Data center: Ashburn, VA

Telegram Chat : MBHH_x86

Email Us:

Mobile Hacker For Hire, hire a hacker, hiring a hacker, hacker with proof

Tool To Automate The Boring Process Of APK Recon

Table of Contents

A tool to automate the recon process on an APK file.

Slicer accepts a path to an extracted APK file and then returns all the activities, receivers, and services which are exported and have null permissions and can be externally provoked.

Note: The APK has to be extracted via jadx or apktool.


I started bug bounty like 3 weeks ago(in June 2020) and I have been trying my best on android apps. But I noticed one thing that in all the apps there were certain things which I have to do before diving in deep. So I just thought it would be nice to automate that process with a simple tool.

Why not drozer?

Well, drozer is a different beast. Even though it does finds out all the accessible components but I was tired of running those commands again and again.

Why not automate using drozer?

I actually wrote a bash script for running certain drozer commands so I won’t have to run them manually but there was still some boring stuff that had to be done. Like Checking the strings.xml for various API keys, testing if firebase DB was publically accessible or if those google API keys have setup any cap or anything on their usage and lot of other stuff.

Why not search all the files?

I think that a tool like grep or ripgrep would be much faster to search through all the files. So if there is something specific that you want to search it would be better to use those tools. But if you think that there is something which should be checked in all the android files then feel free to open an issue.

git clone
  • cd slicer
  • Now you can run it: python3 -h

It’s very simple to use. Following options are available:

Extract information from Manifest and strings of an APK

slicer [OPTION] [Extracted APK directory]


-d, --dir path to jadx output directory
-o, --output Name of the output file(not implemented)

I have not implemented the output flag yet because I think if you can redirect slicer output to a yaml file it will a proper format.

  • Extract information from the APK and display it on the screen.
python3 -d path/to/extact/apk -c config.json

The extractor module used to extract URLs and paths is taken from apkurlgrep by @ndelphit

All the features implemented in this are things that I’ve learned in past few weeks, so if you think that there are various other things which should be checked in an APK then please open an issue for that feature and I’d be happy to implement that 🙂

If you’d like you can buy me some coffee:

Leave a Reply

Your email address will not be published. Required fields are marked *

error: Content is protected !!