apkscan is a high-performance, evidence-based static analysis tool for Android APKs. Unlike traditional scanners that only flag raw string matches, apkscan performs deep reachability analysis to prove that a vulnerability is actually accessible from the application's entry points.
- 🧠 Evidence-Based Analysis: Every finding includes a complete call chain from entry point (e.g., Exported Activity, JS Bridge) to sink (vulnerable code/string).
- 🔍 Reachability Engine: Built-in BFS-based call graph traversal through DEX bytecode.
- 📱 Comprehensive Manifest Auditing: Deep inspection of AndroidManifest.xml for misconfigurations.
- 📊 Professional Reporting: Interactive HTML dashboards, SARIF (for GitHub Security Tab), JSON, and high-fidelity Console output.
- 🛡️ Security Standards: Mapped to CWE and OWASP MASVS (Mobile Application Security Verification Standard).
apkscan comes with a suite of professional security rules:
| ID | Title | Severity |
|---|---|---|
unsafe_ssl_error |
WebView SSL validation bypass | CRITICAL |
debuggable_enabled |
Production build with debug mode on | CRITICAL |
exported_no_protection |
Unprotected exported components | HIGH |
cleartext_traffic |
Cleartext (HTTP) traffic permitted | HIGH |
hardcoded_urls |
Hardcoded development/test URLs | MEDIUM |
backup_enabled |
ADB backup enabled (Data leakage) | MEDIUM |
signature_metadata |
Insecure signature or debug certs | INFO |
dev_artifacts |
Development metadata & env files | LOW |
apkscan scan app.apkGenerate a professional interactive HTML report:
apkscan scan app.apk --format html --output report.htmlExport results for CI/CD integration (SARIF):
apkscan scan app.apk --format sarif --output results.sarif# Only show High and Critical findings
apkscan scan app.apk --severity high
# Disable specific rules
apkscan scan app.apk --disable-rule backup_enabledRequires Python 3.11+.
git clone https://github.com/apkscan/apkscan.git
cd apkscan
pip install .- Data Flow Analysis: Taint tracking for intent extras.
- Deobfuscation Support: ProGuard/R8 mapping file integration.
- Advanced JADX Enrichment: Code-level context for complex findings.
- CI/CD Actions: Official GitHub Action for automated PR scanning.
Distributed under the MIT License. See LICENSE for more information.
Built with ❤️ for Security Engineers.