A tool to automate the recon process on an APK file.
Slicer accepts a path to an extracted APK file and then returns all the activities, receivers, and services which are exported and have
null permissions and can be externally provoked.
Note: The APK has to be extracted via
I started bug bounty like 3 weeks ago(in June 2020) and I have been trying my best on android apps. But I noticed one thing that in all the apps there were certain things which I have to do before diving in deep. So I just thought it would be nice to automate that process with a simple tool.
Why not drozer?
Well, drozer is a different beast. Even though it does finds out all the accessible components but I was tired of running those commands again and again.
Why not automate using drozer?
I actually wrote a bash script for running certain drozer commands so I won't have to run them manually but there was still some boring stuff that had to be done. Like Checking the
strings.xml for various API keys, testing if firebase DB was publically accessible or if those google API keys have setup any cap or anything on their usage and lot of other stuff.
Why not search all the files?
I think that a tool like grep or ripgrep would be much faster to search through all the files. So if there is something specific that you want to search it would be better to use those tools. But if you think that there is something which should be checked in all the android files then feel free to open an issue.
Check if the APK has set the
Check if the APK has set the
Return all the activities, services and broadcast receivers which are exported and have null permission set. This is decided on the basis of two things:
android:exporte=trueis present in any of the component and have no permission set.
Intent-filtersare defined for that component, if yes that means that component is exported by default(This is the rule given in android documentation.)
Check the Firebase URL of the APK by testing it for
myapp.firebaseio.comthen it will check if
https://myapp.firebaseio.com/.jsonreturns something or gives permission denied.
Check if the google API keys are publically accessible or not.
not applicableand will claim that the KEY has a
usage cap- r/suspiciouslyspecific 😉
Return other API keys that are present in
strings.xml and in
List all the file names present in
Extracts all the URLs and paths.
You can download the binary from the release page. Also if you want you can clone this repository and build the binary yourself.
If you have
go compiler installed then you can use
go get github.com/mzfr/slicer.
NOTE: Slicer uses
config.yml file. So either have a file named
config.yml in your current working directory or make a directory
.slicer in your
$HOME and then place the
config.yml file there.
yay -S slicer
git clone https://aur.archlinux.org/slicer.git && cd slicer && makepkg -si
It's very simple to use. Following options are available:
Extract information from Manifest and strings of an APK Usage: slicer [OPTION] [Extracted APK directory] Options: -d, --dir path to jadx output directory -o, --output Name of the output file(not implemented) -nb, --no-banner Don't Show Banner
I have not implemented the
output flag yet because I think if you can redirect slicer output to a yaml file it will a proper format.
slicer -d path/to/extact/apk
slicer -d path/to/extracted/apk -nb=false > name.yaml
If you plan to use if for Bug bounty or anything similar it's better to store in some file
All the features implemented in this are things that I've learned in past few weeks, so if you think that there are various other things which should be checked in an APK then please open an issue for that feature and I'd be happy to implement that :)
If you'd like you can buy me some coffee: