loading
Loading content
loading
Discovery
Extract URLs and endpoints from Android APK files.
overview
apkurlgrep greps an APK for URL-like strings and endpoint paths so you see hard-coded API hosts and routes without reading smali by hand. That is often the fastest look at a mobile backend with no public docs.
Pass the package with --apk. It walks resources, assets, and compiled code, then prints full URLs and bare paths like /api/v2/login. No separate apktool decode step required for URL-only work.
Trickest runs it as a managed Discovery node: APK in, FILE plus FOLDER of endpoints out. Wire after APK collection so mobile hosts join the same httpx and nuclei stages as web recon.
use cases
Extract the URLs and endpoint paths embedded in an APK to reveal the API hosts and routes a mobile app depends on, often undocumented and absent from any web UI.
Hand extracted URLs to httpx and nuclei so the app's backend gets the same liveness and vulnerability testing as your web targets, from one merged endpoint list.
Pull API hosts that appear only inside the app and never in DNS or a web crawl, expanding scope beyond what subdomain enumeration finds.
Fan the node across a list of packages in a workflow, merge and dedupe the results, then probe the combined endpoint set in one pass.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| apk-file | FILE | --apk | Path to the APK file to walk and extract URLs and endpoint paths from. |
Showing key inputs. apkurlgrep exposes 1 inputs in total.
example
# extract every URL and endpoint path baked into an APKapkurlgrep --apk app-release.apkhttps://api.example.comhttps://api.example.com/v2/usershttps://cdn.example.com/static/http://analytics.example.com/collecthttps://198.51.100.24:8443/mobile/configcontent://com.example.app.fileprovider//auth/login/api/v2/profile/payments/checkoutguidance
Use when you have an APK and want embedded endpoints fast, without a full decode. It finds URLs; it does not probe them. Feed output to httpx. For a full source tree, decode with apktool-decode first.
Unpacks the whole APK into a source tree. Use when you need more than URLs.
Extracts endpoints from JavaScript. Web counterpart for the same job.
Pulls JS files from web targets for endpoint mining. Pairs with linkfinder on the web side.
faq
related
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
Reconstruct commits from a dumped .git folder.
An APK feeds apkurlgrep, which extracts the embedded endpoints and passes them to httpx so only live backend hosts land as output.
Facts on this page come from the live Trickest tool library.