Redteam Pipeline APK

--- name: apk-redteam-pipeline description: End-to-end Android APK red-team pipeline : automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external red-team engagement where 7 APKs were manually extracted, 4 download attempts were truncated, and a hardcoded JWT along with 30 internal API endpoints were recovered from one of the apps. Use when the target has a mobile app catalog (Play Store developer page), when you find an APK-URLs hosted on a web server, or when post-recon mentions “mobile app” in its scope. sources: authorized-engagement report_count: 1 --- ## When to use this skill Trigger when: - Reconnaissance reveals 1 or more mobile apps under the target’s developer name (Play Store developer page) - A web app directly hosts *.apk files (e.g., Recruitz.apk found on a subdomain during an engagement) - APK package IDs leaked via stealer logs (e.g., com.<brand>.app, com.<brand>.<sub-brand> patterns in stealer dump format) - Customer-facing app, dealer/partner portal, or employee mobile companion app is in scope - Bug bounty program lists Android as in scope DO NOT use for: - Targets that are “iOS” only (different pipeline:IPA reverse, MobSF, frida-ios-dump) - React Native / Flutter web apps already covered by JS bundle analysis - Server-side-only assessments --- ## Stage 0 : Inventory all organization-owned apps ### Scrape the Play Store developer page ``bash # Find developer page from the target's brand name curl -sk -A "Mozilla/5.0" "https://play.google.com/store/apps/developer?id=<Brand+Name>" -o /tmp/dev.html # Extract package IDs grep -oE 'id=[a-zA-Z0-9._]+' /tmp/dev.html | sort -u ` Example output (anonymized : 7 packages typical for a multi-brand conglomerate): ` com.events.<brand>build com.<corp>.<sub-brand-1> com.<corp>.<sub-brand-2> com.<corp>.<flagship> com.<corp>.<product-line-1> com.<corp>.<product-line-2> com.<corp>.<sub-brand-3> ` ### Cross-reference with stealer logs Stealer-log format includes package names like *@com.<corp>.<app> : extract these from creds_userpass.txt if you have a leaked dump. ### Brand permutation guesses (multi-brand conglomerate patterns) ` com.<brand>.app com.<brand>.mobile com.<brand>.android com.<brand>connect.app in.<brand>.dealer in.co.<brand>.app ` --- ## Stage 1 : APK acquisition ### Primary: APKPure direct (no auth required) `bash # Follow 302 redirects to actual download curl -sk -L --max-time 60 \ "https://d.apkpure.net/b/APK/<package_id>?version=latest" \ -o "<package_id>.apk" # Or via the legacy d-XX.winudf.com mirror chain (we saw this work) ` ### Secondary: APKMirror search `bash curl -sk -A "Mozilla/5.0" "https://www.apkmirror.com/?post_type=app_release&searchtype=apk&s=<brand>" \ | grep -oE 'href="[^"]+\.apk[^"]*"' | sort -u ` ### Tertiary: APKPure web search `bash curl -sk "https://apkpure.com/search?q=<brand>" | grep -oE 'data-dt-app="[^"]+"' ` ### XAPK vs APK - .xapk = a zip containing multiple split APKs (base + config.armeabi-v7a + config.en + etc.) - Unzip outer first, then unzip the inner base.apk or <package>.apk - Some apkpure downloads return truncated XAPK with missing EOCD signature : symptom of CDN rate-limiting; rotate IP and retry, OR use 7z x which is more lenient than unzip `bash # Standard unzip (works for clean APK) unzip -o <package>.apk -d extracted_<package>/ # For truncated/repaired XAPK 7z x -y <package>.apk -o"extracted_<package>" # For nested XAPK for inner in extracted_<package>/*.apk; do mkdir -p "extracted_<package>/$(basename "$inner" .apk)" unzip -o "$inner" -d "extracted_<package>/$(basename "$inner" .apk)" done ` --- ## Stage 2 : DEX decompilation (jadx) `bash # Install brew install jadx # macOS # or wget https://github.com/skylot/jadx/releases/latest/download/jadx-1.5.x.zip # Decompile jadx -d decompiled_<package>/ <package>.apk # For XAPK that contains multiple APKs for inner in extracted_<package>/*.apk; do jadx -d decompiled_<package>_$(basename "$inner" .apk)/ "$inner" done `` For a fa