/apkleaks

Scanning APK file for URIs, endpoints & secrets.

Primary LanguagePythonApache License 2.0Apache-2.0

APKLeaks

version contributions

Scanning APK file for URIs, endpoints & secrets.

APKLeaks

Installation

To install APKLeaks, simply:

$ git clone https://github.com/dwisiswant0/apkleaks
$ cd apkleaks/
$ pip3 install -r requirements.txt

Dependencies

APKLeaks using jadx dissambler to decompile APK file. If it doesn't exist in your environment, it'll ask you to download or nah.

Usage

It's fairly simple,

$ python3 apkleaks.py -f ~/path/to/file.apk

Options

$ python3 apkleaks.py -h
usage: apkleaks [-h] -f FILE [-o OUTPUT] [-p PATTERN] [--json]

optional arguments:
  -h, --help            show this help message and exit
  -f FILE, --file FILE  APK file to scanning
  -o OUTPUT, --output OUTPUT
                        Write to file results (random if not set)
  -p PATTERN, --pattern PATTERN
                        Path to custom patterns JSON
  --json                Save as JSON format

In general, if you don't provide -o argument, then it will generate results file automatically.

Custom patterns can be added with the following flag --pattern /path/to/rules.json to provide sensitive search rules in the JSON file format. If not set, it'll use default patterns from regexes.json file.

Example patterns file:

// rules.json
{
  "Amazon AWS Access Key ID": "AKIA[0-9A-Z]{16}",
  ...
}
$ python apkleaks.py -f /path/to/file.apk -p rules.json -o ~/Documents/apkleaks-results.txt

Known Bugs

  • Empty results on Windows (#24).

Version

Current version is v2.0.6, and still development.

Legal

apkleaks is distributed under Apache 2.

Acknowledments

Since this tool includes some contributions, and I'm not an asshole, I'll publically thank the following users for their helps and resources: