syscallx-18113/apkx-hunter — explained in plain English
Analysis updated 2026-05-18
Scan an Android APK for hardcoded API keys, tokens, and passwords before release.
Run an OWASP MASVS security check against an app during a penetration test.
Review the permissions and native libraries an Android app bundles as part of a security assessment.
| syscallx-18113/apkx-hunter | freertos/freertos-smp-demos | nettitude/clr-stomp | |
|---|---|---|---|
| Stars | 70 | 68 | 72 |
| Language | C | C | C |
| Last pushed | — | 2025-02-16 | — |
| Maintenance | — | Stale | — |
| Setup difficulty | moderate | moderate | hard |
| Complexity | 3/5 | 3/5 | 5/5 |
| Audience | ops devops | developer | ops devops |
Figures from each repo's GitHub metadata at analysis time.
Linux only, and requires JADX, APKTool, and unzip, the bundled install.sh sets these up automatically.
APKX-Hunter is a command line tool for analyzing Android apps, aimed at security researchers, penetration testers, and people doing bug bounty work or reverse engineering. It is written entirely in the C programming language and works by examining an app's code and files without running the app itself, an approach known as static analysis. Given an Android app file, or a folder that has already been decompiled by tools like JADX or APKTool, the tool searches for things a security researcher cares about: embedded secrets such as API keys, tokens, and passwords, URLs and network endpoints referenced in the code, the permissions the app requests, and native libraries bundled inside it. It also includes a scanning mode built around OWASP MASVS, a widely used mobile security standard, covering fifteen categories such as weak cryptography, certificate pinning, root detection, and WebView security, with over 160 detection patterns in total. One notable feature is a small machine learning model, also written in C, that runs entirely offline with no internet connection or cloud service required. It scores each detected secret with a confidence probability, which helps a researcher decide which findings are worth investigating first instead of manually checking everything the scan turns up. The project states this model is data only, containing trained numerical weights rather than executable code. The tool currently only supports Linux, and installation is handled by a setup script that checks for and installs missing dependencies like JADX, APKTool, and unzip. Once installed, it is run from the command line against an APK file or a decompiled folder, with flags to choose fast or deep decompilation, and to select which specific scans to run, such as secrets, permissions, endpoints, or the full MASVS check. This is intended for authorized security assessment work: reviewing your own apps, or apps you have explicit permission to test, rather than for scanning software you do not own or have not been given permission to analyze.
A command-line static analysis tool for Android apps that scans decompiled code for secrets, endpoints, permissions, and OWASP MASVS security issues.
Mainly C. The stack also includes C, JADX, APKTool.
Setup difficulty is rated moderate, with roughly 30min to a first successful run.
Mainly ops devops.
This repo across BitVibe Labs
double-check against the repo, no cap.