DOCSEARCHbyAlgolia
Submit Docs

APKLeaks

repository·master·Indexed 27 days ago

https://github.com/dwisiswant0/apkleaks

A security tool designed to scan Android APK files for sensitive information, including URIs, endpoints, and secrets such as API keys. It utilizes the jadx disassembler to decompile APKs and supports custom regex search patterns via JSON configuration.

Tokens
1K
Snippets
4
Records
8
Agent score
42%

What's inside APKLeaks

  1. Run APKLeaks scan

    master

    Use APKLeaks to scan an APK file for URIs, endpoints, and secrets. Depending on your installation method, use one of the following commands:

    Using PyPi/CLI

    apkleaks -f ~/path/to/file.apk

    Using Source

    python3 apkleaks.py -f ~/path/to/file.apk

    Using Docker

    When using Docker, ensure you mount the directory containing your APK file to a volume (e.g., /tmp) so the container can access it:

    docker run -it --rm -v /tmp:/tmp dwisiswant0/apkleaks:latest -f /tmp/file.apk
    apkleaks -f ~/path/to/file.apk

  2. Install APKLeaks

    master

    You can install APKLeaks using PyPi, from source, or via Docker.

    From PyPi

    pip3 install apkleaks

    From Source

    Clone the repository and install the required dependencies:

    git clone https://github.com/dwisiswant0/apkleaks
cd apkleaks/
pip3 install -r requirements.txt

    From Docker

    Pull the latest image:

    docker pull dwisiswant0/apkleaks:latest

    Note on Dependencies: APKLeaks requires the jadx disassembler to decompile APK files. If jadx is not found on your system, the tool will prompt you to download it.

    pip3 install apkleaks

  3. Pass arguments to the disassembler

    master

    APKLeaks allows you to pass arbitrary arguments to the underlying jadx disassembler using the -a or --args flag. This is useful for enabling features like deobfuscation or adjusting thread counts.

    Example: Enabling deobfuscation and setting log level:

    apkleaks -f /path/to/file.apk -a "--deobf --log-level DEBUG"

    Example: Increasing thread count:

    apkleaks -f /path/to/file.apk -a "--threads-count 5"
    apkleaks -f /path/to/file.apk -a "--deobf --log-level DEBUG"

  4. Configure custom search patterns

    master

    You can extend the default scanning rules by providing a custom JSON file via the --pattern argument. The JSON file should map a descriptive name to a regex pattern.

    Example custom-rules.json format:

    {
  "Amazon AWS Access Key ID": "AKIA[0-9A-Z]{16}"
}

    Usage:

    apkleaks -f /path/to/file.apk -p rules.json -o ~/Documents/apkleaks-results.txt
    apkleaks -f /path/to/file.apk -p rules.json -o ~/Documents/apkleaks-results.txt

  5. Reference APKLeaks CLI arguments

    master

    The following arguments are available for controlling the APKLeaks scan:

    ArgumentDescriptionExample
    -f, --fileThe APK file to scanapkleaks -f file.apk
    -o, --outputPath to write results to (a random filename is generated if not set)apkleaks -f file.apk -o results.txt
    -p, --patternPath to a custom patterns JSON fileapkleaks -f file.apk -p custom-rules.json
    -a, --argsArguments to pass directly to the disassemblerapkleaks -f file.apk --args="--deobf --log-level DEBUG"
    --jsonSave the output in JSON formatapkleaks -f file.apk -o results.json --json

  6. Use the APKLeaks class for APK scanning

    master

    The APKLeaks class is the core engine for scanning APK files for sensitive information (secrets, links, etc.) using regex patterns. It manages the decompilation process via jadx, executes scanning threads, and handles output in either plain text or JSON format.

    To use it programmatically, you must provide an args object (typically from argparse) that contains the following attributes:

    • file: Path to the target APK file.
    • json: Boolean indicating if output should be JSON.
    • args: String containing additional arguments for the jadx decompiler.
    • output: (Optional) Path to the output file.
    • pattern: (Optional) Path to a custom regex JSON configuration file.

    Key workflow methods:

    1. integrity(): Validates the APK file and ensures jadx is available (prompting to download if missing).
    2. decompile(): Runs jadx to decompile the APK into a temporary directory.
    3. scanning(): Iterates through regex patterns and spawns threads to find matches.
    4. cleanup(): Removes temporary files and saves the final results to the output file.

  8. Use the APKLeaks CLI to scan APK files

    master
    APKLeaks is a tool for scanning APK files for URIs, endpoints, and secrets. You can run it via the command line by providing a target APK file. The tool performs integrity checks, decompiles the APK, scans for patterns, and then cleans up temporary files.