APKra

    ___    ____  __ __
   /   |  / __ \/ //_  _________
  / /| | / /_/ / ,<   / ___/ __ `
 / ___ |/ ____/ /| | / /  / /_/ /
/_/  |_/_/   /_/ |_|/_/   \__,_/

APKra is a fast, lightweight Android APK static analyzer for penetration testers. It runs as a Python CLI, works fully offline, and never calls external APIs.

It is built for quick APK triage: unpack, parse, decompile when possible, scan, report.

Why APKra?

🔍 Fast CLI workflow
Drop an APK, get results. No browser, no Docker, no setup overhead.

🛡️ Offline by design
APKra does not upload APKs, query cloud APIs, or leak target artifacts.

⚙️ Graceful JADX fallback
If jadx is present, APKra scans decompiled Java output. If JADX fails or is missing, APKra still extracts the APK and parses the manifest with androguard.

📄 Terminal and HTML reports
Many lightweight scripts stop at terminal output. APKra gives you clean terminal triage and a dark HTML report you can hand to yourself later.

What APKra Finds

Category	What it detects	Severity
Manifest Analyzer	Debuggable builds, allowBackup, exported components, dangerous permissions, missing Network Security Config	Critical to Low
Secret Finder	Google API keys, Firebase URLs, hardcoded crypto keys, AWS keys, GitHub tokens, Slack tokens	Critical / High
Network Checker	Cleartext HTTP, Trust-All Certificate Manager, custom HostnameVerifier, JavaScript Bridge, SSL bypass patterns	Critical / High / Medium
Crypto Checker	MD5, SHA-1, DES, RC4, AES/ECB, hardcoded IV, weak Random	High / Medium
Log Checker	Credentials and sensitive values logged to Android Logcat	High

Installation

git clone https://github.com/UmutCanYY/APKra
cd APKra
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

Install JADX separately and make sure it is available on PATH:

jadx --version

Requirements

• Python 3.8+
• jadx optional, strongly recommended
• Python packages: rich, androguard, jinja2, xmltodict

Usage

python apkra.py -f app.apk
python apkra.py -f app.apk --report html
python apkra.py -f app.apk --only secrets
python apkra.py -f app.apk --only manifest
python apkra.py -f app.apk --only network
python apkra.py -f app.apk --only crypto
python apkra.py -f app.apk --report html -o /output/dir
python apkra.py -f app.apk -v

Useful module filters:

python apkra.py -f app.apk --only logs

JADX

JADX is optional, but you want it installed.

Without JADX, APKra can still unpack the APK and parse binary AndroidManifest.xml using androguard. With JADX, APKra also scans decompiled Java source, which unlocks deeper checks for secrets, TLS bypasses, weak crypto, insecure WebView patterns, and Logcat leaks.

APKra does not treat every non-zero JADX exit code as fatal. If JADX produces Java files, APKra uses the partial output and warns you.

Sample Findings

Realistic findings from InsecureBankv2-style APKs:

APKRA-001  Manifest  Debuggable Flag
Evidence: android:debuggable="true"
Fix: Disable debuggable builds before release.

APKRA-018  Secrets  Hardcoded Username / Backdoor Account
Evidence: username.equals("devadmin")
Fix: Never hardcode usernames or credentials in application code.

APKRA-021  Secrets  Hardcoded Zero IV
Evidence: byte[] ivBytes = {0, 0, 0, 0, ...}
Fix: Generate a random IV for every encryption operation.

APKRA-023  Network  HTTP Protocol String
Evidence: String protocol = "http://"
Fix: Use HTTPS for all network communication.

Extending Rules

Secret patterns live in rules/patterns.json.

Add your own rule:

{
  "name": "Internal API Token",
  "regex": "internal_[A-Za-z0-9]{32}",
  "severity": "HIGH",
  "description": "An internal API token was found.",
  "recommendation": "Remove the token and load it at runtime from a secure source."
}

Keep rules specific. Context-aware patterns beat broad regex every time.

Project Layout

apkra.py                 CLI entry point
core/manifest_parser.py  AndroidManifest.xml analysis
core/secret_finder.py    Hardcoded secrets and API key detection
core/network_checker.py  Network and TLS checks
core/crypto_checker.py   Weak crypto checks
core/log_checker.py      Logcat credential leak checks
reporters/               Terminal and HTML report renderers
rules/patterns.json      Extendable regex rules
templates/report.html    Dark HTML report template

Roadmap

• Dynamic analysis helpers
• APK-to-APK diff mode
• CVSS scoring export
• SARIF / JSON output
• Rule packs for common Android SDKs

Disclaimer

⚠️ APKra is for authorized security testing, malware lab work, and defensive review only. Do not scan or reverse engineer applications you are not allowed to test.

License

MIT

Built by a pentester, for pentesters.