 27017]
svcs = {
  "21": "FTP", "22": "SSH", "23": "Telnet", "25": "SMTP",
  "80": "HTTP", "443": "HTTPS", "445": "SMB", "3306": "MySQL",
  "3389": "RDP", "5432": "PostgreSQL", "8080": "HTTP-Alt", "8443": "HTTPS-Alt",
  "27017": "MongoDB"
}

open_ports = []
results = {}

Trace("\n[+] Scanning ports...\n")

each port : ports {
  if hasPort(target, port) {
    service = svcs[str(port)]
    Trace("   OPEN     " --> str(port) --> "  (" --> service --> ")")

    ## Store results
    open_ports = append(open_ports, port)
    results[str(port)] = service

    ## Grab banner if it's HTTP/HTTPS
    if port == 80 or port == 443 or port == 8080 or port == 8443 {
      proto = "https"
      if port == 80 or port == 8080 { proto = "http" }
      url = proto --> "://" --> target --> ":" --> str(port)
      Trace("      → Grabbing banner from " --> url)

      resp = http("GET", url, {"timeout": 3000, "follow": false})
      server = httpHeader(resp, "server")
      if server != "" {
        Trace("      → Server: " --> server)
        results[str(port) --> "_banner"] = server
      }
    }
  }
}

## Generate report
Trace("\n[+] Summary:")
Trace("    Open ports found: " --> str(len(open_ports)))
Trace("    Results saved to scan_results.json and scan_report.html")

## Save JSON output
json_data = jsonStr(results)
writeFile("scan_results.json", json_data)

## Create HTML report
html = "<html><head><title>Scan Report - " --> target --> "</title>"
html = html --> "<style>body{font-family:monospace;background:#0a0f1a;color:#e2e8f0;padding:20px}"
html = html --> "h1{color:#00d4aa} table{border-collapse:collapse;width:100%}"
html = html --> "th,td{border:1px solid #334155;padding:8px;text-align:left}"
html = html --> "th{background:#1e293b}</style></head><body>"
html = html --> "<h1> Spectator Scan Report</h1>"
html = html --> "<p><strong>Target:</strong> " --> target --> "</p>"
html = html --> "<p><strong>Timestamp:</strong> " --> now() --> "</p>"
html = html --> "<h2> Open Ports</h2><table><tr><th>Port</th><th>Service</th><th>Banner</th></tr>"

each port : open_ports {
  port_str = str(port)
  service = results[port_str]
  banner = ""
  if hasKey(results, port_str --> "_banner") {
    banner = results[port_str --> "_banner"]
  } else {
    banner = "-"
  }
  html = html --> "<tr><td>" --> port_str --> "</td><td>" --> service --> "</td><td>" --> banner --> "</td></tr>"
}

html = html --> "</table><hr><p><i>Generated by Spectator - See Everything. Miss Nothing.</i></p></body></html>"
writeFile("scan_report.html", html)

Trace("\n[+] Done! Open scan_report.html in your browser.")

Step 3: Run Your Tool

spectator run smart_scan.str

That's it. No dependencies, no virtual environments, no "pip install requests." Just run.

Level Up: Adding a GUI
Here's where Spectator gets really interesting. Let's wrap that scanner in a native GUI:

#Import Spec.GUI

open.window({
  "title": "Spectator Port Scanner",
  "width": 900,
  "height": 700,
  "bg": "#0a0f1a",
  "accent": "#00d4aa"
})

GUI.header("Spectator Port Scanner")
GUI.input("target", "Enter target (IP or domain)...")
GUI.button("Start Scan", "scan", {"color": "#00d4aa"})
GUI.output("results", {"height": 500})

GUI.on("scan", func() {
  target = GUI.get("target")

  if target == "" {
    GUI.alert("Please enter a target")
    return
  }

  GUI.clear("results")
  GUI.print("results", "[+] Scanning: " --> target)
  GUI.print("results", "[+] Checking common ports...")

  ports = [21, 22, 23, 25, 80, 443, 445, 3306, 3389, 5432, 8080, 8443]

  each port : ports {
    if hasPort(target, port) {
      GUI.print("results", "  ✓ Port " --> str(port) --> " is OPEN")
    } else {
      GUI.print("results", "  ✗ Port " --> str(port) --> " is closed")
    }
  }

  GUI.print("results", "\n[+] Scan complete!")
})

end()

Build

# Windows executable
spectator build scanner.str to PortScanner.exe for windows

# Linux binary
spectator build scanner.str to portscanner for linux

# macOS (Intel)
spectator build scanner.str to PortScanner for mac

Your users don't need Spectator installed. The binary is completely self-contained.

*GUI available only for windows.

The Built-in Modules That Shine

After playing with Spectator, here are the modules I found most useful:

Recon

ips = resolve("target.com")
whois = WHOIs("target.com")
geo = GeoIP("8.8.8.8")
subs = SubdomainEnum("target.com", "wordlist.txt")

Web Testing

headers = HeaderAudit("https://target.com")
tech = TechDetect("https://target.com")
sqli_test = SQLiTest("https://target.com/page?id=1")

Mission Reporting

m = missionStart("Web App Pentest", "target.com")
missionStage(m, "Recon")
missionFind(m, "HIGH", "Missing CSP header", "XSS possible")
missionFind(m, "CRITICAL", "SQLi in login form", "Auth bypass")
missionEnd(m)
missionReport(m, "pentest_report.html")

The Package Manager: Space

Installing community libraries is straightforward and secure:

spectator space get ghost

spectator space verify ghost

#Import ghost
ghost_full("target.com")  # Full OSINT sweep

Who Is This For?

Penetration testers who want to automate repetitive tasks without fighting tooling.

Red teamers who need quick, reliable scripts that work everywhere (thanks to standalone binaries).

Bug bounty hunters who want to build custom scanners without dependency hell.

Security researchers who need to prototype attack techniques rapidly.

Tool builders who want to distribute GUI security tools without Electron bloat.

Getting Started Today

# 1. Download
wget https://github.com/CzaxStudio/Spectator/releases/latest/download/spectator-linux
chmod +x spectator-linux

# 2. Run REPL
./spectator-linux repl

# 3. Try hello world
Trace("Hello, Spectator!")

# 4. Install a library
./spectator-linux space get coffee

# 5. Build something
./spectator-linux build mytool.str to scanner

Documentation: spectatorlang.pages.dev
GitHub: github.com/CzaxStudio/Spectator
Examples: Check the examples/ directory in the repo

Final Thoughts

Is Spectator going to replace Python for security work? Not tomorrow. But it's solving real problems that Python has ignored for years — dependency management, cross-platform GUI apps, and built-in security primitives.

For pentesters tired of the "pip install → version conflict → break everything" cycle, Spectator is a breath of fresh air. And at 7 stars on GitHub (as of writing), you can get in on the ground floor.

Try it on your next CTF or internal tool. You might be surprised how fast you can go from idea to working executable.

Thanks

What tools would you build with a language like this? Drop a comment below!

Follow for more: I'll be posting Spectator tutorials, security tools, and red team automation scripts in the coming weeks.

Spectator v2.0.0 — "See Everything. Miss Nothing."

Introducing Mamba: A Powerful Python OSINT Library for Security Researchers

Czax225 — Wed, 29 Apr 2026 05:09:08 +0000

What is Mamba?
Mamba is a production-ready OSINT (Open Source Intelligence) library that makes security research and reconnaissance simple in Python. With just a few lines of code, you can investigate emails, domains, usernames, phone numbers, and IP addresses.

GitHub: CzaxStudio/Mamba
PyPI: pip install mamba-security

Why I Built Mamba
As a security researcher, I found myself writing the same code repeatedly for OSINT investigations. Each project needed:

Email breach checking

WHOIS lookups

Username enumeration

Phone validation

IP geolocation

I built Mamba to solve this. It's designed to be:

Easy to use - One line of code for complex OSINT tasks

Production ready - Rate limiting, caching, and error handling built-in

Well tested - Comprehensive test suite

Industry standard - Type hints, proper documentation

Example

from mamba import MambaClient, EmailReputation, DomainIntel

with MambaClient() as client:
    # Check email
    email = EmailReputation(client)
    result = email.validate_format("researcher@example.com")
    print(f"Valid email: {result.data['valid_format']}")

    # Domain WHOIS
    domain = DomainIntel(client)
    result = domain.whois_lookup("google.com")
    print(f"Registrar: {result.data['registrar']}")

Requirements
Python 3.8+

Internet connection for API calls

Documentation & Learning

Complete Mamba Documentation: GitHub - MambaDocumentation

The documentation repository includes:

Step-by-step tutorials

Complete API reference

Real-world examples

Best practices for OSINT

Roadmap
Add more breach databases

Support for Dark Web monitoring

Social media API integration

Machine learning for threat detection

Plugin system for custom sources

Contributing
Contributions are welcome! Open issues, submit PRs, or suggest features.

License
MIT License - Free for commercial and personal use

Connect With Me
GitHub: CzaxStudio

Star the Repo ⭐
If Mamba helps you, please star the repository on GitHub. It helps others discover the project!

https://github.com/CzaxStudio/Mamba

Happy OSINT investigations!

I built a lightweight IDE for Nim — focused, fast, and simple

Czax225 — Thu, 23 Apr 2026 08:36:44 +0000

Most Nim developers today use tools like Visual Studio Code with extensions.

It works — but I kept wondering:

What would a Nim-first IDE feel like if it was designed around simplicity and speed?

So I built one.

Ferrum Studio.

Why I built this

While learning and working with Nim, I noticed the workflow often feels adapted rather than designed for the language.

You install an editor, configure extensions, tweak settings… and eventually it works.

But I wanted something simpler:

Open a Nim file
Press run
See output immediately

No friction. No setup overhead.

What Ferrum Studio does

Ferrum Studio is a lightweight IDE focused specifically on Nim.

A few things upfront:

Built with Go + Wails (uses a system webview — no bundled Chromium)
Frontend parts were built with help from AI tools (I’m still learning JavaScript)
Backend, Nim integration, and overall structure are written by me
Features (current)
Run Nim files with live output
Build (nim build), test, and ast-check integration
Inline error display with simplified explanations
Basic autocomplete and snippets
Project templates (CLI, library, TCP server, embedded)
Integrated terminal with stdin support
Nim auto-detection
The main goal: a smooth workflow

The focus is on making this loop fast and simple:

open → run → see output → interact → fix errors

Handling things like:

real-time output streaming
stdin interaction
process control

…took more work than expected, but this is the part I’m most proud of.

Who should use this (right now)

Ferrum Studio is still early, but it’s already useful for:

Developers learning Nim who want a simple environment
People who prefer lightweight tools over heavier setups
Anyone who wants a fast “open → run → test” workflow

If you rely heavily on advanced IDE features (full LSP, deep refactoring, debugging), tools like Visual Studio Code are still better today.

But if you want a focused, minimal Nim workflow — this already works well.

What I learned

This project taught me a lot:

How Nim tooling works in practice (run, build, test, ast-check)
Managing subprocesses and terminal interaction
Designing an editor around a single language
Using AI tools effectively for parts I’m less experienced in
What’s next
Deciding between lightweight autocomplete vs full LSP (ZLS)
Improving error explanations
Exploring debugging support
Cleaning up and improving the codebase
Feedback?

I’d really appreciate input:

What do you expect from a Nim-focused IDE?
What slows you down in your current workflow?
What would make this genuinely useful for you?
Project

GitHub: https://github.com/CzaxStudio/Ferrum-Studio

Final thoughts

This started as an experiment — but it’s already shaping how I think about developer tools.

Simple, fast, and focused.

Thanks for reading 🙂

Spectator - A programming language for cybersecurity(GUI, CLI, TUI built in)

Czax225 — Sat, 04 Apr 2026 06:51:30 +0000

Spectator — A Cybersecurity Language That Actually Gets Work Done

███████╗██████╗ ███████╗ ██████╗████████╗ █████╗ ████████╗ ██████╗ ██████╗
██╔════╝██╔══██╗██╔════╝██╔════╝╚══██╔══╝██╔══██╗╚══██╔══╝██╔═══██╗██╔══██╗
███████╗██████╔╝█████╗  ██║        ██║   ███████║   ██║   ██║   ██║██████╔╝
╚════██║██╔═══╝ ██╔══╝  ██║        ██║   ██╔══██║   ██║   ██║   ██║██╔══██╗
███████║██║     ███████╗╚██████╗   ██║   ██║  ██║   ██║   ╚██████╔╝██║  ██║
╚══════╝╚═╝     ╚══════╝ ╚═════╝   ╚═╝   ╚═╝  ╚═╝   ╚═╝    ╚═════╝ ╚═╝  ╚═╝

See Everything. Miss Nothing.

What if your entire cybersecurity workflow lived inside one language?

No switching between Python, Bash, and dozens of disconnected tools.
No glue scripts. No messy pipelines.

Just one clean, purpose-built system.

That’s Spectator.

The Problem

Modern security workflows are fragmented by design.

Python for scripting
Bash for automation
Standalone tools for scanning and fuzzing
Separate stacks for GUI tools

Everything works — but nothing works together.

You spend more time connecting tools than actually testing systems.

The Idea Behind Spectator

Spectator is a cybersecurity-first scripting language designed to unify your workflow.

It combines:

Simple, readable syntax
Built-in security modules
Native GUI framework
Integrated package manager
Standalone binary compilation

All inside a single runtime.

Recon in 5 Lines

target = "scanme.nmap.org"
ips = resolve(target)
Trace("IPs: " --> join(ips, ", "))
do --> PortScan(target, 1, 1024)
do --> SSLInfo(target)

No imports. No external dependencies. No setup.

Build a Real GUI Tool

#Import Spec.GUI

open.window({"title": "Ghost Recon", "bg": "#070b14", "accent": "#00d4aa"})
GUI.input("target", "Enter target...")
GUI.button("Scan", "run", {"color": "#00d4aa"})
GUI.output("out", {"height": 400})

GUI.on("run", func() {
  t = GUI.get("target")
  ips = resolve(t)
  each ip : ips {
    GUI.print("out", "IP: " --> ip)
  }
})
end()

No Electron. No web stack. No Python GUI frameworks.

Built-in Security Modules

Spectator includes native support for:

Recon: PortScan, DNSLookup, CIDRScan
OSINT: WHOIS, GeoIP, Subdomain Enumeration
Web: HTTP probing, header analysis, SSL inspection
Exploitation: SQLi, CORS, Open Redirect testing
Fuzzing: Directory busting, URL fuzzing
Payload generation for multiple attack vectors
Encoding, hashing, and cryptographic utilities

Everything is directly accessible from the language.

HTTP Engine Included

resp = http("GET", "https://target.com", {"timeout": 5000})
Trace(httpStatus(resp))
Trace(extractTitle(httpBody(resp)))

No external libraries required.

Mission Engine for Structured Testing

m = missionStart("Web App Pentest", "target.com")

missionStage(m, "Recon")
missionFind(m, "CRITICAL", ".env exposed", "Credentials leaked")

missionEnd(m)
missionReport(m, "report.html")

Generate structured reports automatically.

Space Package Manager

spectator space get coffee
spectator space verify coffee
spectator space registry

All packages are SHA-256 verified by default.

Build Standalone Tools

spectator build tool.str to Tool.exe for windows

No runtime required for end users.

Why Spectator Exists

Because cybersecurity tooling is unnecessarily complex.

Because developers keep rebuilding the same pipelines.

Because switching between tools breaks flow.

Spectator removes that friction.

Links

Website: https://spectatorlang.pages.dev/
Documentation: https://github.com/CzaxStudio/SpectatorDocs/
Source: https://github.com/CzaxStudio/Spectator

Final Thought

Spectator is not trying to replace existing tools.

It is trying to replace the need to glue them together.

If you build tools, automate testing, or work in offensive security — this is for you.

I Built a Cybersecurity-Only Programming Language (So You Don’t Need 200 Lines of Python)

Czax225 — Sat, 03 Jan 2026 05:54:23 +0000

Cybersecurity scripting today mostly relies on general-purpose languages like Python, Bash, or Go.

They work — but they come with problems:

Too many libraries

Long scripts for simple tasks

Environment setup issues

Slower execution for small utilities

So I asked a simple question:

Why isn’t there a programming language made only for cybersecurity?

That’s how Cyber+ was born.

What is Cyber+?

Cyber+ is a domain-specific programming language (DSL) built exclusively for cybersecurity tasks.

It is not a replacement for Python or Go.
It is a workflow language for security operations.

Instead of writing long scripts and importing heavy libraries, Cyber+ provides built-in security commands.

And because it’s implemented in Go, it’s fast and distributed as a single binary.

The Problem with Current Approaches

Let’s take a very common task: hashing.

Python
import hashlib

data = "password".encode()
hash_value = hashlib.sha256(data).hexdigest()
print(hash_value)

That’s fine — but this is a simple example.

Now imagine:

Encoding / decoding

Password generation

Port scanning

File integrity checks

Repetitive CTF automation

Scripts quickly become long and repetitive.

The Cyber+ Approach

In Cyber+, the same task looks like this:

Hash_Compute("password", "sha256")

That’s it.

No imports.
No setup.
No boilerplate.

Why a DSL?

Cybersecurity already uses DSLs successfully:

SQL for databases

Bash for automation

YARA for malware detection

Cyber+ follows the same idea:

One language, one domain, maximum clarity.

Each Cyber+ command directly represents a security action, not a programming construct.

Core Design Goals

Cyber+ is designed to be:

Security-first (only cybersecurity features)

Fast (Go-powered execution)

Beginner-friendly

Minimal syntax

Single binary (no runtime hell)

Who is Cyber+ For?

Cyber+ is especially useful for:

Cybersecurity students

CTF players

Security automation

Learning-focused environments

Quick scripting tasks

It’s not meant to replace full frameworks — it’s meant to remove friction.

Real Use Cases

Automating CTF challenges

Quick hashing / encoding utilities

Password and wordlist operations

Lightweight recon scripts

Teaching cybersecurity fundamentals

Why It’s Written in Go

Using Go allows Cyber+ to:

Run fast

Compile to static binaries

Avoid dependency issues

Work across platforms easily

This matters a lot in security workflows.

Open Source & Early Stage

Cyber+ is open source and still evolving.

Feedback, ideas, and contributions are welcome — especially from:

Security professionals

Students

Educators

Tool builders

GitHub

Project repository:
https://github.com/TanmayCzax/Cyber-Programming-language-Alpha

Final Thoughts

Cyber+ isn’t trying to be the next Python.

It’s trying to be something simpler:

A language that lets you focus on cybersecurity, not code overhead.

If you’ve ever thought “this script shouldn’t be this long” — Cyber+ might be for you.

I Built a Cybersecurity Programming Language in Go (Cyber+)

Czax225 — Fri, 19 Dec 2025 12:41:56 +0000

I’m experimenting with a small domain-specific language for ethical cyber security tasks
(recon, DNS, OSINT, HTTP inspection).

The idea is to reduce reliance on Bash scripts and multiple tools
by offering a minimal, command-based syntax.

Example usage:
Recon("example.com");
Phone_Info("+91XXXXXXXXXX");
Scan_Port("8.8.8.8", 53);

I’m mainly looking for feedback on:
• Syntax readability
• Whether this feels more like a language or a wrapper
• What features you’d expect in a security DSL

Here is the repo link -- https://github.com/TanmayCzax/Cyber-Programming-language