Android Secret & Endpoint Scanning - jddlab Edition

Version: 1.0 | Last Updated: 2026-08 | Difficulty: Intermediate

How to find hardcoded secrets (API keys, tokens, credentials), endpoints, and other sensitive data inside Android apps using jddlab. Centered on APKscan, which decompiles + deobfuscates + scans in one pass, with manual follow-up techniques. Every tool runs inside the stanislavpovolotsky/jddlab Docker container via the jddlab MCP server.

Table of Contents

1. Toolchain Overview
2. Quick Scan with APKscan
3. Tuning Rules & Output
4. Scanning Obfuscated Apps
5. Manual Follow-up (jadx grep, resources, native)
6. Triage: Which Findings Matter
7. Troubleshooting

1. Toolchain Overview

APKscan accepts .apk, .xapk, .dex, .jar, .class, .smali, .zip, .aar, .arsc, .aab. It runs a decompiler itself (JADX by default), so you can point it straight at an APK.

2. Quick Scan with APKscan

{
  "tool": "jddlab_apkscan",
  "args": ["-f", "json", "-o", "secrets.json", "target.apk"],
  "input_paths": ["target.apk"],
  "output_paths": ["secrets.json"],
  "timeout_seconds": 1800
}

• -f {text,json,yaml} - output format (json is best for further processing).
• -o <file> - write results to a file.
• -g {file,locator,both} - group findings by input file, by rule, or both.

Large APKs take a while (decompilation dominates). Raise timeout_seconds.

3. Tuning Rules & Output

APKscan ships several built-in locator sets. Select them with -r/--rules:

aws, azure, gcp, cloud, endpoints, generic, gitleaks, nuclei-regexes, high-confidence, curated, default, all_secret_locators.

Scan for cloud creds + endpoints only, high signal:

{
  "tool": "jddlab_apkscan",
  "args": ["-r", "high-confidence", "cloud", "endpoints", "-f", "json", "-o", "secrets.json", "target.apk"],
  "input_paths": ["target.apk"],
  "output_paths": ["secrets.json"]
}

Provide your own rules (SecretLocator JSON, secret-patterns-db YAML, or Gitleaks TOML) by passing their file paths to -r:

{
  "tool": "jddlab_apkscan",
  "args": ["-r", "my-rules.yaml", "-o", "secrets.txt", "target.apk"],
  "input_paths": ["target.apk", "my-rules.yaml"],
  "output_paths": ["secrets.txt"]
}

Use -c/--cleanup to delete the (large) decompiled output after scanning, or -w <dir> to keep it somewhere you can inspect (see §5).

4. Scanning Obfuscated Apps

Obfuscation hides secrets from a plain scan. APKscan can deobfuscate first (-d/--deobfuscate is on by default) and can use alternate decompilers:

{
  "tool": "jddlab_apkscan",
  "args": ["--deobfuscate", "--fernflower", "-w", "decompiled", "-f", "json", "-o", "secrets.json", "target.apk"],
  "input_paths": ["target.apk"],
  "output_paths": ["secrets.json", "decompiled"],
  "timeout_seconds": 3600
}

If strings are encrypted at runtime, a static scan will miss them. Decrypt first using the java-deobfuscation skill (d2j-decrypt-string / simplify), then scan the cleaned JAR/DEX with APKscan.

5. Manual Follow-up

APKscan is pattern-based; always confirm and hunt beyond it.

Keep the decompiled sources (-w decompiled) and grep for high-value markers on the host:

grep -rEn "api[_-]?key|secret|token|password|bearer|BEGIN (RSA|EC|PRIVATE)" decompiled/
grep -rEn "https?://[a-zA-Z0-9._~:/?#@!$&'()*+,;=%-]+" decompiled/   # endpoints

Do not forget non-code locations - decode resources and check them too:

{
  "tool": "jddlab_apktool",
  "args": ["d", "target.apk", "-o", "dec", "-f"],
  "input_paths": ["target.apk"],
  "output_paths": ["dec"]
}

Then inspect: dec/res/values/strings.xml, dec/assets/, dec/res/raw/, AndroidManifest.xml (<meta-data> API keys, e.g. Google Maps), .properties/.json config files, and any bundled .env. Secrets baked into native libraries need the native-jni-analysis skill.

6. Triage: Which Findings Matter

Deduplicate across smali/java/resource copies of the same string, and verify a finding is reachable (not dead test data) before reporting it.

7. Troubleshooting