APP渗透|Frida过VPN和代理检测

import android.content.Context;import android.net.ConnectivityManager;import android.net.NetworkInfo;publicclassVpnDetector {publicstaticbooleanisVpnEnabled(Context context) {// 获取 ConnectivityManager 实例ConnectivityManager connectivityManager = (ConnectivityManager) context.getSystemService(Context.CONNECTIVITY_SERVICE);if (connectivityManager == null) {returnfalse;        }// 获取 VPN 类型的 NetworkInfoNetworkInfo vpnNetworkInfo = connectivityManager.getNetworkInfo(ConnectivityManager.TYPE_VPN);if (vpnNetworkInfo == null) {returnfalse;        }// 检查 VPN 是否已连接return vpnNetworkInfo.isConnectedOrConnecting();    }publicstaticvoidmain(String[] args) {// 示例用法Context context = getApplicationContext(); // 获取 Context 对象if (isVpnEnabled(context)) {System.out.println("VPN 已启用");        } else {System.out.println("VPN 未启用");        }    }}

import android.content.Context;import android.net.ConnectivityManager;import android.net.Network;import android.net.NetworkCapabilities;publicclassVpnDetector {publicstaticbooleanisVpnEnabled(Context context) {ConnectivityManagerconnectivityManager= (ConnectivityManager) context.getSystemService(Context.CONNECTIVITY_SERVICE);if (connectivityManager == null) {returnfalse;        }NetworkactiveNetwork= connectivityManager.getActiveNetwork();if (activeNetwork == null) {returnfalse;        }NetworkCapabilitiesnetworkCapabilities= connectivityManager.getNetworkCapabilities(activeNetwork);return networkCapabilities != null && networkCapabilities.hasTransport(NetworkCapabilities.TRANSPORT_VPN);    }publicstaticvoidmain(String[] args) {Contextcontext= getApplicationContext(); // 获取 Context 对象if (isVpnEnabled(context)) {            System.out.println("VPN 已启用");        } else {            System.out.println("VPN 未启用");        }    }}

functionwifi1_proxy_bypass(){Java.perform(()=>{var systemCls = Java.use('java.lang.System');        systemCls.getProperty.overload('java.lang.String').implementation = function (val) {var ret = this.getProperty(val);if (val == "http.proxyHost") {return""            }if (val == "http.proxyPort") {return"-1"// 这里改""/"0"/"-1"，我这里留的-1是之前金融项目好几家都是-1            }return ret        }    })}functionwifi2_proxy_bypass(){Java.perform(function () {varConnectivityManager = Java.use('android.net.ConnectivityManager');ConnectivityManager.getLinkProperties.implementation = function (network) {var linkProperties = this.getLinkProperties(network);if (linkProperties) {varProxyInfo = Java.use('android.net.ProxyInfo');var proxyInfo = ProxyInfo.$new(null, null, 0);                 linkProperties.setHttpProxy(proxyInfo);             }return linkProperties;        };    });}functionvpn1_bypass(){Java.perform(()=>{varConnectivityManager = Java.use('android.net.ConnectivityManager');ConnectivityManager.getNetworkInfo.overload('int').implementation = function (networkType) {var result = this.getNetworkInfo(networkType);if (networkType === ConnectivityManager.TYPE_VPN.value) {returnnull;            }return result;        };    })}functionvpn2_bypass() {Java.perform(() => {// 获取 NetworkCapabilities 类varNetworkCapabilities = Java.use('android.net.NetworkCapabilities');// Hook hasTransport 方法NetworkCapabilities.hasTransport.overload('int').implementation = function (transportType) {// 如果检测到 TRANSPORT_VPN，返回 falseif (transportType === NetworkCapabilities.TRANSPORT_VPN.value) {console.log("[*] VPN 检测被绕过");returnfalse;            }// 否则调用原始方法returnthis.hasTransport(transportType);        };console.log("[*] NetworkCapabilities.hasTransport 已 Hook");    });}functionbypass_proxy_main(){wifi1_proxy_bypass()  // wifi1+vpn1这两个组合居多，如果不行开wifi2和vpn2测试// wifi2_proxy_bypass()  vpn1_bypass()// vpn2_bypass()}setImmediate(bypass_proxy_main)