Share
## https://sploitus.com/exploit?id=BDAE3A4F-7E46-5641-BB94-113CAA610923
# APKForge - The Dark Version of OpenCode
```
โโโโ โโโโ โโโ โโโ โโโโโโโโ โโโโโโโ โโโโโโโโ
โโโโโ โโโโโ โโโ โโโโ โโโโโโโโ โโโโโโโโโ โโโโโโโโ
โโโโโโโโโโโ โโโโโโโ โโโโโโ โโโ โโโ โโโโโโโโ
โโโโโโโโโโโ โโโโโโโ โโโโโโ โโโ โโโ โโโโโโโโ
โโโ โโโ โโโ โโโ โโโ โโโโโโโโ โโโโโโโโโ โโโโโโโโ
โโโ โโโ โโโ โโโ โโโโโโโโ โโโโโโโ โโโโโโโโ
THE DARK VERSION OF OPENCODE - APK SECURITY SUITE
```
[](https://github.com/xspeen/opencode-apk-forge)
[](LICENSE)
[](#cross-platform-support)
[](https://nodejs.org)
## Features
- **Auto-Mode**: One command to rule them all - analyze, scan, exploit, and patch
- **Vulnerability Detection**: Full OWASP MASVS M1-M10 coverage
- **Secret Extraction**: API keys, tokens, passwords, certificates
- **Endpoint Discovery**: HTTP, API, WebSocket, deep links
- **Exploit Generation**: Working exploits with step-by-step instructions
- **Premium Exploits**: Zero-click RCE, memory corruption, auth bypass
- **Auto-Patching**: Automatic fix generation for vulnerabilities
- **Cross-Platform**: Works on Termux, Kali, Ubuntu, macOS, Windows
- **No Root Required**: Uses ADB for device communication
## Installation
### Prerequisites
- Node.js v16 or higher
- ADB (Android Debug Bridge)
- jadx or apktool (for decompilation)
### Install APKForge
```bash
# Using npm
npm install -g @opencode/apk-forge
# Using yarn
yarn global add @opencode/apk-forge
```
### Platform-Specific Setup
#### Termux (Android)
```bash
pkg install nodejs-lts
pkg install android-tools
pkg install jadx
```
#### Kali Linux / Ubuntu
```bash
sudo apt install nodejs npm
sudo apt install adb
# Install jadx from GitHub releases
```
#### macOS
```bash
brew install node
brew install android-platform-tools
brew install jadx
```
#### Windows
```powershell
# Install Node.js from nodejs.org
# Install ADB from Android SDK
# Download jadx from GitHub releases
```
## Usage
### Launch with OpenCode
```bash
# Start opencode
opencode
# Inside opencode:
/apk auto com.whatsapp
```
### Standalone CLI
```bash
# Full analysis
apk-forge auto com.whatsapp
apk-forge auto base.apk
# Quick scan
apk-forge scan base.apk
# Find endpoints
apk-forge endpoints base.apk
# Extract secrets
apk-forge secrets base.apk
# Generate exploit
apk-forge exploit VULN-007
# Generate patch
apk-forge patch VULN-001
# Premium exploits
apk-forge premium com.banking.app
# List installed apps
apk-forge list
```
### Programmatic API
```typescript
import { APKAnalyzer, analyzeAPKTool } from '@opencode/apk-forge';
// Using the analyzer class
const analyzer = new APKAnalyzer();
const report = await analyzer.analyze('com.whatsapp');
// Using the tool function
const result = await analyzeAPKTool('base.apk');
```
## Command Reference
| Command | Description | Example |
|---------|-------------|---------|
| `/apk auto` | Full analysis suite | `/apk auto com.whatsapp` |
| `/apk scan` | Quick vulnerability scan | `/apk scan base.apk` |
| `/apk endpoints` | Find all endpoints | `/apk endpoints base.apk` |
| `/apk secrets` | Extract secrets | `/apk secrets base.apk` |
| `/apk exploit` | Generate exploit | `/apk exploit VULN-007` |
| `/apk patch` | Auto-patch vulnerability | `/apk patch VULN-001` |
| `/apk premium` | Premium exploits | `/apk premium com.app` |
| `/apk list` | List installed packages | `/apk list` |
## Vulnerability Detection
APKForge detects vulnerabilities based on OWASP MASVS:
| ID | Category | Description |
|----|----------|-------------|
| M1 | Improper Platform Usage | Debug mode, exported components |
| M2 | Insecure Data Storage | SharedPreferences, SQLite, external storage |
| M3 | Insecure Communication | HTTP, SSL bypass, cleartext traffic |
| M4 | Insecure Authentication | Hardcoded credentials, weak auth |
| M5 | Insufficient Cryptography | MD5, SHA1, DES, ECB mode |
| M6 | Insecure Authorization | Hardcoded roles, permission checks |
| M7 | Client Code Quality | WebView issues, JavaScript enabled |
| M8 | Code Tampering | No integrity verification |
| M9 | Reverse Engineering | No obfuscation detected |
| M10 | Extraneous Functionality | Debug code, test endpoints |
## Secret Detection
APKForge automatically detects:
- API Keys (Google, Stripe, GitHub, AWS)
- JWT Tokens
- Hardcoded Passwords
- Database URLs (MongoDB, MySQL, PostgreSQL)
- Firebase Configuration
- Private Keys & Certificates
- AWS Credentials
- OAuth Tokens
## Cross-Platform Support
| Platform | Status | Notes |
|----------|--------|-------|
| Termux | Supported | Both proot and non-root |
| Kali Linux | Supported | Full feature support |
| Ubuntu/Debian | Supported | Full feature support |
| macOS | Supported | Homebrew packages available |
| Windows | Supported | PowerShell compatible |
## Requirements
- **Node.js**: v16.0.0 or higher
- **ADB**: Android Debug Bridge for device communication
- **Decompiler**: jadx or apktool for APK decompilation
## Architecture
```
opencode-apk-forge/
โโโ src/
โ โโโ index.ts # Main plugin entry
โ โโโ banner.ts # Dark theme banner
โ โโโ cli.ts # Standalone CLI
โ โโโ core/
โ โ โโโ adb-wrapper.ts # ADB operations
โ โ โโโ analyzer.ts # Analysis engine
โ โ โโโ vuln-scanner.ts # Vulnerability detection
โ โ โโโ endpoint-finder.ts # Endpoint discovery
โ โ โโโ secret-extractor.ts # Secret extraction
โ โ โโโ exploit-generator.ts # Exploit generation
โ โ โโโ patch-engine.ts # Auto-patching
โ โ โโโ premium-exploits.ts # Premium exploits
โ โโโ commands/ # CLI commands
โ โโโ tools/ # AI tools
โ โโโ events/ # Event handlers
โ โโโ utils/ # Utilities
โโโ package.json
โโโ tsconfig.json
โโโ README.md
```
## Contributing
1. Fork the repository
2. Create your feature branch (`git checkout -b feature/amazing-feature`)
3. Commit your changes (`git commit -m 'Add amazing feature'`)
4. Push to the branch (`git push origin feature/amazing-feature`)
5. Open a Pull Request
## License
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
## Disclaimer
This tool is intended for authorized security testing and educational purposes only. Always obtain proper authorization before testing any application. The authors are not responsible for any misuse of this software.
## Support
- [GitHub Issues](https://github.com/xspeen/opencode-apk-forge/issues)
- [Documentation](https://github.com/xspeen/opencode-apk-forge#readme)
---
Made with by APKForge Team