Repolode
Submit
dwisiswant0

dwisiswant0/apkleaks

A Python command-line tool that decompiles Android APK files with jadx and scans them for URLs, endpoints and hardcoded secrets.

View on GitHub
Stars
6,356
Forks
599
Open issues
26
Last commit
last year

What is it?

APKLeaks is a static analysis tool for Android application packages. It takes an APK file, decompiles it with the jadx disassembler, and searches the resulting source for URIs, API endpoints and potentially sensitive values such as access keys and tokens. Results are written to a text or JSON file.

The search is driven by a set of regular expression rules. The default rules are stored in a JSON file, and users can supply their own rules file with the pattern option to target specific secrets or endpoint formats. Extra arguments can be passed through to jadx, for example to enable deobfuscation or set thread counts.

The tool can be installed from PyPI, run from source, or used through a Docker image. If jadx is not already on the system, the tool prompts to download it.

Key features

  • 01Decompiles APK files using the jadx disassembler.
  • 02Scans decompiled code for URIs, endpoints and secret-like strings.
  • 03Supports custom regex rule files via a JSON pattern option.
  • 04Outputs results as plain text or JSON.
  • 05Passes custom arguments through to jadx.
  • 06Available via PyPI, source, and Docker.

Use cases

  • Reviewing an Android app for hardcoded API keys or tokens before release.
  • Mapping backend endpoints and URLs used by a mobile app during a security assessment.
  • Hunting for exposed secrets as part of bug bounty research on Android apps.

Quick start

  1. 1

    Install from PyPI

    pip3 install apkleaks
  2. 2

    Scan an APK file

    apkleaks -f ~/path/to/file.apk

Things to know

  • Relies on the jadx disassembler, which is prompted for download if not present.
  • Results are regex-based pattern matches, so expect possible false positives.

Topics

#android-security#apk#static-analysis#reverse-engineering#mobile-security#bug-bounty#apk-parser#bugbounty#scanning-apk

FAQ

What is apkleaks?
A Python command-line tool that decompiles Android APK files with jadx and scans them for URLs, endpoints and hardcoded secrets. APKLeaks is a static analysis tool for Android application packages. It takes an APK file, decompiles it with the jadx disassembler, and searches the resulting source for URIs, API endpoints and potentially sensitive values such as access keys and tokens. Results are written to a text or JSON file.
Is apkleaks free to use? What license does it have?
apkleaks is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is apkleaks still maintained?
No commits for 6+ months. The last commit to apkleaks was on Aug 20, 2025.
What can I use apkleaks for?
Reviewing an Android app for hardcoded API keys or tokens before release. Mapping backend endpoints and URLs used by a mobile app during a security assessment. Hunting for exposed secrets as part of bug bounty research on Android apps.
How do I install apkleaks?
Install from PyPI: pip3 install apkleaks Scan an APK file: apkleaks -f ~/path/to/file.apk
Where can I get apkleaks?
The source code and installation instructions are on GitHub: https://github.com/dwisiswant0/apkleaks

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects