Hack Tools APK2URL 2024-02-25

apk2url​

apk2url by n0mi1k is a tool that easily extracts URL and IP endpoints from an APK file and performs filtering into a .txt output. This is suitable for information gathering by the red team, penetration testers, and developers to quickly identify endpoints associated with an application.

NOTE: Why use apk2url? When compared with APKleaks, MobSF, and AppInfoScanner, apk2url identifies a significantly higher number of endpoints.

Running apk2url​

NOTE: apk2url requires apktool and jadx which can be easily installed with apt. Please refer to the dependencies section.


UPDATE v1.2 now supports directory input for multiple APKs!




You can also install directly for easy access by running ./install.sh.
After that, you can run apk2url anywhere:


By default there are 2 output files in the “endpoints” directory:

• <apkname>_endpoints.txt – Contains endpoints with full URL paths
• <apkname>_uniq.txt – Contains unique endpoint domains and IPs

By default, the program does not log the Android file name/path where endpoints are discovered.
To enable logging, run as follows:

Dependencies​

Use apt for easy installation of these tools required by apk2url:

• Kod:

  sudo apt install apktool
  sudo apt install jadx

Demonstration​