APKHunt - APKHunt is a comprehensive static code analysis to

项目说明

!Apkhunt: OWASP MAS Android security analysis

APKHunt | OWASP MAS Static Analyzer

Apkhunt is a local Android APK static-analysis workbench. It extracts manifest and code signals, maps static checks to OWASP MAS, captures a CycloneDX SBOM, and enriches package identities through OSV when that service is a. It does not MAS.

Static matches are in targets, not proof of runtime reachability or exploitation.

Latest release: See the new web workbench and Go CLI migration notes.

Screenshots

Scan intake — choose an APK and start a background scan.

!Apkhunt scan intake with APK upload and e o

Sa — review findings, se, co, and dependencies in one place.

!Apkhunt sa o for the InsecureBankv2 sample APK

Co ledger

Scanned files, rule events, and unknown work.

!Apkhunt co ledger showing archi, recovered files, rule e, and decompiler attempts

Entry point graph

Components, handlers, and nearby calls.

!Apkhunt entry point graph showing an exported activity and nearby code e

Threat model

Trust boundaries and review questions.

!Apkhunt threat model showing a receiver, its handler, and a nearby SMS call

Runtime tests

ADB readiness and component-specific tests.

!Apkhunt proof workbench showing device readiness and activity launch tests

API route e

Sa and scoped request controls.

!Apkhunt API route e with no hostname enabled for li

Secret review

TruffleHog candidates and state.

!Apkhunt secret review showing un candidates with collapsed

The screenshots use a local InsecureBankv2 sample scan. Secret remain collapsed, no API host is enabled for li, and static signals are not .

Run with Docker

Requirements:

* Docker Desktop with Docker Compose v2
* A unique application secret

From this directory, start Apkhunt with:

Open

The Compose stack stores uploads, decompiled output, reports, scan history, and worker status in named Docker . Stop it with docker compose down. Add -- only when you intentionally want to remove all saved scan data. An app restart interrupts a running worker; the restored status marks that scan as interrupted instead of claiming it is still running.

What a scan does

1. Accepts an APK up to 200 MB by default and its ZIP structure before queuing a background scan. The page returns immediately; the scan status dock follows na across the app.
2. Runs one scan at a time, uses JADX first, retries simplified JADX output after an auto-mode error, and retries bounded indi DEX files only if APK-le leave no usable Ja source. Per-DEX rescue uses --show-bad-code; that flag is optional for the initial APK passes because it significantly slowed the reference APK without resolving its method errors. Apktool supplies fallback manifest and resources when JADX returns errors. The dock shows completed processing stages and elapsed time. When JADX emits work-unit progress, that percentage applies only to the current JADX attempt, not to the whole scan.
3. E structural manifest rules and the manifest-linked Network Security Configuration, then recursively walks recovered JADX files for static rules. It reads eligible text files up to 10 MB each; only Ja, and XML currently ha rules. The report records scanned and skipped-file counts. Apktool fallback uses the manifest and selected resources; it also decodes Smali, whose file count is reported separately because Ja rules do not inspect Smali instructions.
4. Creates a CycloneDX SBOM with Syft when a.
5. Queries OSV once for each package URL and preser or unknown states instead of in a se.
6. Saves a separate static API route in and a TruffleHog credential-candidate snapshot. Android XML namespace URLs are ignored; query strings and token-like path segments are removed from route e. No extracted host is contacted. TruffleHog does not with pro unless the upload explicitly opts in. The secret review page reveals full candidate on request.
7. Saves a co ledger with APK member extraction states, reco rule events, skipped work, and decompiler attempts. It also saves a bounded entry point graph that connects manifest declarations to recovered handler-class e without claiming execution.
8. Saves the report, e snapshots, and SBOM together. Opening a saved page ne decompilers, route extraction, TruffleHog, or OSV.

Follow-up workbenches

* Co ledger: inspect which archi were copied, which recovered files and rules were e, and which paths remain skipped or unknown. Listing limits and failed JADX attempts stay .
* Entry point graph: review exported components and deep links beside handler, permission-check, WebView, API, and sensiti e. Code in the same class is a lead, not a proven call path.
* Threat model: open an interactive map for a sa path, with Android trust boundaries, linked rule findings, exact source references, STRIDE review questions, a counter-hypothesis, and a path-specific proof step. The model is deterministic and uses no AI. Download its JSON for further review. Cytoscape.js is included locally under the MIT license.
* Runtime proof: see whether ADB is ready, then launch an explicitly exported activity from its sa entry. The workbench checks the installed base APK hash before launch and records the ADB result. This is shell-identity launchability e, not proof of an app-to-app .
* API route e: choose one exact authorized hostname from source-code URL e, then run a bounded anonymous GET for its concrete HTTPS routes through curl. The same page sa, response body, and digest. A 2xx response is labeled as responding without credentials, not as a confirmed authorization failure. The older manual comparison page remains a at its direct URL for sa.

Included co

The current rule set has 39 checks (38 acti and one in rule) across storage, crypto, authentication, network, platform, code, and resilience-oriented Android surfaces. It includes review signals for manifest-linked cleartext and CA policy, expired certificate pins, unsafe WebView settings, FileProvider root paths, nested Intent forwarding, mutable PendingIntents, weak randomness, hardcoded keys, and AES-ECB use.

Every nontrivial static rule carries context checks and escalation conditions. Follow those before presenting a static signal as a .

Android security co review and proposed feature sections records the current gaps, e limits, and build priorities. There are no acti or privacy rules in the rule engine. TruffleHog runs separately and reports candidates in the Secret review page.

MAS co audit maps all 24 current controls to implemented signals, in, and missing checks. The app exposes the same capability states at /mas. No control is end to end by the current scanner.

E and limitations

Apkhunt is static-first. The optional proof workbench records device state and user obser but does not independently establish runtime reachability, network transmission, an authorization failure, or exploitability. A conclusion still needs the exact APK, an independently obser effect, and a causal negati.

OS is limited to saved, package identities. A component without a PURL is shown as not queryable; an una OS is shown as not queried.

The API e page does not contact hosts during a scan or page view. Its opt-in route probe makes one scoped request; it does not establish intended access policy or object ownership. A URL in decompiled code may be unused or intentionally public. TruffleHog scans recovered code/resources plus bounded raw APK members and extracted binary strings; members over 64 MB or a 512 MB total unpack budget are recorded as skipped. Its state means the provider confirmed the credential at check time; it does not establish permissions or application impact. An un match can be a false positive. Full candidate are stored in the local sa so they can be re in the UI; protect that state directory as sensitive data. Runtime obser and API response e are also stored under APKHUNT_STATE_DIR and are deleted with their scan.

Useful commands

The container runs as a non-root user and ships Syft 1.52.0, JADX 1.5.1, Apktool 2.10.0, TruffleHog 3.95.9, curl, and ADB. No separate host installation of those scan tools is needed. Compose binds the web UI to local loopback. Gunicorn uses one process with four request threads because the background queue and status are process-local.

Runtime tests require a connected, authorized Android device and an ADB ser from the container. Installing ADB in the image alone does not expose a macOS USB device to Docker Desktop. The static APK scan, dependency in, secret review, and sa do not require a device.

Configuration

En :

* SECRET_KEY — required by Docker Compose; use a unique random value.
* MAX_CONTENT_LENGTH — upload limit in bytes; defaults to 209715200 (200 MB).
* MAX_APK_ARCHI — ZIP member cap; defaults to 100000.
* MAX_APK_UNCOMPRESSED_SIZE — extracted-size cap; defaults to 2147483648 (2 GB).
* MAX_APK_COMPRESSION_RATIO — single-member compression-ratio cap; defaults to 100.
* JADX_THREADS — JADX parallelism; Docker Compose uses 4.
* DECOMPILER_TIMEOUT — Apktool time limit in seconds; defaults to 1200 (20 minutes).
* JADX_AUTO_TIMEOUT, JADX_SIMPLE_TIMEOUT — per-mode JADX limits in seconds; both default to 600.
* JADX_STALL_TIMEOUT — seconds without an advance in JADX's reported work units before switching modes; defaults to 180.
* JADX_SIMPLE_RETRY — retry simplified source recovery after auto mode returns errors; defaults to true. Simplified output is labeled partial co in the sa.
* JADX_SHOW_BAD_CODE — use MobSF's --show-bad-code flag on APK-level JADX attempts; defaults to false after a measured 299-second 102-second reference scan with the same 23 code errors and 9,500 rule-scanned Ja files.
* JADX_PER_DEX_RETRY — if APK-level JADX leaves no source, retry up to 32 valid DEX members in isolated output directories; defaults to true. These retries ne usable whole-APK source because path-count differences do not pro class co.
* JADX_DEX_TIMEOUT, JADX_PER_DEX_BUDGET — per-DEX process limit (120 seconds) and total retry budget (600 seconds). Skipped members and recovered source counts are saved in the report.
* TRUFFLEHOG_TIMEOUT — seconds allowed for secret detection and optional provider ; defaults to 240.

Project history and license

This replaces the original Go CLI with the local web workbench. The original CLI remains a in repository history. Apkhunt was originally de by Sumit Kalaria and Mrunal Chawda.

The project is distributed under GPL-3.0. The bundled Cytoscape.js graph library retains its MIT license.

项目信息

开发语言：Python

Star 数：987

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕APKHunt is a comprehensive static code analysis tool for Android apps that is based on the OWASP MASVS framework. Although APKHunt is intended primarily for mobile app developers and security testers, it can be used by anyone to identify and address potential security vulnerabilities in their code.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。