Summary
This is a security research tool that demonstrates a serious localhost vulnerability in popular Android VPN clients like v2rayNG, NekoBox, and Clash. Any app with basic INTERNET permission can scan localhost ports, detect unauthenticated SOCKS5 proxies exposed by these VPN apps, and tunnel through them to reveal your real exit IP and server config. The implementation is thorough: it fingerprints VPN clients by port patterns (10808/10809 for xray, 7890/9090 for Clash), reads /proc/net/tcp to find listening ports without root, checks hidden Android capabilities like IS_VPN, and does MTU analysis. If you're building VPN clients or need to audit mobile privacy assumptions, this shows exactly how exposed localhost services become attack surfaces. The full detection pipeline runs 14 phases from interface detection to geolocation.
Install to Claude Code
npx -y skills add aradotso/trending-skills --skill yourvpndead-vpn-detection --agent claude-codeInstalls into .claude/skills of the current project.
Keep your Mac awake while Claude Code and 40+ AI agents run. Sleeps when they're idle.
One time payment $9 →
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →
Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →
On Capafy, your Skill runs online 24/7 as an agent product, and you get paid every time someone uses it.
Start earning →
Files
SKILL.md
Select a file.
Featured
Keep your Mac awake while Claude Code and 40+ AI agents run. Sleeps when they're idle.
One time payment $9 →Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →On Capafy, your Skill runs online 24/7 as an agent product, and you get paid every time someone uses it.
Start earning →First SeenJun 3, 2026
