Get hostnames and domains found in an Android application's code. Use this to discover backend servers, APIs, and third-party services that a mobile app communicates with. Requires an Android package ID. Returns a list of unique hostnames/domains extracted from the app.

Discover subdomains associated with a domain, as found across mobile applications indexed by BeVigil. Useful for attack surface mapping and asset discovery. Returns a list of unique subdomains. Note: Results come from mobile app analysis, not traditional DNS enumeration.

Get URLs associated with a domain, as discovered from mobile application analysis. Useful for finding API endpoints, web paths, and resources referenced by apps. Returns a list of full URLs. Results may include internal/staging endpoints that are not publicly indexed by search engines.

Find Amazon S3 bucket names referenced in an Android application's code. Useful for discovering cloud storage assets associated with a mobile app. These buckets may contain publicly accessible data if misconfigured. Note: Finding a bucket name does NOT confirm it is vulnerable or misconfigured — further investigation is required.

Find Android application packages that reference a given hostname or domain. Use this for reverse lookups — given a server/domain, discover which mobile apps communicate with it. Useful for understanding the app ecosystem around a service. Returns package IDs and app names where available.

Get a wordlist generated from an Android application's code. The wordlist includes URL paths, API endpoints, file paths, and parameters extracted from the app. Useful for fuzzing, directory brute-forcing, and understanding the app's API surface. Returns a list of path/endpoint strings.

Perform a comprehensive investigation of an Android application using BeVigil. This combines multiple lookups (hosts, S3 buckets, parameters, wordlist) into a single structured report. Use this when you need a broad overview of an app's exposed infrastructure rather than querying individual asset types. Returns a structured investigation summary with observed findings. Note: All findings are observed data — they do NOT indicate vulnerabilities without further analysis.