git404hub

what is apkx-hunter fr?

syscallx-18113/apkx-hunter — explained in plain English

Analysis updated 2026-05-18

70CAudience · ops devopsComplexity · 3/5Setup · moderate

tl;dr

A command-line static analysis tool for Android apps that scans decompiled code for secrets, endpoints, permissions, and OWASP MASVS security issues.

vibe map

mindmap
  root((repo))
    What it does
      Static analysis of APKs
      Finds embedded secrets
      Runs MASVS checks
    Tech stack
      C
      JADX
      APKTool
    Use cases
      Bug bounty hunting
      Penetration testing
      Secret scanning
    Audience
      Security researchers
      Pentesters

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

what do people make with this?

VIBE 1

Scan an Android APK for hardcoded API keys, tokens, and passwords before release.

VIBE 2

Run an OWASP MASVS security check against an app during a penetration test.

VIBE 3

Review the permissions and native libraries an Android app bundles as part of a security assessment.

what's the stack?

CJADXAPKTool

how it stacks up fr

syscallx-18113/apkx-hunterfreertos/freertos-smp-demosnettitude/clr-stomp
Stars706872
LanguageCCC
Last pushed2025-02-16
MaintenanceStale
Setup difficultymoderatemoderatehard
Complexity3/53/55/5
Audienceops devopsdeveloperops devops

Figures from each repo's GitHub metadata at analysis time.

how do i run it?

Difficulty · moderate time til it works · 30min

Linux only, and requires JADX, APKTool, and unzip, the bundled install.sh sets these up automatically.

in plain english

APKX-Hunter is a command line tool for analyzing Android apps, aimed at security researchers, penetration testers, and people doing bug bounty work or reverse engineering. It is written entirely in the C programming language and works by examining an app's code and files without running the app itself, an approach known as static analysis. Given an Android app file, or a folder that has already been decompiled by tools like JADX or APKTool, the tool searches for things a security researcher cares about: embedded secrets such as API keys, tokens, and passwords, URLs and network endpoints referenced in the code, the permissions the app requests, and native libraries bundled inside it. It also includes a scanning mode built around OWASP MASVS, a widely used mobile security standard, covering fifteen categories such as weak cryptography, certificate pinning, root detection, and WebView security, with over 160 detection patterns in total. One notable feature is a small machine learning model, also written in C, that runs entirely offline with no internet connection or cloud service required. It scores each detected secret with a confidence probability, which helps a researcher decide which findings are worth investigating first instead of manually checking everything the scan turns up. The project states this model is data only, containing trained numerical weights rather than executable code. The tool currently only supports Linux, and installation is handled by a setup script that checks for and installs missing dependencies like JADX, APKTool, and unzip. Once installed, it is run from the command line against an APK file or a decompiled folder, with flags to choose fast or deep decompilation, and to select which specific scans to run, such as secrets, permissions, endpoints, or the full MASVS check. This is intended for authorized security assessment work: reviewing your own apps, or apps you have explicit permission to test, rather than for scanning software you do not own or have not been given permission to analyze.

prompts (copy fr)

prompt 1
Help me install Apkx-Hunter's dependencies using install.sh on Linux.
prompt 2
Explain how to run Apkx-Hunter's --masvs scan against a decompiled Android app folder.
prompt 3
Show me how to use Apkx-Hunter's --secrets and --endpoints flags together on an APK file.

Frequently asked questions

what is apkx-hunter fr?

A command-line static analysis tool for Android apps that scans decompiled code for secrets, endpoints, permissions, and OWASP MASVS security issues.

What language is apkx-hunter written in?

Mainly C. The stack also includes C, JADX, APKTool.

How hard is apkx-hunter to set up?

Setup difficulty is rated moderate, with roughly 30min to a first successful run.

Who is apkx-hunter for?

Mainly ops devops.

peek the repo → explain another one

This repo across BitVibe Labs

double-check against the repo, no cap.