Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Discovery

Pull hard-coded endpoints from an Android APK

apkurlgrep is an open-source Go tool that extracts endpoints and URLs from decompiled APK files, pairing with apktool to collect an Android app's API endpoints, hidden paths, and hardcoded links for further testing.

installgo get -u github.com/ndelphit/apkurlgrep

Go · MIT license

Agent
Map an app's backend API surfaceFeed mobile endpoints into web testingDiscover hosts nothing else surfaces

overview

What apkurlgrep does

apkurlgrep greps an APK for URL-like strings and endpoint paths so you see hard-coded API hosts and routes without reading smali by hand. That is often the fastest look at a mobile backend with no public docs.

Supply the original APK with --apk. In an offline owned-fixture test, the existing image extracted a URL from DEX content but omitted a separate resource URL. Treat the results as candidates, not a complete inventory of embedded endpoints.

Trickest runs it as a managed Discovery node: APK in, FILE plus FOLDER of endpoints out. Wire after APK collection so mobile hosts join the same httpx and nuclei stages as web recon.

source github.com/ndelphit/apkurlgrep

use cases

Where apkurlgrep fits

Map an app's backend API surface

Extract the URLs and endpoint paths embedded in an APK to reveal the API hosts and routes a mobile app depends on, often undocumented and absent from any web UI.

Feed mobile endpoints into web testing

Hand extracted URLs to httpx and nuclei so the app's backend gets the same liveness and vulnerability testing as your web targets, from one merged endpoint list.

Discover hosts nothing else surfaces

Pull API hosts that appear only inside the app and never in DNS or a web crawl, expanding scope beyond what subdomain enumeration finds.

Sweep a set of collected APKs

Fan the node across a list of packages in a workflow, merge and dedupe the results, then probe the combined endpoint set in one pass.

reference

apkurlgrep inputs and flags

1 inputs
NameTypeFlagDescription
apk-fileFILE--apkPath to the APK file to walk and extract URLs and endpoint paths from.

Showing key inputs. apkurlgrep exposes 1 inputs in total.

example

Run apkurlgrep

apkurlgrep · command
apkurlgrep --apk fixture.apk
sample output
Result of URLs:

 
https://fixture.invalid/api/v1

guidance

Choosing apkurlgrep

Use when you have an APK file and want candidate embedded URLs and paths. This node does not accept a decoded folder or prove that an extracted endpoint is reachable.

apktool-decode

Unpacks the whole APK into a source tree. Use when you need more than URLs.

linkfinder

Extracts endpoints from JavaScript. Web counterpart for the same job.

getjs

Pulls JS files from web targets for endpoint mining. Pairs with linkfinder on the web side.

faq

apkurlgrep questions

Pass the package with --apk, for example `apkurlgrep --apk app-release.apk`. On Trickest, set the node's apk-file input instead of typing the flag.

That is the main use. Apps often call backends absent from a web UI or DNS. apkurlgrep surfaces candidate hosts and paths; httpx shows which respond.

Give this node the original APK FILE. Do not wire apktool-decode’s FOLDER output into its apk-file input. Exact decoding behavior is being checked against the existing image; the two tools do not form a folder-to-file chain.

Plain text, one item per line: full URLs with scheme and host, plus bare paths like /api/v2/login. Sort and dedupe before the next node.

The node takes one APK per run. Fan it across a package list in a workflow, then merge and dedupe before probing.

Yes. The sample is retained stdout from an owned-fixture offline test of the exact existing public image. It extracted the DEX URL marker but missed a separate resource URL. Extracted strings still need review and normalization before separately authorized network testing.

Not by itself. An actual malformed-APK test reproduced wrapper exit zero despite extraction failure. A controlled shell test also isolated failure masking in the wrapper pipeline. Check diagnostics and output contents; an empty file does not establish that an APK contains no URLs. A wrapper correction remains pending.

related

More Discovery tools

  1. cariddi

    Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.

  2. crawlergo

    Browser-driven crawler that harvests requests for downstream scanners.

  3. dirsearch

    Web path scanner.

  4. fallparams

    Crawl pages, harvest potential parameters, write a custom wordlist.

  5. feroxbuster

    Recursive content discovery with smart defaults and rich response filters.

  6. gau

    Passive known-URL fetch from public web archives.

Run apkurlgrep yourself

Retained native stdout from the existing public image on a self-owned APK containing a DEX URL marker. The DEX marker was extracted; a separate resource URL was omitted. A malformed APK still returned wrapper exit zero, so this is positive extraction evidence, not a passed invalid-input check.

Open apkurlgrep in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.