Skip to main content

apk-hunt

apk-hunt is a powerful static code analysis tool for Android APK files, designed to identify security vulnerabilities based on the OWASP Mobile Application Security Verification Standard (MASVS). Its integration into automated workflows allows for continuous assessment of mobile application security, ensuring compliance with industry standards.

Ideal Use Cases & Fit​

apk-hunt is best suited for security professionals conducting vulnerability assessments on Android applications during the development lifecycle. It excels in scenarios such as:

  • Evaluating third-party APKs acquired during threat intelligence.
  • Conducting routine security audits to ensure compliance with security benchmarks.
  • Analyzing multiple APKs in batch through Input Node uploads to streamline vulnerability detection.

This tool may not be the best choice for dynamic analysis or runtime behavior assessments of applications.

Value in Workflows​

Integrating apk-hunt into security workflows enhances the identification and remediation of vulnerabilities early in the development process. By automating static analysis, it improves efficiency in:

  • Early reconnaissance during application development.
  • Continuous integration/continuous deployment (CI/CD) pipelines.
  • Security assessments prior to application releases, thereby reducing risk.

Input Data​

apk-hunt requires APK files provided through an Input Node. The tool can process one or multiple APK files in a single workflow execution.

  • Type: File(s)
  • Format: APK files uploaded to Input Node
  • Function: Target(s) for static analysis
  • Required: At least one APK file

Example workflow:

[Input Node with APK file(s)] → [apk-hunt Node] → [Analysis Output]

To provide input:

  1. Create an Input Node
  2. Upload one or more APK files via the "Files" tab
  3. Connect the Input Node to apk-hunt

Configuration​

Key configurable parameters for apk-hunt include:

  • raw: Controls whether to output the raw APKHunt report without JSON parsing. Default is false.
  • timeout: Sets the timeout duration, in seconds, for each APK scan, with a default of 3600 seconds.

These parameters help customize the tool's behavior to suit specific workflow requirements and operational constraints. Updated: 2026-02-17