The Problem

Investigators and OSINT practitioners often need a quick, script‑based way to fetch public data about an IP address, phone number, or username. Existing tools are fragmented, requiring separate installations and manual API calls, which slows down real‑time analysis.

What This Does

GhostTR.py implements a single‑file CLI that presents a text menu for three lookup modes: IP Tracker, Phone Tracker, and Username Tracker. The menu logic lives in run_banner() and option(), while the actual lookups are performed by the functions IP_Track(), phoneGW(), and TrackLu(). Supporting assets (icons and screenshots) are stored under asset/. The only external dependency list is requirements.txt, which the README installs with pip3 install -r requirements.txt.

How It Is Wired

Execution starts at the main function defined near line 296 of GhostTR.py. main calls clear(), displays the banner via run_banner(), and then hands control to option().

  • run_banner() → clear() (clears the terminal) and prints the static menu.
  • option() reads the user’s choice, validates it with is_option(), and dispatches to execute_option().
  • execute_option() invokes the selected workflow (IP_Track, phoneGW, or TrackLu) and finally returns to main.

The internal call graph contains 11 resolved edges; the most‑used functions are clear (called from three places) and main (called from two places). All network calls are made inside the three tracker functions, each using requests.get without a timeout (identified by the static analysis). No external modules are imported beyond the Python standard library and requests, so the code’s side‑effects are limited to HTTP requests and console output.

How To Use It

# Clone the original upstream (the fork you are reviewing)
git clone https://github.com/moses-y/GhostTrack.git
cd GhostTrack

# Install Python 3 and pip if not present (see README for Linux/Termux hints)
pip3 install -r requirements.txt

# Run the CLI
python3 GhostTR.py

The script expects no configuration files or environment variables; all prompts are interactive. The README’s “Usage Tool” section matches these steps verbatim.

Real‑World Use

A security analyst could embed the CLI in a larger Bash automation loop:

for target in $(cat ip_list.txt); do
    echo "$target" | python3 GhostTR.py <<EOF
1   # select “IP Tracker”
$target
EOF
done

The loop feeds each IP to the menu, collects the printed JSON response, and stores it for later correlation.

Code Health & Issues

  • HIGH – Deep nesting – GhostTR.py reaches an indentation depth of 20, making the control flow hard to follow. Refactor with early returns or guard clauses.
  • MEDIUM – No Dependabot/Renovate – Only requirements.txt is present; a Dependabot config (.github/dependabot.yml) would automate security updates.
  • MEDIUM – Outbound requests lack timeout – Three requests.get calls in the tracker functions have no timeout= argument, risking hangs. Add a reasonable timeout or use a configured Session.
  • MEDIUM – No test suite – No tests/ directory; untested paths increase regression risk.
  • MEDIUM – No CI pipeline – Absence of GitHub Actions or similar means changes are not automatically verified.
  • MEDIUM – No LICENSE – Redistribution rights are unclear without a license file.
  • LOW – No lockfile – requirements.txt alone makes reproducible installs harder; consider adding requirements-lock.txt or a pipfile.

The Bottom Line

GhostTrack provides a quick, menu‑driven way to gather public IP, phone, and username data, but the implementation is a single monolithic script with deep nesting and minimal safeguards. It is suitable for ad‑hoc investigations or as a prototype, but production use should address the noted health issues—especially adding request timeouts, a test suite, and CI automation—before relying on it in a repeatable workflow.