Slicer accepts a path to an extracted APK file and then returns all the activities, receivers, and services which are exported and have null permissions and can be externally provoked.

Note: The APK has to be extracted via jadx or apktool.

Features

• Check if the APK has set the android:allowbackup to true
• Check if the APK has set the android:debuggable to true.
• Return all the activities, services and broadcast receivers which are exported and have null permission set. This is decided on the basis of two things:
  • android:exporte=true is present in any of the component and have no permission set.
  • If exported is not mention then slicer check if any Intent-filters are defined for that component, if yes that means that component is exported by default(This is the rule given in android documentation.)
• Check the Firebase URL of the APK by testing it for .json trick.
  • If the firebase URL is myapp.firebaseio.com then it will check if https://myapp.firebaseio.com/.json returns something or gives permission denied.
  • If this thing is open then that can be reported as high severity.
• Check if the google API keys are publically accessible or not.
  • This can be reported on some bounty programs but have a low severity.
  • But most of the time reporting this kind of thing will bring out the pain of Duplicate.
  • Also sometimes the company can just close it as not applicable and will claim that the KEY has a usage cap – r/suspiciouslyspecific 
• Return other API keys that are present in strings.xml and in AndroidManifest.xml
• List all the file names present in /res/raw and res/xml directory.
• Extracts all the URLs and paths.
  • These can be used with tool like dirsearch or ffuf.

Installation

• Clone this repository

git clone https://github.com/mzfr/slicer

• cd slicer
• Now you can run it: python3 slicer.py -h

Usage

It’s very simple to use. Following options are available:

Extract information from Manifest and strings of an APK
Usage:
slicer [OPTION] [Extracted APK directory]
Options:
d, –dir path to jadx output directory
o, –output Name of the output file(not implemented)

I have not implemented the output flag yet because I think if you can redirect slicer output to a yaml file it will a proper format.

Usage Example

• Extract information from the APK and display it on the screen.

python3 slicer.py -d path/to/extact/apk -c config.json