APKHunt: Android App Pentesting on Kali Linux

APKHunt maps Android source and manifest data to OWASP MASVS static checks so you get file paths and remediation hints without opening a full MobSF session. This walkthrough installs the tool on Kali, scans Damn Vulnerable Bank (DVBA), then batches InsecureShop from a folder with logging enabled.

What is APKHunt in ethical hacking?

Android static analysis reads an APK without running it on a device. APKHunt automates that workflow for penetration testers who want MASVS-aligned leads in the terminal.

The tool chains three steps on each APK:

• dex2jar converts DEX bytecode to a JAR for pattern matching
• jadx decompiles sources into a *_SAST tree beside the APK
• Go rules grep manifest, resources, and Java/Kotlin sources for MASVS categories

Each hit prints a decompiled path, a line number, a QuickNote remediation blurb, and an MSTG reference link. That is SAST coverage, not proof of exploitability — you still validate findings with manual review, MobSF dynamic analysis, or runtime tests in your Android pentesting lab.

APKHunt targets Linux hosts only (per upstream help). There is no web UI; results stay in the terminal or TXT/HTML log files when you pass -l.

Compare APKHunt and MobSF

Both tools help with Android app security reviews, but they fit different moments in a test.

Use APKHunt when you want lightweight batch SAST tied to MSTG IDs. Open MobSF when you need a browser workflow or dynamic testing on an emulator.

Kali lab setup

Create a predictable folder layout and download two public training APKs. DVBA exercises banking flaws; InsecureShop adds a second target for folder mode.

Set paths once for the rest of the guide:

APK_LAB="${HOME}/apk-lab"
SINGLE="${APK_LAB}/single"
MULTI="${APK_LAB}/multi"
APK="${SINGLE}/dvba.apk"
APKHUNT="${HOME}/APKHunt"

mkdir -p "${SINGLE}" "${MULTI}"

Download Damn Vulnerable Bank and copy the release APK into your lab tree:

git clone https://github.com/rewanthtammana/Damn-Vulnerable-Bank.git "${HOME}/Damn-Vulnerable-Bank"

cp "${HOME}/Damn-Vulnerable-Bank/Builds/dvba.apk" "${APK}"

Sample output:

'/home/kali/Damn-Vulnerable-Bank/Builds/dvba.apk' -> '/home/kali/apk-lab/single/dvba.apk'

The copy places DVBA where single-file scans expect it. If git clone fails on your network, download the APK from the project releases page and copy it to "${APK}" manually.

Fetch InsecureShop for multi-APK mode and mirror DVBA into the shared folder. Download the release APK with curl command and -fL so HTTP errors fail the step.

curl -fL -o "${MULTI}/insecureshop.apk" "https://github.com/optiv/InsecureShop/releases/download/v1.0/insecureshop.apk"

cp "${APK}" "${MULTI}/dvba.apk"

Confirm both training APKs are present before installing APKHunt:

ls -lh "${APK}" "${MULTI}"

Sample output:

-rw-r--r-- 1 kali kali 3.7M ... /home/kali/apk-lab/single/dvba.apk

/home/kali/apk-lab/multi:
-rw-r--r-- 1 kali kali 3.7M ... dvba.apk
-rw-r--r-- 1 kali kali 4.6M ... insecureshop.apk

Two APKs in "${MULTI}" means folder mode will run two sequential scans when you pass -m.

Install APKHunt dependencies on Kali

APKHunt shells out to jadx, dex2jar, go, and standard Unix tools. Install the Kali packages with apt command before cloning the repository.

sudo apt update

sudo apt install -y golang-go jadx dex2jar git

Verify the toolchain versions match what you expect on Kali:

go version

Sample output:

go version go1.26.5 linux/amd64

dpkg-query -W -f='${Package} ${Version}\n' jadx dex2jar golang-go

Sample output:

dex2jar 2.1~nightly-28-0kali2
golang-go 2:1.26~1
jadx 1.5.6-0kali1

Those three packages are the moving parts APKHunt invokes on every scan.

Clone APKHunt from GitHub

Clone the upstream repository into "${APKHUNT}". The scanner entry point is apkhunt.go (lowercase on disk).

git clone https://github.com/Cyber-Buddy/APKHunt.git "${APKHUNT}"

List the main script so you know the exact filename before running go run:

ls -lh "${APKHUNT}/apkhunt.go"

Sample output:

-rw-r--r-- 1 kali kali 209K ... /home/kali/APKHunt/apkhunt.go

No separate go build step is required — go run apkhunt.go compiles and executes the scanner in one step.

Verify APKHunt CLI help

Print the banner and flag summary with -h before you point the tool at a multi-minute decompile job.

cd "${APKHUNT}" && go run apkhunt.go -h

Sample output:

APKHunt Usage:
	  go run APKHunt.go [options] {.apk file}

    Options:
	 -h     For help
	 -p     Provide a single apk file-path
	 -m     Provide the folder-path for multiple apk scanning
	 -l     For logging (.txt file)

    Examples:
	 APKHunt.go -p /Downloads/android_app.apk
	 APKHunt.go -p /Downloads/android_app.apk -l
	 APKHunt.go -m /Downloads/android_apps/
	 APKHunt.go -m /Downloads/android_apps/ -l

    Note:
	 - Tested on linux only!
	 - Keep tools such as jadx, dex2jar, go, grep, etc.! installed

The help text still shows APKHunt.go in examples, but Kali uses apkhunt.go. Flags -p, -m, and -l are the ones this lab exercises next.

APKHunt flags reference

Scan one APK with APKHunt

Single-APK mode decompiles "${APK}", hashes the file, then walks MASVS-themed sections such as manifest components, storage APIs, and resilience checks. Expect several minutes of jadx progress output before findings appear.

cd "${APKHUNT}" && go run apkhunt.go -p "${APK}"

Early console lines confirm dex2jar and jadx started and show APK metadata:

[+] APK Base: dvba.apk
[+] APK Size: 3.609375 MB
[+] APK Directory: /home/kali/apk-lab/single/
[+] APK Static Analysis Path: /home/kali/apk-lab/single/dvba_SAST/
[+] APK Hash: MD5: 5b40b49cd80dbe20ba611d32045b57c6
[+] APK Hash: SHA256: 76c308fac6a655a3534771777780e004feb1d91be032857768c891b2baf40ba6

[+] d2j-dex2jar has started converting APK to Java JAR file
    dex2jar /home/kali/apk-lab/single/dvba.apk -> /home/kali/apk-lab/single/dvba.jar

[+] Jadx has started decompiling the application
ERROR - finished with errors, count: 13

jadx may report decompile errors on messy training APKs. APKHunt continues when partial sources are available — treat the error count as a signal to review coverage, not always as a failed scan.

When rules match, sections print file paths with line numbers under headings such as ==>> The Shared Preferences related instances...:

==>> The Shared Preferences related instances...

/home/kali/apk-lab/single/dvba_SAST/sources/com/app/damnvulnerablebank/AddBeneficiary.java
77:        String string = getSharedPreferences("jwt", 0).getString("accesstoken", null);
79:        String strM1972c = C0580a.m1972c(getSharedPreferences("apiurl", 0).getString("apiurl", null), "/api/beneficiary/add");

[!] QuickNote:
    - It is recommended to use shared preferences appropriately, if observed. Please note that, Misuse of the SharedPreferences API can often lead to the exposure of sensitive data...

[*] Reference:
    - OWASP MASVS: MSTG-STORAGE-2 | CWE-922: Insecure Storage of Sensitive Information

Each block ties a code location to an MSTG item and CWE ID — copy those lines into your report and verify whether tokens or URLs are actually sensitive in context.

The scan footer prints total runtime when all MASVS sections finish:

[+] Scan has been finished at: 2026-08-02 11:46:40 ...
[+] Total time taken for hunting: 6m38.294423823s

Decompiled trees remain under "${SINGLE}/dvba_SAST" for manual grep or import into another tool.

Save APKHunt results to a TXT log

Add -l when you want a timestamped report file for diffing scans or attaching to a client deliverable.

cd "${APKHUNT}" && go run apkhunt.go -p "${APK}" -l

The log header records TXT and HTML paths next to the APK directory:

[+] Log-file path: /home/kali/apk-lab/single/APKHunt_dvba_2026-8-2_11-40-2.txt
[+] HTML-file path: /home/kali/apk-lab/single/APKHunt_dvba_2026-8-2_11-40-2.html

List generated reports after the scan completes:

ls -1 "${SINGLE}"/APKHunt_*.txt

Sample output:

/home/kali/apk-lab/single/APKHunt_dvba_2026-8-2_11-40-2.txt

The TXT file repeats console findings in order — manifest summary first, then storage, network, crypto, and resilience checks. Open the matching .html file in a browser when you want the same content with a simple HTML wrapper.

A Firebase URL hit in the DVBA log illustrates how resource files surface:

==>> The Firebase Database instances...

/home/kali/apk-lab/single/dvba_SAST/resources/res/values/strings.xml
71:    <string name="firebase_database_url">https://damn-vulnerable-bank.firebaseio.com</string>

[!] QuickNote:
    - It is recommended that Firebase Realtime database instances should not be misconfigured, if observed...
[*] Reference:
    - OWASP MASVS: MSTG-STORAGE-2 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Follow QuickNote guidance with manual verification — a string resource alone does not prove an open Firebase ruleset.

Scan multiple APKs in one folder

Folder mode scans every .apk in the directory sequentially. Point -m at "${MULTI}" where DVBA and InsecureShop already sit.

cd "${APKHUNT}" && go run apkhunt.go -m "${MULTI}" -l

Each APK produces its own timestamped TXT and HTML pair. After both scans finish, list the reports:

ls -1 "${MULTI}"/APKHunt_*.txt

Sample output:

/home/kali/apk-lab/multi/APKHunt_dvba_2026-8-2_11-47-25.txt
/home/kali/apk-lab/multi/APKHunt_insecureshop_2026-8-2_11-53-46.txt

The DVBA report header shows which base APK that file belongs to:

[+] APK Base: dvba.apk
[+] Total time taken for hunting: 6m21.802803825s

InsecureShop ran as the second file in the folder and took about eleven minutes in this lab. Budget sequential runtime when you batch many APKs — there is no parallel worker flag in the CLI.

Separate logs keep findings isolated per app, which is easier to hand to developers than one merged file.

APKHunt troubleshooting

References

• APKHunt GitHub repository
• OWASP MASVS
• OWASP MASVS GitBook (v1.5.0 requirements)
• Damn Vulnerable Bank
• InsecureShop (Optiv)
• jadx decompiler
• dex2jar

Summary

APKHunt gives you a terminal-first path through OWASP MASVS static checks on Kali. You installed golang-go, jadx, and dex2jar, cloned Cyber-Buddy/APKHunt, and confirmed -p, -m, and -l with go run apkhunt.go -h. Single-APK scans decompile DVBA into a dvba_SAST tree, print MSTG-tagged hits with file paths, and finish with a runtime total on the order of several minutes per app.

Logging with -l drops timestamped TXT and HTML reports beside each APK — useful for reports and regression diffs. Folder mode processed DVBA and InsecureShop sequentially and wrote one log file per APK. jadx decompile warnings are common on training apps; APKHunt still produced full MASVS sections when partial sources were available.

Treat every QuickNote as a lead, not a confirmed vulnerability. Pair APKHunt output with manual code review, MobSF when you need dynamic analysis, and runtime tests on emulators from your Android pentesting lab. For payload or repackaging workflows, continue with payload on APK only inside authorized scopes.