3 releases 11 tags

RSS feed

• v11 bab03c7d09

  Compare

  Detect VPN server IPs from /proc/net established connections

  Ghost released this 2026-04-07 19:48:08 +03:00 | 12 commits to main since this release

  New: ProcNetScanner.scanEstablishedConnections() parses /proc/net/tcp,
  tcp6, udp, udp6 for ESTABLISHED connections to public IPs. Identifies
  VPN servers by port heuristics:

  • UDP :51820 → WireGuard/Amnezia (90% confidence)
  • TCP :443 → VLESS/Trojan (50% confidence)
  • UDP :1194 → OpenVPN (80% confidence)
  • IPSec :500/:4500, L2TP :1701, PPTP :1723

  This works for ALL VPN types including Amnezia VPN, WireGuard, OpenVPN
  which don't expose SOCKS5 proxy on localhost.

  Integrated as Phase 0.6 in ScanOrchestrator between /proc/net/tcp
  listening scan and DirectSigns check. Shows CRITICAL finding with
  server IPs, ports, protocols, and server type guesses.

  Updated report and SummaryCard with critical findings count.

  Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads