[TOOL] Add APKleaks & Deprecate APKEnum

[TheDauntless]

APKEnum is mentioned a few times in the MASTG, though it's Python 2.7 and doesn't look actively maintained. Let's remove the references from the MASTG and leave a deprecation note.

Add APKleaks as a MASTG-TOOL and replace references and potential examples used.

https://github.com/dwisiswant0/apkleaks/

[cpholguera]

Maybe we can replace it with the forked and updated version

https://github.com/furkanumut/APKLeakData

[jeel38]

@cpholguera
We can add apkleaks tool https://github.com/dwisiswant0/apkleaks which use python3 and activity maintained.
Please assign to me, i work on it.

[cpholguera]

Thanks for the suggestion @jeel38. Could you please select 2 widely used apps like WhatsApp and TikTok for example and run both

https://github.com/furkanumut/APKLeakData

and

https://github.com/dwisiswant0/apkleaks

on them so we can compare results and know if the tools complement each other or if they do the same, to see which one provides better results?

[jeel38]

@cpholguera

The apkleaks provides more information when compared to apkleakdata. Apkleaks provides custom regex rules that can be added to the json file https://github.com/dwisiswant0/apkleaks/blob/master/config/regexes.json

To run the tool using these custom rules, use the following command:

$ apkleaks -f /path/to/file.apk -p regexed.json -o ~/Documents/apkleaks-results.txt

WhatsApp

Apkleaks Result:	Apkleakdata:
Authorization_Basic	URLs
Generic_Secret	IP_Address
Google_API_Key	Google_API_Key
IP_Address
JSON_Web_Token
LinkFinder
URLs

Instagram

Apkleaks Result:	Apkleakdata:
Facebook_ClientID	URLs
Facebook_Secret_Key	IP_Address
Firebase	Google_API_Key
Google_API_Key
IP_Address
JSON_Web_Token
URLs

[cpholguera]

Awesome, thank you for checking that @jeel38! Would you like to help us create a MASTG-TOOL file for that?

Android tools live here: https://github.com/OWASP/owasp-mastg/tree/master/tools/android

You can simply create a file following the same style and structure of the rest. Like MASTG-TOOL-xxxx.md

To set the number xxxx in the filename please use the next ID available after sorting this table: https://mas.owasp.org/MASTG/tools/

Please also update this mention to @MASTG-TOOL-xxxx (with the new number)

https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0022/

[jeel38]

@cpholguera

Sure, Will work on it please assign to me.

[cpholguera]

It's yours. Thank you @jeel38!