Can apkurlgrep find undocumented API endpoints?

That is the main use. Apps often call backends absent from a web UI or DNS. apkurlgrep surfaces candidate hosts and paths; httpx shows which respond.

Does apkurlgrep decompile the APK first?

No. It reads the packaged APK and greps it, so you skip a separate apktool decode. For the full smali, manifest, and resources tree, run apktool-decode instead.

What format is the output?

Plain text, one item per line: full URLs with scheme and host, plus bare paths like /api/v2/login. Sort and dedupe before the next node.

Can I run apkurlgrep on many APKs at once?

The node takes one APK per run. Fan it across a package list in a workflow, then merge and dedupe before probing.

Updated Jul 14, 2026

Discovery

Pull hard-coded endpoints from an Android APK

Extract URLs and endpoints from Android APK files.

Map an app's backend API surface Feed mobile endpoints into web testing Discover hosts nothing else surfaces

overview

What apkurlgrep does

apkurlgrep greps an APK for URL-like strings and endpoint paths so you see hard-coded API hosts and routes without reading smali by hand. That is often the fastest look at a mobile backend with no public docs.

Pass the package with --apk. It walks resources, assets, and compiled code, then prints full URLs and bare paths like /api/v2/login. No separate apktool decode step required for URL-only work.

Trickest runs it as a managed Discovery node: APK in, FILE plus FOLDER of endpoints out. Wire after APK collection so mobile hosts join the same httpx and nuclei stages as web recon.

source github.com/ndelphit/apkurlgrep

use cases

Where apkurlgrep fits

Map an app's backend API surface

Extract the URLs and endpoint paths embedded in an APK to reveal the API hosts and routes a mobile app depends on, often undocumented and absent from any web UI.

Feed mobile endpoints into web testing

Hand extracted URLs to httpx and nuclei so the app's backend gets the same liveness and vulnerability testing as your web targets, from one merged endpoint list.

Discover hosts nothing else surfaces

Pull API hosts that appear only inside the app and never in DNS or a web crawl, expanding scope beyond what subdomain enumeration finds.

Sweep a set of collected APKs

Fan the node across a list of packages in a workflow, merge and dedupe the results, then probe the combined endpoint set in one pass.

reference

apkurlgrep inputs and flags

1 inputs

Name	Type	Flag	Description
apk-file	FILE	--apk	Path to the APK file to walk and extract URLs and endpoint paths from.

Showing key inputs. apkurlgrep exposes 1 inputs in total.

example

Run apkurlgrep

apkurlgrep · command

# extract every URL and endpoint path baked into an APKapkurlgrep --apk app-release.apk

sample output

https://api.example.comhttps://api.example.com/v2/usershttps://cdn.example.com/static/http://analytics.example.com/collecthttps://198.51.100.24:8443/mobile/configcontent://com.example.app.fileprovider//auth/login/api/v2/profile/payments/checkout

guidance

Choosing apkurlgrep

Use when you have an APK and want embedded endpoints fast, without a full decode. It finds URLs; it does not probe them. Feed output to httpx. For a full source tree, decode with apktool-decode first.

apktool-decode

Unpacks the whole APK into a source tree. Use when you need more than URLs.

linkfinder

Extracts endpoints from JavaScript. Web counterpart for the same job.

getjs

Pulls JS files from web targets for endpoint mining. Pairs with linkfinder on the web side.

faq

apkurlgrep questions

Pass the package with --apk, for example `apkurlgrep --apk app-release.apk`. On Trickest, set the node's apk-file input instead of typing the flag.

Run apkurlgrep yourself

An APK feeds apkurlgrep, which extracts the embedded endpoints and passes them to httpx so only live backend hosts land as output.

Open apkurlgrep in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.