APK decompiler and secrets scanner for Android security research. Automatically extract API keys, endpoints, tokens, and other leaked credentials from Android applications.
Works with .apk, .xapk, .dex, .jar, .class, .smali, .zip, .aar, .arsc, .aab files.
Perfect for apk2url extraction, apk leaks detection, and Android reverse engineering. Used by security researchers, penetration testers, and bug bounty hunters.
- Why APKprobe?
- Features
- Installation
- Quick Start
- Usage Examples
- Supported Decompilers
- Custom Rules
- Performance
- Alternatives
- Contributing
- FAQ
- License
Most Android apps contain hardcoded secrets. Developers often hide AWS keys, Firebase tokens, API credentials directly in the code, thinking obfuscation will protect them. It won't.
APKprobe decompiles the APK, runs deobfuscation, and scans everything with regex patterns to find:
- Cloud credentials (AWS, GCP, Azure)
- API keys (Stripe, Twilio, SendGrid, etc.)
- OAuth tokens & secrets
- Database connection strings
- Private keys & certificates
Find Hidden Endpoints (apk2url)
Extract all URLs, API endpoints, and backend routes from any Android app. Perfect for:
- Bug bounty recon
- Penetration testing
- Attack surface mapping
Discover forgotten dev/staging endpoints, internal APIs, and admin panels that shouldn’t be public.
Quickly locate security-critical code:
- SSL pinning implementations
- Root detection functions
- Anti-tampering checks
- Encryption routines
Speed up your Frida scripts by knowing exactly where to hook.
- Multi-decompiler support — JADX, APKTool, CFR, Procyon, Krakatau, Fernflower
- Automatic deobfuscation — better results on protected apps
- 250+ built-in patterns — AWS, GCP, Azure, generic API keys, URLs
- Custom rules — JSON, YAML, TOML, gitleaks format
- Batch processing — scan hundreds of APKs at once
- Fast — parallel decompilation and scanning
- Multiple output formats — JSON, YAML, text
git clone https://github.com/wadingporque/apkprobe.git
cd apkprobe
python setup.py installOr install in development mode:
pip install -e .Scan an APK for secrets:
apkprobe target.apkExtract URLs and endpoints:
apkprobe target.apk -r endpointsScan for AWS/cloud credentials:
apkprobe target.apk -r aws gcp azureapkprobe app.apkapkprobe app1.apk app2.apk app3.xapkapkprobe --jadx --apktool --cfr app.apkapkprobe app.apk -o results.json -f jsonapkprobe app.apk -r /path/to/rules.jsonapkprobe -r aws endpoints -o output.yaml -f yaml -c *.apkAll CLI options
apkprobe [OPTIONS] FILES...
Options:
-r, --rules FILES Rule files or built-in sets (aws, gcp, azure, endpoints, etc.)
-o, --output FILE Output file path
-f, --format FORMAT Output format: json, yaml, text
-g, --groupby TYPE Group by: file, locator, both
-c, --cleanup Remove decompiled files after scan
-q, --quiet Suppress output
Decompilers:
--jadx, -J Use JADX (default)
--apktool, -A Use APKTool
--cfr, -C Use CFR
--procyon, -P Use Procyon
--krakatau, -K Use Krakatau
--fernflower, -F Use Fernflower
Advanced:
-d, --deobfuscate Enable deobfuscation
-w, --working-dir DIR Working directory
--timeout SECONDS Scan timeout
| Decompiler | Type | Notes |
|---|---|---|
| JADX | Java | Default, best for most APKs |
| APKTool | Smali | Resources + manifest |
| CFR | Java | Good for obfuscated code |
| Procyon | Java | Alternative decompiler |
| Krakatau | Java | Handles edge cases |
| Fernflower | Java | IntelliJ's decompiler |
Use multiple decompilers together for maximum coverage — different tools handle obfuscation differently.
APKprobe supports multiple rule formats. Create your own or use existing pattern databases.
| Format | Extension |
|---|---|
| APKprobe JSON | .json |
| Gitleaks | .toml |
| secret-patterns-db | .yaml |
| Simple key-value | .json |
{
"id": "stripe-api-key",
"name": "Stripe API Key",
"pattern": "sk_live_[a-zA-Z0-9]{24}",
"confidence": "high"
}aws— AWS credentials, S3 buckets, ARNsgcp— Google Cloud API keys, service accountsazure— Azure connection strings, keysendpoints— URLs, API routes, webhooksgeneric— Common API key patternsgitleaks— Full gitleaks ruleset
APKprobe uses parallel processing for both decompilation and scanning.
# Use 8 workers for scanning
apkprobe app.apk -smw 8
# Use multiprocessing instead of threading
apkprobe app.apk -sct processTips:
- Decompilation is RAM-heavy — limit workers on low-memory systems
- Scanning is CPU-bound — more workers = faster results
- Use
--cleanupto save disk space on batch jobs
APKprobe is similar to these tools:
- apkleaks — Python, regex-based
- jadx — Java decompiler (no scanning)
- apktool — Smali disassembler
- MobSF — Full mobile security framework
APKprobe combines decompilation + scanning in one tool with support for multiple decompilers.
Found a bug? Have an idea? PRs welcome.
git clone https://github.com/wadingporque/apkprobe.git
cd apkprobe
python setup.py installUse APKprobe with the endpoints ruleset to extract all URLs, API endpoints, and backend routes:
apkprobe app.apk -r endpoints -o urls.jsonThis performs apk2url extraction automatically after decompilation.
APKprobe scans decompiled code for hardcoded secrets using 250+ regex patterns:
apkprobe app.apk -r aws gcp azureIt detects AWS keys, Firebase tokens, Stripe keys, and other leaked credentials.
APKprobe supports multiple decompilers — use them together for best results:
apkprobe --jadx --apktool --cfr app.apkDifferent decompilers handle obfuscation differently, so combining them increases coverage.
Yes. APKprobe is designed for Android penetration testing and bug bounty recon. It quickly maps the attack surface by extracting endpoints, API keys, and hardcoded secrets from target apps.
- OWASP Mobile Security Testing Guide — comprehensive mobile app security testing
- Android Security Documentation — official security best practices
- HackerOne Android Bug Bounty Programs — find Android targets
wadingporque
MIT License. See LICENSE for details.