The browser used to be a window. Now it's the terminal.
That shift happened quietly — enterprises moving their entire stack to SaaS, authentication migrating from the server to the client, identity becoming the perimeter. The result is that the most interesting attack surface in 2026 isn't a misconfigured S3 bucket or an unpatched CVE. It's the trust boundary the browser already lives inside. You've authenticated. The IAP verified you. The WAF waved you through. Everything that happens next happens inside a context the perimeter has already blessed.
You build understanding of a problem like that slowly. You break things methodically, every day, until the way the modern detection landscape thinks starts to feel legible. Until you know what a UI Sentinel is looking for before you've written a line. Until you understand the stealth requirements not because you read a paper but because you've watched an intercept fail in real time and had to figure out why.
GHOST_PROXY is what that understanding produces when you give it a form.
It is not a proxy manager. It is not a script injector with a nice UI. It is a full-stack red-team command center distributed as a UserScript — TypeScript, Vite, React with Motion — built for the engagement loop that actually exists in 2026. Tampermonkey or Violentmonkey, no extension store review, no waiting. You modify, deploy, audit from the console. The iteration is live. The footprint is minimal. The tool does not announce itself. That is not an accident. That is the design.
The Behavioral Model Already Running When You Inject
If you inject a script into a modern enterprise application, something is already watching. Not a human. A behavioral model. UI Sentinels that monitor for DOM mutations, global variable pollution, unauthorized event listeners, timing anomalies in API calls. The detection layer isn't signature-based. It is behavioral. It doesn't look for known bad patterns. It looks for anything that deviates from how a normal authenticated session moves through the application.
Static intercepts fail in this environment. A regex that finds what you're looking for also looks like a regex to the thing watching your script execute. The timing of your method calls, the order you touch the DOM, the variables you introduce into the global scope — all of it is being scored against a baseline you never got to see.
GHOST_AGENT is the answer to this. An integrated Gemini Pro link that operates as a code-level neural architect. Not a chatbot. A system you feed the target context — the WAF version, the detection behavior you're seeing, the framework underneath the application — and it generates bypass logic, suggests payload mutations, helps you harden intercepts in real time. The difference between a tool that gives you a starting point and one that evolves with the environment you're operating in.
The Stealth Architecture
Modern enterprise applications instrument their own environment. They check fetch and XMLHttpRequest for signs of tampering. They audit the event listener registry. They scan for globals that shouldn't exist. The naive response to this is a different execution context. The right response is to make the environment report clean when inspected — to wrap the intercept in a layer that shows investigators exactly what they expect to see.
STEALTH_ACTIVE does this with Proxy-based monkey patches. Sensitive global objects get wrapped so their .toString() calls return the original native signature. The application's own defense scripts check for tampering and find nothing. The intercept logic runs underneath, invisible to the inspection layer above it.
// GHOST_PROXY: Stealth Cloak Interceptor
window.stealthPatch = function(obj, prop, replacementFunc) {
const original = obj[prop];
const proxy = new Proxy(replacementFunc, {
get: (target, key) => {
// Return native signature on inspection
if (key === 'toString') return () => original.toString();
return target[key];
}
});
obj[prop] = proxy;
};
// Cloaking the event listener
// getEventListeners() sees nothing
stealthPatch(EventTarget.prototype, 'addEventListener', function(type, listener, options) {
return originalAddEventListener.apply(this, arguments);
});
The UI layer goes further. Every control lives in a closed Shadow Root — an isolated DOM environment that the host page's JavaScript cannot traverse. The main document encounters a randomized container ID and an empty div. The actual augmentation interface exists in a layer that the document's own scripts have no access to. The tool operates in the same browser the site lives in and the site cannot see it.
This is the architecture the Ghost Protocol: Stealth Cloak module implements. It is also the architecture you need to understand to detect it, which is the point of running it in a controlled environment before you encounter it in the wild.
The Protocols
The first cut of the workshop shipped with five specialized intercepts. Each one targets a specific surface of the modern attack landscape. Each one is a starting point for understanding, not a finished weapon. (v1.4 grew the lab into a ten-module sandbox — see the coda at the bottom; the five below are the spine the rest grew around.)
The UI Sentinel runs real-time monitoring for high-altitude overlays and DOM poisoning — watching for the same techniques the tool uses against target applications. The reason is deliberate. Understanding how injection gets detected is the same knowledge as understanding how to inject cleanly. You cannot build one without the other.
The E-Comm Auditor is platform-aware. It knows the specific DOM structure and API patterns of Shopify and WooCommerce. It surfaces price tampering vectors, discount enumeration, IDOR exposure, and parameter pollution in checkout flows. The surgical precision comes from the platform knowledge. A generic probe finds generic results. This finds the things that are actually there.
The Source Secret Scanner runs passively in the background, auditing the DOM for leaked credentials — Stripe sk_live_ prefixes, AWS AKIA key patterns, Firebase configs surfaced in client-side JavaScript. The number of production applications leaking real API keys into their own frontend is not a small number. It is a finding that appears on almost every engagement where someone looks.
