How to find HTTP requests in apk source code

Question

I've extracted an apk(react native) with dex2jar and jar to java through jd-qui and also with apktool, and I can view the source code but there is no clue where are the HTTP requests in the source code.

When I intercept the apk traffic I can see all the requests to graphql endoint but I cannot see in the source code, where they are triggered or stored.

I searched the extracted source code with some keywords such as grahpql endpoint name, and the server address but still no result.

And the code seems not obfuscated to me, just some parts are like;

@Metadata(d1 = {"\000\026\n\002\030\002\n\002\020\000\n\000\n\002\020\002\n\000\n\002\030\002\n\000\bf\030\0002\0020\001J\020\020\002\032\0020\0032\006\020\004\032\0020\005H&\006\006"}, d2 = {"Lcom/shopify/arrive/E2EModule;", "", "launch", "", "intent", "Landroid/content/Intent;", "app_release"}, k = 1, mv = {1, 7, 1}, xi = 48)
public interface E2EModule {
  void launch(Intent paramIntent);
}

Is there any way to reach where these requests are triggered or stored on the source code?

This is the apk name, com.shopify.arrive

Answer 1

There are many ways you can try

First option is to Reverse engineer code into dex and decompile using any tool like fernflower or CFR. Then apply regex extract script to pull all the http links. Reference of code

Second option is to use pre-build tool like MobSF Automated tool which is used to extract http urls

Another possibility is that the developer of app has hide the urls/link in the splitted way or has encrypted it, in that case you can do dynamic analysis to fetch the urls along with the file from which url is being called.

Another possibility is that developer has hidden it in the binary usually written in C using JNI Java Native Interfaces. You can use tool like IDA or Ghidra to disassemble code to have sneak into it.Here is tool

There are some other ways too which can be explored if these doesn't work.