Defensive security tool demonstrating how spyware can exploit
unauthenticated SOCKS5 proxies on localhost to discover VPN exit IPs.
Modules:
- PortScanner: parallel TCP scan of 127.0.0.1 (known ports + full range)
- Socks5Probe: SOCKS5/HTTP/gRPC handshake detection with auth check
- ExitIPResolver: exit IP discovery through vulnerable SOCKS5
- XrayAPIDetector: xray gRPC API (HandlerService) detection
- DeviceInfoCollector: VPN status, interfaces, direct IP
- GeoLocator: IP geolocation via ip-api.com
- ScanOrchestrator: pipeline orchestrator
- Jetpack Compose UI with Material 3
GitHub Actions CI for automated APK builds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1ef08e9ab7