# Vuln Bank Mobile: A Deliberately Broken Banking App for Android Security Practice

> Vuln Bank Mobile is an intentionally insecure React Native banking app that ships with hardcoded secrets, plaintext storage, and debug endpoints so testers can practice OWASP Mobile Top 10 attacks. It pairs with the Vulnerable Bank Flask API and can be installed as a prebuilt APK or built from source.

**Commando-X/vuln-bank-mobile** — A deliberately vulnerable mobile banking application designed for practicing mobile security testing. Features common vulnerabilities found in real-world applications, making it an ideal platform for security professionals, developers, and enthusiasts to learn mobile penetration testing..

- Repository: https://github.com/Commando-X/vuln-bank-mobile
- Stars: 105 · Forks: 44
- Language: TypeScript
- License: not declared
- Published: 2026-08-17 · Updated: 2026-08-18 · Language: en
- Canonical page: https://hysenlabs.com/projects/commando-x-vuln-bank-mobile

## A Banking App Built to Be Broken

Vuln Bank Mobile is a React Native application written in TypeScript that intentionally reproduces insecure coding practices found in real mobile banking apps. The README positions it as a training ground for security engineers, penetration testers, and students. It is the mobile frontend for the Vulnerable Bank API, a Flask-based web API that is also deliberately vulnerable. The app includes features you would expect from a banking product: balance checks, money transfers, transaction history, loans, virtual cards, and an admin-only hidden panel. But every one of those features is wired to a vulnerability. The project does not aim to be a realistic production app. It aims to be a realistic target. That distinction matters because the value is not in the UI, it is in the flaws you can find.

## What Vulnerabilities Are Built In

The README lists the OWASP Mobile Top 10 categories covered: M1 (Improper Platform Usage), M2 (Insecure Data Storage), M4 (Insecure Authentication), M5 (Insufficient Cryptography), and M9 (Reverse Engineering). Concretely, the app stores credentials and balance in SharedPreferences as plaintext. It ships with hardcoded JWT tokens in the source code. The AndroidManifest.xml exposes static secrets. There is a debug API endpoint that is discoverable in the APK, and insecure login uses hardcoded credentials. The README also mentions that secrets are deliberately placed in Java and Kotlin source code, SharedPreferences, and the manifest. For a tester, this means you can practice static analysis with JADX or MobSF, dynamic instrumentation with Frida, and network interception with Burp Suite. The app is designed to give you multiple entry points, so you are not forced into a single attack path.

## How to Get It Running

The recommended path is to download the prebuilt APK from the GitHub Releases page. The README says you just install it on an Android device, enable Install Unknown Apps, and start testing. That is the fastest route because you do not need to build anything. If you prefer to build from source, the requirements are Node.js 18 or newer, Android Studio with an emulator or physical device, Java JDK 11 or newer, and Git. The commands are straightforward: clone the repository, cd into the directory, run npm install, then start the Metro server with npx react-native start. In a second terminal, run npx react-native run-android. The README notes that if you test on a real device, you must update API_BASE in App.tsx with your server's IP and allow HTTP traffic by setting android:usesCleartextTraffic="true" in the manifest. That last step is a deliberate part of the exercise: cleartext traffic is exactly what you are supposed to learn to detect.

## The Companion API Is Part of the Deal

The mobile app is only the frontend. The README explicitly links to the Vulnerable Bank API, a Flask-based web API that is also intentionally vulnerable. This means the mobile app is not a standalone lab. To practice the full flow, you need to host that API somewhere reachable from your Android device. The README says the APK works offline with your own hosted API server, but that implies you must set up that server. The API_BASE configuration in App.tsx is the bridge between the two. If you skip the API, you lose the ability to test request tampering, authentication bypasses, and data exposure on the server side. The project is designed as a pair, and the mobile app alone gives you only half the picture. That is a practical constraint, not a flaw, but it is worth knowing before you start.

## What the Release History Tells You

The repository has three recent releases. Version 1.2.0 came out in May 2025, version 1.2.1 in July 2025, and version 1.3 in November 2025. The latest release is named VulnBank, and the previous one is Vuln Bank Latest. The naming is not descriptive, but the cadence suggests active maintenance. The README mentions that the APK includes all vulnerable features, static secrets, and works offline with your own hosted API server. That phrasing appears in the context of the latest release, so you can assume the prebuilt APK is current. There is no changelog in the README, so you cannot tell what changed between versions. If you rely on this project for training, you should check the release notes on GitHub for each version to understand what was added or fixed. The project is not archived, and the last push matches the latest release date, which is a good sign for ongoing upkeep.

## Where It Falls Short

The README is clear that this app is strictly for educational purposes and should never be installed on production devices or used with real financial data. That is a hard boundary. But there are subtler limitations. First, the app is a React Native project, so the vulnerabilities are implemented in JavaScript and native modules. If you want to practice iOS testing, there is no mention of an iOS build. The project appears Android-only. Second, the README lists challenges like extracting an admin JWT and discovering a debug API, but it does not provide a walkthrough or answer key. You are expected to figure it out with your own tools. That is fine for experienced testers, but beginners may struggle without guidance. Third, the app depends on the companion API, so if that API is not maintained or breaks, the mobile app loses its server-side attack surface. The README does not mention any fallback mode. Finally, the license is MIT, which is permissive, but the README also includes a disclaimer. That disclaimer is not a license, and you should read it as a warning, not legal advice.

## Alternatives and How They Differ

If Vuln Bank Mobile does not fit your needs, the most direct alternative is the original OWASP Mobile Security Testing Guide (MSTG) and its companion app, the OWASP UnCrackable Laptop. That project also provides intentionally vulnerable Android apps, but it focuses on reverse engineering and runtime tampering rather than a full banking feature set. Another alternative is InsecureBankv2, which is a deliberately vulnerable Android banking app that runs standalone without a separate API. The key difference is that InsecureBankv2 has a built-in server component, so you do not need to host a separate Flask API. Vuln Bank Mobile forces you to set up the companion API, which adds friction but also gives you a more realistic client-server architecture. If you want a pure mobile-only lab, InsecureBankv2 is simpler. If you want to practice API interaction as part of the mobile test, Vuln Bank Mobile is closer to a real engagement.

## Who Should Adopt It and What to Check First

Adopt Vuln Bank Mobile if you are a security professional or educator running a mobile security training lab, a CTF, or a red team exercise that needs a banking app with a matching API. It is also useful if you want to demo mobile DevSecOps pipelines, as the README suggests. Do not adopt it if you need a production-grade reference app or if you expect a fully self-contained mobile lab. Before you start, verify the latest release's APK integrity by checking the release notes on GitHub for any checksums. Confirm that your Android device or emulator is set to allow unknown apps. If you build from source, make sure you have Node.js 18+, JDK 11+, and Android Studio installed. Then update API_BASE in App.tsx to point to your hosted Vulnerable Bank API instance. The project is MIT licensed, so you can modify it freely, but the README's disclaimer means you are responsible for keeping it in an isolated testing environment. The project is active as of late 2025, but you should treat the companion API as a dependency that you must maintain yourself.

## Conclusion

Adopt Vuln Bank Mobile if you teach or practice Android penetration testing and need a realistic banking target with prebuilt APK and a matching vulnerable API. Do not use it for production or real financial data, as the README warns. Before you start, verify the APK checksum against the release notes, confirm your Android device allows unknown apps, and check the API_BASE setting in App.tsx if you build from source. The project is MIT licensed and actively maintained, but its value depends on your willingness to set up the companion API and your own testing tools.

## FAQ

### How to do security testing for mobile applications?

vuln-bank-mobile is built for exactly that practice. It ships hardcoded login credentials, JWT tokens in source, plaintext credentials in SharedPreferences, a debug API endpoint and static secrets in AndroidManifest.xml, and the README names JADX, Frida, MobSF and Burp Suite as the tools to point at it.

### What are vulnerable apps?

In this project a vulnerable app is one written on purpose to be broken. vuln-bank-mobile is an intentionally insecure banking client that emulates real features such as balance check, transfers and loans while planting the flaws a tester is meant to find and exploit.

### How do I install vuln-bank-mobile without building it?

Download the compiled .apk from the GitHub Releases page, enable Install Unknown Apps on the Android device, and install it. The README says the APK includes all vulnerable features and static secrets and works offline against your own hosted API server.

### What must I change to run vuln-bank-mobile on a physical device?

Update API_BASE in App.tsx with your server's IP, and allow HTTP traffic by setting android:usesCleartextTraffic="true" in the manifest. Without both, requests from a real device fail even though the app starts.

### What does vuln-bank-mobile need to run from source?

Node.js v18 or newer, Android Studio with an emulator or physical device, a Java JDK 11 or newer, and Git. The package.json engines field requires node >=18, and the build itself needs npm install followed by npx react-native start and npx react-native run-android.

### Is it safe to install vuln-bank-mobile on a real phone?

No. The README states the app is strictly for educational purposes, says not to install it on real production devices or use it with real financial data, and notes that all API endpoints are intentionally insecure and belong in isolated testing environments only.

## Sources

- [Official README](https://github.com/Commando-X/vuln-bank-mobile#readme)
- [Project repository](https://github.com/Commando-X/vuln-bank-mobile)
- [Release notes](https://github.com/Commando-X/vuln-bank-mobile/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/commando-x-vuln-bank-mobile