Apkleaks

Apkleaks es una herramienta de análisis estático y auditoría de seguridad diseñada para extraer secretos hardcodeados, endpoints de API y datos sensibles de paquetes de aplicaciones Android. Opera como un escáner de secretos que analiza binarios compilados sin ejecutarlos para identificar posibles fugas de información y endpoints inseguros.

La herramienta utiliza un motor de extracción de datos basado en regex para identificar cadenas sensibles dentro de código descompilado. Soporta la personalización a través de patrones de búsqueda definidos en JSON y proporciona flags de configuración para ajustar el comportamiento del desensamblador subyacente.

El pipeline de análisis abarca la descompilación binaria, la extracción de texto y la coincidencia de patrones. Las fugas de seguridad y credenciales identificadas pueden exportarse a archivos de texto o JSON para su revisión offline.

Features

Mobile App Security Auditing - Performs security analysis of Android binaries to identify hardcoded secrets, API endpoints, and potential vulnerabilities.
Regex Pattern Matching - Employs regular expression pattern matching to identify sensitive strings and API endpoints within decompiled code.
Regex-Based Data Extractors - Uses custom regular expression patterns to identify and extract sensitive strings within decompiled code.
Android APK Analysis - Analyzes the internals of Android APKs without execution to detect embedded keys and private endpoints.
Static Binary Analysis - Performs static analysis on compiled binaries to determine program structure and identify leaked credentials without execution.
Android Security Auditors - Acts as a security auditor for analyzing APK files to identify potential information leaks.
APK Secret Scanners - Extracts hardcoded URIs, API endpoints, and sensitive secrets from Android application packages.
Credential Leak Detection - Detects leaked passwords, API keys, and tokens within decompiled application files using regex patterns.
Secrets Scanning - Detects and alerts on hardcoded credentials and sensitive API endpoints within Android application packages.
Mobile Application Scanners - Scans Android application packages to identify leaked credentials and URIs to assess the attack surface.
Analysis Pipelines - Implements a sequential workflow of decompilation, text extraction, and pattern matching to analyze application packages.
Code Pattern Searches - Allows the definition of custom regular expression patterns to identify proprietary keys and sensitive strings.
Search Pattern Schemas - Uses external JSON files to define the specific search patterns and rules used during the scanning process.
Mobile App Analysis Tools - Extracts URLs and sensitive information from APK files.
Reconnaissance Tools - Scanner for extracting URIs and secrets from APK files.
Mobile Application Analysis - Scanner for extracting URIs, endpoints, and secrets from APK files.
Mobile Security - Scans Android packages for hardcoded secrets and endpoints.
Static Analysis and Scanning - Scans APK files for hardcoded endpoints, URIs, and secrets.
Static Analysis Tools - Scan APK files for sensitive URIs, endpoints, and secrets.

Historial de estrellas

dwisiswant0apkleaks

Name: dwisiswant0/apkleaks
Author: dwisiswant0

View on GitHub

6,102 estrellas574 forksPythonApache-2.08 vistas

Apkleaks

Features

Mobile App Security Auditing - Performs security analysis of Android binaries to identify hardcoded secrets, API endpoints, and potential vulnerabilities.
Regex Pattern Matching - Employs regular expression pattern matching to identify sensitive strings and API endpoints within decompiled code.
Regex-Based Data Extractors - Uses custom regular expression patterns to identify and extract sensitive strings within decompiled code.
Android APK Analysis - Analyzes the internals of Android APKs without execution to detect embedded keys and private endpoints.
Static Binary Analysis - Performs static analysis on compiled binaries to determine program structure and identify leaked credentials without execution.
Android Security Auditors - Acts as a security auditor for analyzing APK files to identify potential information leaks.
APK Secret Scanners - Extracts hardcoded URIs, API endpoints, and sensitive secrets from Android application packages.
Credential Leak Detection - Detects leaked passwords, API keys, and tokens within decompiled application files using regex patterns.
Secrets Scanning - Detects and alerts on hardcoded credentials and sensitive API endpoints within Android application packages.
Mobile Application Scanners - Scans Android application packages to identify leaked credentials and URIs to assess the attack surface.
Analysis Pipelines - Implements a sequential workflow of decompilation, text extraction, and pattern matching to analyze application packages.
Code Pattern Searches - Allows the definition of custom regular expression patterns to identify proprietary keys and sensitive strings.
Search Pattern Schemas - Uses external JSON files to define the specific search patterns and rules used during the scanning process.
Mobile App Analysis Tools - Extracts URLs and sensitive information from APK files.
Reconnaissance Tools - Scanner for extracting URIs and secrets from APK files.
Mobile Application Analysis - Scanner for extracting URIs, endpoints, and secrets from APK files.
Mobile Security - Scans Android packages for hardcoded secrets and endpoints.
Static Analysis and Scanning - Scans APK files for hardcoded endpoints, URIs, and secrets.
Static Analysis Tools - Scan APK files for sensitive URIs, endpoints, and secrets.

Alternativas open-source a Apkleaks

Proyectos open-source similares, clasificados según cuántas características comparten con Apkleaks.

six2dez/reconftw
six2dez/reconftw
7,226Ver en GitHub
reconftw is an attack surface management framework and reconnaissance workflow orchestrator designed to automate the discovery, mapping, and monitoring of external digital assets. It operates as a modular tool-chain pipeline that coordinates a sequence of security tools to perform intelligence gathering and vulnerability scanning. The project distinguishes itself through a cloud-native deployment model that parallelizes scanning workloads across a fleet of remote VPS instances to bypass local resource constraints. It utilizes container-based environment isolation to ensure consistent executio
Shellbug-bountybugbountybugbounty-tool
Ver en GitHub7,226
zricethezav/gitleaks
zricethezav/gitleaks
27,739Ver en GitHub
Gitleaks is a static analysis security tool and secret detection engine designed to find hardcoded passwords, API keys, and authentication tokens. It functions as a Git secret scanner that analyzes both local file systems and Git commit history to prevent credential leaks. The tool distinguishes itself through a decoding pipeline that transforms base64 and hex strings into plaintext to find obfuscated secrets. It further reduces false positives using proximity-based validation and fingerprint-based suppression to filter out known or baseline findings. The system covers a broad range of detec
Go
Ver en GitHub27,739
google/android-classyshark
google/android-classyshark
7,565Ver en GitHub
Android Classyshark is a binary analysis toolset designed to extract structural data from Android executable files. It functions as a bytecode viewer and binary XML parser to analyze compiled Java and Android binaries. The project converts binary XML files into readable formats for the inspection of application manifests, layouts, and resource files. It also provides the ability to analyze class interfaces, members, and dependency counts without requiring access to the original source code. The toolset supports static analysis and the export of binary information into plain text formats for
Java
Ver en GitHub7,565
linkedin/qark
linkedin/qark
3,366Ver en GitHub
Tool to look for several security related Android application vulnerabilities
Python
Ver en GitHub3,366

Ver las 30 alternativas a Apkleaks

Preguntas frecuentes

¿Qué hace dwisiswant0/apkleaks?

¿Cuáles son las características principales de dwisiswant0/apkleaks?

Las características principales de dwisiswant0/apkleaks son: Mobile App Security Auditing, Regex Pattern Matching, Regex-Based Data Extractors, Android APK Analysis, Static Binary Analysis, Android Security Auditors, APK Secret Scanners, Credential Leak Detection.

¿Qué alternativas de código abierto existen para dwisiswant0/apkleaks?

Las alternativas de código abierto para dwisiswant0/apkleaks incluyen: six2dez/reconftw — reconftw is an attack surface management framework and reconnaissance workflow orchestrator designed to automate the… zricethezav/gitleaks — Gitleaks is a static analysis security tool and secret detection engine designed to find hardcoded passwords, API… google/android-classyshark — Android Classyshark is a binary analysis toolset designed to extract structural data from Android executable files. It… linkedin/qark — Tool to look for several security related Android application vulnerabilities. quark-engine/quark-engine. projectdiscovery/subfinder — Subfinder is a security reconnaissance framework designed for subdomain enumeration and attack surface management. It…