# ApkLeaks | Tool For Scanning APK file to Extract URIs, Endpoints & Secrets

**URL:** <https://onehack.st/t/apkleaks-tool-for-scanning-apk-file-to-extract-uris-endpoints-secrets/230626>\
**Category:** Tools & Scripts\
**Tags:** tools, tips-tricks, technology\
**Created:** [January 1, 2023, 7:26pm UTC](https://onehack.st/t/apkleaks-tool-for-scanning-apk-file-to-extract-uris-endpoints-secrets/230626 "2023-01-01T19:26:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\
**Post date:** [January 1, 2023, 7:26pm UTC](https://onehack.st/t/apkleaks-tool-for-scanning-apk-file-to-extract-uris-endpoints-secrets/230626/1 "2023-01-01T19:26:28Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/7/b/7beb8051196701352774fe6e8392c1f94a01bdc3.jpeg)

# APKLeaks

[![version](https://camo.githubusercontent.com/93c6830621aa8234e3f072eb0dd239f89f082d9a7be432e99cbb84051b4ecb90/68747470733a2f2f62616467652e667572792e696f2f67682f64776973697377616e743025326661706b6c65616b732e737667)](https://badge.fury.io/gh/dwisiswant0%2fapkleaks.svg) [![contributions](https://camo.githubusercontent.com/f5054ffcd4245c10d3ec85ef059e07aacf787b560f83ad4aec2236364437d097/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f636f6e747269627574696f6e732d77656c636f6d652d627269676874677265656e2e7376673f7374796c653d666c6174)](https://github.com/dwisiswant0/apkleaks/issues)

Scanning APK file for URIs, endpoints & secrets.

- [Installation](https://github.com/dwisiswant0/apkleaks#installation)
  - [from Pypi](https://github.com/dwisiswant0/apkleaks#from-pypi)
  - [from Source](https://github.com/dwisiswant0/apkleaks#from-source)
  - [from Docker](https://github.com/dwisiswant0/apkleaks#from-docker)

- [Usage](https://github.com/dwisiswant0/apkleaks#usage)
  - [Options](https://github.com/dwisiswant0/apkleaks#options)
    - [Output](https://github.com/dwisiswant0/apkleaks#output)
    - [Pattern](https://github.com/dwisiswant0/apkleaks#pattern)
    - [Pattern](https://github.com/dwisiswant0/apkleaks#pattern)
    - [Arguments (disassembler)](https://github.com/dwisiswant0/apkleaks#arguments-disassembler)

- [License](https://github.com/dwisiswant0/apkleaks#license)
- [Acknowledments](https://github.com/dwisiswant0/apkleaks#acknowledments)

* * *

## Installation

It’s fairly simple to install **APKLeaks** :

### from PyPi

$ pip3 install apkleaks

### from Source

Clone repository and install requirements:

$ git clone [https://github.com/dwisiswant0/apkleaks](https://github.com/dwisiswant0/apkleaks) $ cd apkleaks/ $ pip3 install -r requirements.txt

### from Docker

Pull the Docker image by running:

$ docker pull dwisiswant0/apkleaks:latest

### Dependencies

APKLeaks using [jadx](https://github.com/skylot/jadx) disassembler to decompile APK file. If it doesn’t exist in your environment, it’ll ask you to download.

## Usage

Simply,

$ apkleaks -f ~/path/to/file.apk # from Source $ python3 apkleaks.py -f ~/path/to/file.apk # or with Docker $ docker run -it --rm -v /tmp:/tmp dwisiswant0/apkleaks:latest -f /tmp/file.apk

## Options

Here are all the options it supports.

| **Argument** | **Description** | **Example** |
| --- | --- | --- |
| -f, --file | APK file to scanning | `apkleaks -f file.apk` |
| -o, --output | Write to file results _(random if not set)_ | `apkleaks -f file.apk -o results.txt` |
| -p, --pattern | Path to custom patterns JSON | `apkleaks -f file.apk -p custom-rules.json` |
| -a, --args | Disassembler arguments | `apkleaks -f file.apk --args="--deobf --log-level DEBUG"` |
| –json | Save as JSON format | `apkleaks -f file.apk -o results.json --json` |

### Output

In general, if you don’t provide `-o` argument, then it will generate results file automatically.

**NOTE:** By default it will also save the results in text format, use `--json` argument if you want JSON output format.

### Pattern

Custom patterns can be added with the following argument to provide sensitive _search rules_ in the JSON file format: `--pattern /path/to/custom-rules.json`. If not set, it’ll use default patterns from [regexes.json](https://github.com/dwisiswant0/apkleaks/blob/master/config/regexes.json) file.

Example patterns file:

// custom-rules.json { “Amazon AWS Access Key ID”: “AKIA[0-9A-Z]{16}”, … }

```auto
$ apkleaks -f /path/to/file.apk -p rules.json -o ~/Documents/apkleaks-results.txt

```

### Arguments (disassembler)

We give user complete discretion to pass the disassembler arguments. For example, if you want to activate threads in `jadx` decompilation process, you can add it with `-a/--args` argument, example: `--args="--threads-count 5"`.

```auto
$ apkleaks -f /path/to/file.apk -a "--deobf --log-level DEBUG"

```

**NOTE:** Please pay attention to the default disassembler arguments we use to prevent collisions.

## License

`apkleaks` is distributed under Apache 2.

## Acknowledments

Since this tool includes some contributions, and I’m not an asshole, I’ll publically thank the following users for their helps and resources:

- [@ndelphit](https://github.com/ndelphit) - for his inspiring `apkurlgrep`, that’s why this tool was made.
- [@dxa4481](https://github.com/dxa4481) and y’all who contribute to `truffleHogRegexes`.
- [@GerbenJavado](https://github.com/GerbenJavado) & [@Bankde](https://github.com/Bankde) - for awesome pattern to discover URLs, endpoints & their parameters from `LinkFinder`.
- [@tomnomnom](https://github.com/tomnomnom/gf) - a `gf` patterns.
- [@pxb1988](https://github.com/pxb1988) - for awesome APK dissambler `dex2jar`.
- [@subho007](https://github.com/ph4r05) for standalone APK parser.
- `SHA2048#4361` _(Discord user)_ that help me porting code to Python3.
- [@Ry0taK](https://github.com/Ry0taK) because he had reported an [OS command injection bug](https://github.com/dwisiswant0/apkleaks/security/advisories/GHSA-8434-v7xw-8m9x).
- [@dee\_\_see](https://twitter.com/dee__see) - for curated potentially sensitive tokens, `NotKeyHacks`.
- [All contributors](https://github.com/dwisiswant0/apkleaks/graphs/contributors).

## GitHub:

> **[GitHub - dwisiswant0/apkleaks: Scanning APK file for URIs, endpoints & secrets.](https://github.com/dwisiswant0/apkleaks)**
>
> Scanning APK file for URIs, endpoints & secrets.

---

<div class="post-metadata">

**Author:** ![Major\_Arsid](https://onehack.st/user_avatar/onehack.st/major_arsid/32/104599_2.png) [@Major\_Arsid](https://onehack.st/u/Major_Arsid)\
**Post date:** [January 2, 2023, 12:22am UTC](https://onehack.st/t/apkleaks-tool-for-scanning-apk-file-to-extract-uris-endpoints-secrets/230626/2 "2023-01-02T00:22:38Z")

</div>

Thanks for share

---

<div class="post-metadata">

**Author:** ![King\_Kira](https://onehack.st/user_avatar/onehack.st/king_kira/32/105041_2.png) [@King\_Kira](https://onehack.st/u/King_Kira)\
**Post date:** [January 3, 2023, 12:46am UTC](https://onehack.st/t/apkleaks-tool-for-scanning-apk-file-to-extract-uris-endpoints-secrets/230626/3 "2023-01-03T00:46:43Z")

</div>

Thanks you  
This gonna be useful