NetDeck — a mobile control deck for Kali on a non‑rooted Android phone

NetDeck turns a non‑rooted Android phone into a usable Kali Linux workstation with a phone‑style, touch‑first web UI. It runs Kali in user space (Termux + Kali NetHunter Rootless) and serves a single‑file Python web app you open in your browser — a big‑tile launcher with real app icons, a bottom dock, favorites, a live streaming terminal, and a suite of touch mini‑apps (files, notes, monitor, window switcher, network tools, web request, ports, package manager, logs, services, SSH, snippets, cleanup, find, share, and more).

No root. No bootloader unlock. One self‑contained Python file (standard library only).

⚠️ Authorized use only. NetDeck is a convenience layer over standard Kali tooling for learning and authorized security testing. Only test systems you own or have explicit written permission to test. You are responsible for how you use it.

---

Highlights

• Polished launcher — real system app icons (with emoji fallback), a fixed bottom dock (Terminal · Files · Windows · Top), ★ favorites you can pin to the top, and collapsible groups (the big “All Apps” list is collapsed by default).
• Live terminal pane — tap a CLI tool (nmap, sqlmap, hydra, …) → a real streaming terminal opens pre‑filled; type args, run, watch live output. Persistent working directory. No desktop required.
• Auto‑maximized apps — every GUI app NetDeck launches is auto‑maximized (even slow ones like Wireshark), so the window switcher shows clean full‑screen apps, not overlapping windows.
• Self‑healing UI — auto‑retries on load and sends no‑store, so it never serves a stale page.
• Back/Home navigation — Android back closes the current panel; a Home button returns to the grid without killing anything running.
• Add to Home screen → full‑screen, branded PWA icon.

The 17 touch mini‑apps

All run in the reliable web layer (no X11 needed unless noted):

1. Files — browse Kali + phone storage (/sdcard), view text/images, rename/delete/mkdir
2. Notes — one‑tap scratchpad
3. Monitor — live RAM/disk gauges, load average, top processes (with kill)
4. Windows — switch/raise/close open desktop apps (needs wmctrl)
5. Network — target box → ping / scan / DNS / HTTP headers / traceroute / public IP
6. Hash & Encode — MD5/SHA1/SHA256/SHA512, Base64, URL encode/decode, ROT13
7. Packages — search apt repos, install/remove (runs in the terminal)
8. Logs — view system logs (/var/log)
9. Services — start/stop/status of SSH, PostgreSQL, window manager, X11, NetDeck
10. SSH — saved hosts → one tap to ssh in the terminal
11. Snippets — your own command library; tap to drop into the terminal
12. Cleanup — one‑tap apt autoremove / clean / cache clear / disk usage
13. Notebook — multiple named notes
14. Web Request — mini curl/Postman (method + URL + headers + body → response)
15. Ports — listening ports & TCP connections (parses /proc/net, since ss is blocked in proot)
16. Find — search files by name; results open in Files/editor/viewer
17. Share — python3 -m http.server a folder over Wi‑Fi to grab files from a laptop

---

How it works (architecture)

Android (handles radio, Wi‑Fi, hardware)
└─ Termux (Linux userland, no root)
   ├─ termux-x11 server  ── renders the GUI in the Termux:X11 app
   ├─ Kali NetHunter Rootless (proot)
   │   ├─ xfwm4 (window manager)        ← makes apps maximizable / auto-maximized
   │   └─ netdeck.py  (Python web server on 127.0.0.1:8080)
   └─ you open the server in your phone browser  → NetDeck UI

• CLI tools / mini‑apps run through NetDeck’s web layer — rock solid, no GPU/X11 needed.
• GUI apps (Firefox, Wireshark, …) draw on the Termux:X11 display; NetDeck launches and maximizes them, you switch to the Termux:X11 app to use them.

---

Requirements

• A reasonably modern ARM64 (aarch64) Android phone. Developed/tested on a OnePlus 11R 5G (OxygenOS, Android 15).
• ~10 GB free storage and Wi‑Fi (the Kali image is several GB).
• No root required.

---

Installation (start to end)

Commands at the Kali prompt run inside Kali (after typing nethunter); others run in plain Termux (~ $). Do downloads on Wi‑Fi.

Phase 0 — Install the apps (all from F‑Droid)

Install F‑Droid (https://f-droid.org), then from it install (same signing source — use F‑Droid for the whole family):

App	Package	Purpose
Termux	com.termux	base Linux terminal
Termux:X11	com.termux.x11	renders the Linux GUI in an Android window
Termux:Widget	com.termux.widget	one‑tap home‑screen launcher
Termux:Boot	com.termux.boot	auto‑start after reboot
Termux:API	com.termux.api	bridges Android features (optional)

Also install Hacker's Keyboard (full keyboard with Ctrl/Tab/arrows).

Don’t use the Play Store Termux — it’s abandoned and breaks. If Termux:X11 isn’t on your F‑Droid, get it from the official termux/termux-x11 GitHub releases (arm64‑v8a), but then install base Termux from GitHub too so their signatures match.

Phase 1 — Termux base

pkg update && pkg upgrade -y
pkg install -y wget x11-repo
pkg install -y termux-x11-nightly pulseaudio termux-api

(Press Enter to accept defaults on config‑file prompts.)

Phase 2 — File bridge

termux-setup-storage

Accept the prompt. Inside Kali, your phone storage appears at /sdcard.

Phase 3 — Install Kali (NetHunter Rootless)

wget -O install-nethunter-termux https://offs.ec/2MceZWr
chmod +x install-nethunter-termux
./install-nethunter-termux

If the short link 404s/hangs, fetch the script directly:

curl -L -o install-nethunter-termux \
  https://gitlab.com/kalilinux/nethunter/build-scripts/kali-nethunter-rootless/raw/main/install-nethunter-termux
chmod +x install-nethunter-termux
./install-nethunter-termux

Choose option 1 (full). Several‑GB download + extract. Then enter Kali:

nethunter        # (or: nh)

Phase 4 — Set up Kali

If apt update fails with “Temporary failure resolving …”, fix DNS first:

sudo sh -c 'echo "nameserver 8.8.8.8" > /etc/resolv.conf'

Update + install the desktop, window manager and tools NetDeck uses:

sudo apt update && sudo apt full-upgrade -y
sudo apt install -y kali-desktop-xfce dbus-x11 xfwm4 wmctrl openssh-client
sudo apt install -y kali-themes-common gnome-icon-theme adwaita-icon-theme

Known issue — PostgreSQL fails to configure (no init system in proot). If apt errors on postgresql:

sudo dpkg --configure -a --force-all
sudo apt --fix-broken install -y

(postgres isn’t needed by NetDeck.) Then install whatever security tools you want:

sudo apt install -y nmap sqlmap hydra nikto gobuster      # pick what you need
# or the big set:  sudo apt install -y kali-linux-default

Phase 5 — Deploy NetDeck

# inside Kali
cp /sdcard/Download/netdeck.py ~/

Quick foreground test:

python3 ~/netdeck.py
# open  http://127.0.0.1:8080  in your phone browser, then Ctrl+C to stop the test

Phase 6 — One‑tap launcher + auto‑start

Copy the two scripts from scripts/:

# plain Termux (~ $)
mkdir -p ~/.shortcuts ~/.termux/boot
cp /sdcard/Download/NetDeck ~/.shortcuts/NetDeck
cp /sdcard/Download/start-netdeck ~/.termux/boot/start-netdeck
chmod +x ~/.shortcuts/NetDeck ~/.termux/boot/start-netdeck

• Widget: Home screen → long‑press → Widgets → Termux:Widget → drop it → pick NetDeck. One tap starts X11 + window manager + NetDeck.
• Boot: open the Termux:Boot app once so Android arms it.

Phase 7 — Termux:X11 display (touch sizing)

In the Termux:X11 app → ⋮ → Preferences → Output:

• Display resolution mode: custom
• Display resolution: a portrait value, e.g. 1080x2400 (height > width)
• Adjust resolution to fit screen orientation: ON
• Stretch to fit display: ON
• Display filtering mode: linear

NetDeck also scales launched apps 1.5× (edit UI_SCALE near the top of netdeck.py).

Phase 8 — Persistence

• Settings → Apps → Termux → Battery → Unrestricted / allow background.

• Settings → Auto‑launch / Startup manager → enable Termux and Termux:Boot.

• The launcher already grabs a wakelock.

• Fully hands‑free (optional, needs a PC once): OxygenOS aggressively kills background processes. Disabling the “phantom process killer” via ADB makes boot/background reliable:

  adb shell settings put global settings_enable_monitor_phantom_procs false
  adb shell device_config set_sync_disabled_for_tests persistent
  adb shell device_config put activity_manager max_phantom_processes 2147483647

  Without it, your routine is simply one widget tap after a reboot.

Phase 9 — Install as a home‑screen app

Open http://127.0.0.1:8080 in Chrome → ⋮ → Add to Home screen → full‑screen branded icon.

---

Daily use

1. Tap the NetDeck widget (starts X11 + window manager + server). After a reboot, this once.
2. Tap the NetDeck icon → the deck opens full‑screen.
3. CLI tools / mini‑apps work immediately. For GUI apps, tap a tile, then switch to the Termux:X11 app to view it (it opens maximized). Use the Windows mini‑app to switch/close.
4. Dock (bottom bar): Terminal · Files · Windows · Top. Star any tile to pin it to ★ Favorites. Tap a group header to collapse/expand it (your choices are remembered).

If the deck ever shows “checking / can’t connect”, the server isn’t running — tap the widget, wait ~10 s, reopen. (Confirm with curl -s http://127.0.0.1:8080/api/health.)

---

Customizing

Open netdeck.py and edit near the top:

• PORT — default 8080.
• UI_SCALE — touch scaling for launched GUI apps ("1.25"–"2.0").
• TILES — hand‑picked CLI/quick tiles. Each has id, label, icon, group, mode, cmd, desc. mode: output (run, show text), gui (launch on X11), term (interactive on X11), cli (open the live terminal), panel (a mini‑app).
• COMMON_CLI — which CLI tools become terminal tiles (only the installed ones show).

The All Apps section is generated from installed .desktop files (with real icons) — anything you apt install later just appears. Favorites and collapsed‑group state live in the browser.

---

Troubleshooting

Symptom	Cause / fix
Deck stuck on “checking”, no tiles	Server not running, or a foreground copy died. Tap the widget. Verify: curl -s http://127.0.0.1:8080/api/health.
“Address already in use”	A NetDeck copy is already running — fine; don’t start a second.
Windows app says “wmctrl not installed?”	Start via the widget (it launches X11 + xfwm4). A bare python3 start has no desktop for wmctrl. Also sudo apt install -y wmctrl.
GUI app opens small	Start via the widget so xfwm4 runs; NetDeck auto‑maximizes new windows.
cannot open display launching GUI	X11 not up. Tap the widget; confirm the Termux:X11 app shows a black screen.
App icons missing (emoji shown)	That app has no resolvable system icon — harmless, emoji is the fallback.
App names/descriptions in another language	Re‑deploy the latest netdeck.py (it ignores localized Name[xx]/Comment[xx]).
Boot doesn’t auto‑start	OxygenOS blocked it — enable Auto‑launch, or tap the widget once per reboot; permanent fix is the ADB step above.
postgres errors during apt	sudo dpkg --configure -a --force-all then sudo apt --fix-broken install -y.

---

Honest limitations

• Rootless = no kernel‑level powers. Wi‑Fi monitor mode, packet injection, raw‑socket tools (aircrack‑ng/airmon‑ng, etc.) do not work. NetDeck is for the userland toolset + learning.
• No GPU. GUI apps render via software over X11 — fine for light apps, sluggish for video/3D.
• Some modern GNOME apps won’t run (they need bubblewrap/Vulkan the proot can’t provide).
• GUI apps live on a second screen (Termux:X11). NetDeck launches/switches/closes them, but a web page can’t embed a Linux window — so you flip between NetDeck and the Termux:X11 app.
• OxygenOS kills background processes aggressively; full hands‑free needs the one‑time ADB fix.

---

Repo contents

netdeck.py              # the whole app — single file, Python stdlib only
scripts/NetDeck         # Termux:Widget launcher  -> ~/.shortcuts/NetDeck
scripts/start-netdeck   # Termux:Boot auto-start  -> ~/.termux/boot/start-netdeck
README.md               # this file
LICENSE                 # MIT
.gitignore

Credits

Built on the shoulders of Termux, Termux:X11, Kali NetHunter Rootless, xfwm4, and wmctrl. NetDeck itself is the single‑file Python launcher/console in this repo.

Disclaimer

For education and authorized testing only. Practice on legal targets (TryHackMe, HackTheBox, VulnHub, a local DVWA). Don’t point tools at systems you don’t own or lack permission to test.