Skip to content
View ghost-injection's full-sized avatar
  • Ghostlink Network
  • 17:06 (UTC -08:00)

Block or report ghost-injection

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
ghost-injection/README.md
doom terminal banner

ghost-injection

Security tooling, local AI systems, and operator interfaces - built to run on hardware I own.


I build things that hold up when the network is hostile and the cloud is someone else's computer: Android control planes over private tunnels, WiFi survey instruments, single-file incident utilities, and a Telegram bot that runs its own models on a Raspberry Pi.

Shipped

Repository What it does
GhostLink Mirror and control Android from Windows over Tailscale. No USB, no port forwarding, no relay, no root. Native helper APK + themed scrcpy controller.
AegisWardrive Passive WiFi survey for Android: sweep, score, map, export KML/CSV. No root, no monitor mode - it reads what the OS already broadcasts.
reaper Single-file process hunter for Windows and Linux. Find by name, port, or command line; kill the exact set with a dry run first.
pid-sniper Click a window, get its PID, parent, path, and class. Plus a popup radar that logs new dialogs as they appear.
CipherShell Memory Private Obsidian vault used as durable memory for Codex, Hermes, Claude Code, and local model lanes.

Running, not published

picobot-v2 - autonomous Telegram operator bot: local Ollama inference, twelve agent roles, AES-256-GCM config vault, SQLite state, stdlib dashboard, three-tier SD imaging. Private.

How I build

own the inference        → local models first, cloud only when it is the right tool
own the transport        → Tailscale or nothing; no vendor relay sees the screen
ship the smallest thing  → one file beats a deployment ceremony
state the limits         → a README that hides failure modes is marketing

Stack

python · java · bash              sqlite · systemd · obsidian
ollama · llama.cpp · codex        android (adb, scrcpy, foreground service)
pi 5 · tailscale · windows        nmap · rustscan · ghidra

Contact

hack the planet. keep the mask on.

Popular repositories Loading

  1. ghost-injection ghost-injection Public

    Security tooling and local AI systems: GhostLink (Android control over Tailscale), AegisWardrive (passive WiFi survey), reaper, pid-sniper.

    1

  2. Responder Responder Public

    Forked from SpiderLabs/Responder

    Mirror of SpiderLabs/Responder - LLMNR, NBT-NS and mDNS poisoner with rogue auth servers. Upstream docs apply.

    Python

  3. StegoForge StegoForge Public

    Forked from Nour833/StegoForge

    Mirror of Nour833/StegoForge - steganography and forensics toolkit for images, audio, video, documents. Upstream docs apply.

    Python

  4. AIL-installer AIL-installer Public

    Forked from zSecurity-org/AIL-installer

    Mirror of zSecurity-org/AIL-installer - installer for the AIL analysis framework. Upstream docs apply.

    Shell

  5. I2P-Browser I2P-Browser Public

    Forked from umutcamliyurt/I2P-Browser

    Mirror of umutcamliyurt/I2P-Browser - browser for the I2P network. Read-only; upstream README is authoritative.

    Python

  6. termux-app termux-app Public

    Forked from termux/termux-app

    Mirror of termux/termux-app - Android terminal emulator and Linux environment. Kept for reference.

    Java