{"id":13456067,"url":"https://github.com/dwisiswant0/apkleaks","last_synced_at":"2025-05-11T03:49:52.341Z","repository":{"id":37712522,"uuid":"267958226","full_name":"dwisiswant0/apkleaks","owner":"dwisiswant0","description":"Scanning APK file for URIs, endpoints \u0026 secrets.","archived":false,"fork":false,"pushed_at":"2025-03-26T10:17:52.000Z","size":118,"stargazers_count":5266,"open_issues_count":23,"forks_count":511,"subscribers_count":82,"default_branch":"master","last_synced_at":"2025-05-11T03:49:47.735Z","etag":null,"topics":["android-security","apk","apk-parser","bugbounty","mobile-security","reverse-engineering","scanning-apk","static-analysis"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dwisiswant0.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":".github/SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null},"funding":{"github":["dwisiswant0"]}},"created_at":"2020-05-29T21:26:13.000Z","updated_at":"2025-05-10T19:29:07.000Z","dependencies_parsed_at":"2025-02-04T10:34:09.042Z","dependency_job_id":"159d2024-9a91-4061-a191-9d2b2371b95f","html_url":"https://github.com/dwisiswant0/apkleaks","commit_stats":{"total_commits":152,"total_committers":13,"mean_commits":"11.692307692307692","dds":"0.16447368421052633","last_synced_commit":"3202df9b9fd99645142b62810184f708fe2b6153"},"previous_names":[],"tags_count":29,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dwisiswant0%2Fapkleaks","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dwisiswant0%2Fapkleaks/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dwisiswant0%2Fapkleaks/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dwisiswant0%2Fapkleaks/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dwisiswant0","download_url":"https://codeload.github.com/dwisiswant0/apkleaks/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253514567,"owners_count":21920334,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android-security","apk","apk-parser","bugbounty","mobile-security","reverse-engineering","scanning-apk","static-analysis"],"created_at":"2024-07-31T08:01:15.728Z","updated_at":"2025-05-11T03:49:52.325Z","avatar_url":"https://github.com/dwisiswant0.png","language":"Python","funding_links":["https://github.com/sponsors/dwisiswant0"],"categories":["HarmonyOS","Python","Android","Инструменты анализа","Weapons","Python (1887)","Offensive (ATT\u0026CK tactics)","Tools","Companion Tools"],"sub_categories":["Windows Manager","Tools","🔍 Reconnaissance","Static Analysis Tools","Android","Mobile Security","[UNI](https://wikipedia.org/wiki/Uniform_Resource_Identifier) Tools"],"readme":"# APKLeaks\n[![version](https://badge.fury.io/gh/dwisiswant0%2fapkleaks.svg)](https://badge.fury.io/gh/dwisiswant0%2fapkleaks.svg)\n[![contributions](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/dwisiswant0/apkleaks/issues)\n\nScanning APK file for URIs, endpoints \u0026 secrets.\n\n\u003cimg src=\"https://user-images.githubusercontent.com/25837540/111927529-a4ade080-8ae3-11eb-800a-b764ab1242e1.jpg\" alt=\"APKLeaks\"\u003e\n\n- [Installation](#installation)\n  - [from Pypi](#from-pypi)\n  - [from Source](#from-source)\n  - [from Docker](#from-docker)\n- [Usage](#usage)\n  - [Options](#options)\n    - [Output](#output)\n    - [Pattern](#pattern)\n    - [Arguments (for disassembler)](#arguments-for-disassembler)\n- [License](#license)\n- [Acknowledments](#acknowledments)\n\n---\n\n## Installation\n\nIt's fairly simple to install **APKLeaks**:\n\n### from PyPi\n\n```bash\n$ pip3 install apkleaks\n```\n\n### from Source\n\nClone repository and install requirements:\n\n```bash\n$ git clone https://github.com/dwisiswant0/apkleaks\n$ cd apkleaks/\n$ pip3 install -r requirements.txt\n```\n\n### from Docker\n\nPull the Docker image by running:\n\n```bash\n$ docker pull dwisiswant0/apkleaks:latest\n```\n\n### Dependencies\n\nThe APKLeaks utilizes the [jadx](https://github.com/skylot/jadx) disassembler to decompile APK files. If jadx is not present in your system, it will prompt you to download it.\n\n## Usage\n\nSimply,\n\n```bash\n$ apkleaks -f ~/path/to/file.apk\n# from Source\n$ python3 apkleaks.py -f ~/path/to/file.apk\n# or with Docker\n$ docker run -it --rm -v /tmp:/tmp dwisiswant0/apkleaks:latest -f /tmp/file.apk\n```\n\n## Options\n\nHere are all the options it supports.\n\n| **Argument**  \t| **Description**                             \t| **Example**                                                   |\n|---------------\t|---------------------------------------------\t|-------------------------------------------------------------  |\n| -f, --file    \t| APK file to scanning                        \t| `apkleaks -f file.apk`                                        |\n| -o, --output  \t| Write to file results _(random if not set)_ \t| `apkleaks -f file.apk -o results.txt`                         |\n| -p, --pattern \t| Path to custom patterns JSON                \t| `apkleaks -f file.apk -p custom-rules.json`                   |\n| -a, --args    \t| Disassembler arguments                      \t| `apkleaks -f file.apk --args=\"--deobf --log-level DEBUG\"`     |\n|     --json      | Save as JSON format                         \t| `apkleaks -f file.apk -o results.json --json`                 |\n\n### Output\n\nIn general, if you don't provide `-o` argument, then it will generate results file automatically.\n\n\u003e [!TIP]\n\u003e By default it will also save the results in text format, use `--json` argument if you want JSON output format.\n\n### Pattern\n\nCustom patterns can be added with the following argument to provide sensitive _search rules_ in the JSON file format: `--pattern /path/to/custom-rules.json`. If no file is set, the tool will use the default patterns found in [regexes.json](https://github.com/dwisiswant0/apkleaks/blob/master/config/regexes.json) file.\n\nHere's an example of what a custom pattern file could look like:\n\n```json\n// custom-rules.json\n{\n  \"Amazon AWS Access Key ID\": \"AKIA[0-9A-Z]{16}\",\n  // ...\n}\n```\n\nTo run the tool using these custom rules, use the following command:\n\n```bash\n$ apkleaks -f /path/to/file.apk -p rules.json -o ~/Documents/apkleaks-results.txt\n```\n\n### Arguments (disassembler)\n\nWe give user complete discretion to pass the disassembler arguments. For example, if you want to activate threads in `jadx` decompilation process, you can add it with `-a/--args` argument, example: `--args=\"--threads-count 5\"`.\n\n```\n$ apkleaks -f /path/to/file.apk -a \"--deobf --log-level DEBUG\"\n```\n\n\u003e [!WARNING]\n\u003e Please pay attention to the default disassembler arguments we use to prevent collisions.\n\n## License\n\n`apkleaks` is distributed under Apache 2.\n\n## Acknowledments\n\nSince this tool includes some contributions, and I'm not an asshole, I'll publically thank the following users for their helps and resources:\n\n- [@ndelphit](https://github.com/ndelphit) - for his inspiring `apkurlgrep`, that's why this tool was made.\n- [@dxa4481](https://github.com/dxa4481) and y'all who contribute to `truffleHogRegexes`.\n- [@GerbenJavado](https://github.com/GerbenJavado) \u0026 [@Bankde](https://github.com/Bankde) - for awesome pattern to discover URLs, endpoints \u0026 their parameters from `LinkFinder`.\n- [@tomnomnom](https://github.com/tomnomnom/gf) - a `gf` patterns.\n- [@pxb1988](https://github.com/pxb1988) - for awesome APK dissambler `dex2jar`.\n- [@subho007](https://github.com/ph4r05) for standalone APK parser.\n- `SHA2048#4361` _(Discord user)_ that help me porting code to Python3.\n- [@Ry0taK](https://github.com/Ry0taK) because he had reported an [OS command injection bug](https://github.com/dwisiswant0/apkleaks/security/advisories/GHSA-8434-v7xw-8m9x).\n- [@dee__see](https://twitter.com/dee__see) - for curated potentially sensitive tokens, `NotKeyHacks`.\n- [All contributors](https://github.com/dwisiswant0/apkleaks/graphs/contributors).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdwisiswant0%2Fapkleaks","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdwisiswant0%2Fapkleaks","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdwisiswant0%2Fapkleaks/lists"}