05Lab · Security training platform
GhostNet
Thirteen training modules from OSINT to Active Directory, eight standalone security tools, a leaderboard, and GHOST, an LLM agent for signed-in users.
- 13modules
01
The problem
- Security learning is scattered across blogs and videos. GhostNet puts modules, tools and an assistant in one place.
02
Architecture
ModulesActive Directory, cloud, crypto, malware, mobile, network, offensive, OSINT, red team, social engineering, Tor, web, wireless.
ToolsAttack path, crypto tracer, CTF, intel, payload, report generator, Shodan, terminal.
GHOST agentAuthenticated, rate-limited per user, strict input validation.
03
Real code
app/api/ghost/route.tsexcerpt
const { data: { user } } = await authClient.auth.getUser()
if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
if (!checkRateLimit(user.id))
return NextResponse.json({ error: 'Rate limit exceeded' }, { status: 429 })
if (!Array.isArray(messages) || messages.length > 40) // reject
for (const msg of messages)
if (msg.content.length > 4000) // reject04
What I'd do next
- Move the agent's system prompt to the server so clients cannot change it.
- Persist rate limits in Redis instead of memory.