Apk Deeplink Hunt

Apk Deeplink Hunt

Overview

Identify deep link entry points and routing rules in decompiled APKs, then build and test candidate links that open specific screens or prefill fields.

Workflow

1) Establish inputs and scope

• Confirm decompile outputs (apktool + JADX paths) and the target flows/screens.
• Note the package name if you plan to target with adb.

2) Extract public deep link entry points

• Scan manifest for VIEW intent filters and data rules:
  • rg -n "intent-filter|ACTION_VIEW|VIEW" out-apktool/AndroidManifest.xml
  • rg -n "data android:scheme|data android:host|data android:path|data android:pathPrefix|data android:pathPattern" out-apktool/AndroidManifest.xml
• Record schemes, hosts, and path patterns.

3) Find the deep link router and normalization

• Locate the main activity and deep link handler:
  • rg -n "ACTION_VIEW|getIntent\\(|deep link|deeplink" out-jadx/sources
• Locate scheme normalization (custom schemes to https):
  • rg -n "normalize|scheme|kaspikz|kaspi" out-jadx/sources
• Note which schemes are accepted and how they are normalized.

4) Locate route patterns and screen selectors

• Search for route regex patterns like action://.../(.*) and for route keywords:
  • rg -n "action://|route|pattern|deeplink" out-jadx/sources
• Identify special segments (e.g., focusCard, focusPhone, confirm) and map them to screens.

5) Identify parameter keys for prefills

• Search for parameter key strings in validation or UI models:
  • rg -n "cardNumber|phoneNumber|amount|transferAmount|targetCardNumber" out-jadx/sources
• Capture the exact key names used by the flow.

6) Build candidate deep links

• Combine host/path pattern + route segment + query parameters.
• Prefer HTTPS if it is in the manifest; add custom schemes if present.

Example patterns:

• https://<host>/<path>/<segment>?key=value
• <scheme>://<host>/<path>/<segment>?key=value

7) Validate with adb

• Use the exact command format and confirm the resulting screen:
  • adb shell am start -W -a android.intent.action.VIEW -d "deep_link_here"
• If a link routes incorrectly, try:
  • Alternative scheme (custom vs https)
  • Different host that is listed in the manifest
  • Alternate parameter key (only if supported by the code)

8) Record results

• Write confirmed links into the target output file (e.g., Deeplinks.txt).
• Include required parameters and any notes (login required, optional amount, etc.).

References

Use this when you want a concise checklist and example patterns:

• apk-deeplink-hunt/references/checklist-and-examples.md

Examples

Sample user prompts for this skill:

• apk-deeplink-hunt/examples/example-prompts.md