I am working on an Android Java application that performs a vulnerability scan of the network where the mobile device is. Since I cannot install any type of vulnerability scan tool on Android I would like to send the vulnerability scan packets from a back-end server (running open-vas) to my android device and then make the android device forward them to the destination hosts inside his network. The easiest way to do that would be to create a VPN Server on the android device, but I don't think it's possible with the VpnService APIs. From what I have found it looks like someone managed to forward traffic with VPN Service: Android VpnService - How to forward intercepted internet traffic.

Another idea was to create a sort of packet wrapping: I can wrap the original packet coming from the back-end server inside a standard TCP packet, send it to the android device, unwrap it and forward it to the host inside the device's network. Although I don't know if this would really work in my case for 2 main reasons:

  1. I will probably receive RAW packets from the server (since vulnerability scanners forges specific RAW packets for vulnerability testing) and Java does not have any support for manipulating packets
  2. Even if I am able to unwrap the packet I will still have a RAW packet to send and from what I have seen Java does not have any support for RAW sockets for security reasons.

So do you guys have an idea if there is a way to create a VPN Server on Android to do this remote vulnerability scan?


PS Maybe rooting the device will give some more alternatives but I am reserving this as last chance.

  • Package unwrapping on application layer is equivalent to creating the packages and sending it. If you can't forge arbitrary packets this won't work. And the VPN solution will give you access to the Android device but I don't think that you will be able to access the network the Android device is in (otherwise the VPN would have to run in network bridging mode).
    – Robert
    Aug 2 at 9:39
  • @Robert thank you very much for the answer. I agree with you in both cases...I have to investigate if arbitrary packets forgery is possible in Android but I am pretty sure that it is not. For now the only solution I see is root the device and install the binary of an OpenVPN server like you would do on a Linux Machine.
    – Leonardo
    Aug 2 at 10:17
  • I would install Kali Nethunter for Android with root. That should allow arbitrary packet forging as well as sniffing via Wireshark.
    – Robert
    Aug 2 at 10:30


You must log in to answer this question.

Browse other questions tagged .