Scanning APK file for URIs, endpoints & secrets.

• Installation
  • from Pypi
  • from Source
  • from Docker
• Usage
  • Options
    • Output
    • Pattern
    • Pattern
    • Arguments (disassembler)
• License
• Acknowledments

It's fairly simple to install APKLeaks:

$ pip3 install apkleaks

Clone repository and install requirements:

$ git clone https://github.com/dwisiswant0/apkleaks
$ cd apkleaks/
$ pip3 install -r requirements.txt

Pull the Docker image by running:

$ docker pull dwisiswant0/apkleaks:latest

APKLeaks using jadx disassembler to decompile APK file. If it doesn't exist in your environment, it'll ask you to download.

Simply,

$ apkleaks -f ~/path/to/file.apk
# from Source
$ python3 apkleaks.py -f ~/path/to/file.apk
# or with Docker
$ docker run -it --rm -v /tmp:/tmp dwisiswant0/apkleaks:latest -f /tmp/file.apk

Here are all the options it supports.

In general, if you don't provide -o argument, then it will generate results file automatically.

NOTE: By default it will also save the results in text format, use --json argument if you want JSON output format.

Custom patterns can be added with the following argument to provide sensitive search rules in the JSON file format: --pattern /path/to/custom-rules.json. If not set, it'll use default patterns from regexes.json file.

Example patterns file:

// custom-rules.json
{
  "Amazon AWS Access Key ID": "AKIA[0-9A-Z]{16}",
  ...
}

$ apkleaks -f /path/to/file.apk -p rules.json -o ~/Documents/apkleaks-results.txt

We give user complete discretion to pass the disassembler arguments. For example, if you want to activate threads in jadx decompilation process, you can add it with -a/--args argument, example: --args="--threads-count 5".

$ apkleaks -f /path/to/file.apk -a "--deobf --log-level DEBUG"

NOTE: Please pay attention to the default disassembler arguments we use to prevent collisions.

apkleaks is distributed under Apache 2.

Since this tool includes some contributions, and I'm not an asshole, I'll publically thank the following users for their helps and resources:

• @ndelphit - for his inspiring apkurlgrep, that's why this tool was made.
• @dxa4481 and y'all who contribute to truffleHogRegexes.
• @GerbenJavado & @Bankde - for awesome pattern to discover URLs, endpoints & their parameters from LinkFinder.
• @tomnomnom - a gf patterns.
• @pxb1988 - for awesome APK dissambler dex2jar.
• @subho007 for standalone APK parser.
• SHA2048#4361 (Discord user) that help me porting code to Python3.
• @Ry0taK because he had reported an OS command injection bug.
• All contributors.