Hysen Labsvuln-bank-mobile
A deliberately vulnerable mobile banking application designed for practicing mobile security testing. Features common vulnerabilities found in real-world applications, making it an ideal platform for security professionals, developers, and enthusiasts to learn mobile penetration testing..
A banking app built to be broken into
Vulnerable Bank is an Android app full of deliberate flaws, a frontend for a purposely vulnerable API, aimed at security engineers, penetration testers, and people learning mobile AppSec.
Deliberately insecure
Vulnerable Bank is an intentionally insecure mobile application built for security engineers, penetration testers, and mobile app security learners. The point is to practice and demonstrate real-world exploitation of insecure coding practices. The app acts as a frontend for the Vulnerable Bank API, a purposely vulnerable web API with typical banking features.
The planted flaws
The intentional weaknesses are listed out. An insecure login with hardcoded credentials. A debug API endpoint exposed in the APK. Plaintext storage of credentials and balance in SharedPreferences. Hardcoded JWT tokens in the source code. The README maps these to OWASP Mobile Top 10 categories, so each flaw doubles as a lesson.
Who it is for
The intended uses are practical. Practicing Android security testing with tools like JADX, Frida, MobSF, and Burp Suite. Demonstrating OWASP Mobile Top 10 risks. Building or demoing mobile DevSecOps pipelines. Running capture-the-flag scenarios or internal red team labs. The challenges are concrete: extract the admin JWT, discover the debug API, and find credentials.
Running it and the caveat
For testing on a real device, the API base must be updated with the server IP, and cleartext HTTP traffic must be allowed in the manifest. The app is written in React Native with TypeScript, uses react-native-vector-icons, and is emulator-friendly. Secrets are deliberately placed in the Java or Kotlin source, in SharedPreferences, and in the manifest. The disclaimer is unambiguous: the app is strictly for educational purposes, should not be installed on real production devices or used with real financial data, and all API endpoints are intentionally insecure and belong only in isolated testing environments. The author is described as a security engineer and mobile AppSec educator.
Community notes