rewanthtammana / damn-vulnerable-bank

Damn Vulnerable Bank is designed to be an intentionally vulnerable android application. This provides an interface to assess your android application security hacking skills.

Damn Vulnerable Bank

Guide: https://rewanthtammana.com/damn-vulnerable-bank/

About application

Damn Vulnerable Bank is designed to be an intentionally vulnerable android application. All the details are documented in the guide, here.

Upcoming Sessions

NoNameCon

• https://cfp.nonamecon.org/nnc2021/talk/WCKLTN/

Black Hat Europe

• TBD

Features

• Sign up
• Login
• My profile interface
• Change password
• Settings interface to update backend URL
• Add fingerprint check before transferring/viewing funds
• Add pin check before transferring/viewing funds
• View balance
• Transfer money
  • Via manual entry
  • Via QR scan
• Add beneficiary
• Delete beneficiary
• View beneficiary
• View transactions history
• Download transactions history

List of vulnerabilities in the application

To keep things crisp and interesting, we hidden this section. Do not toggle this button if you want a fun and challenging experience. Try to explore the application, find all the possible vulnerabilities and then cross check your findings with this list.

Spoiler Alert

• Root and emulator detection
• Anti-debugging checks (prevents hooking with frida, jdb, etc)
• SSL pinning - pin the certificate/public key
• Obfuscate the entire code
• Encrypt all requests and responses
• Hardcoded sensitive information
• Logcat leakage
• Insecure storage (saved credit card numbers maybe)
• Exported activities
• JWT token
• Webview integration
• Deep links
• IDOR

Backend to-do

• Add profile and change-password routes
• Create different secrets for admin and other users
• Add dynamic generation of secrets to verify JWT tokens
• Introduce bug in jwt verification
• Find a way to store database and mount it while using docker
• Dockerize environment

Core Team

Damn Vulnerable Bank was created by

Rewanth Tammana (Rest API)	Github	LinkedIn
Akshansh Jaiswal (Android App)	Github	LinkedIn
Hrushikesh Kakade (Android App)	Github	LinkedIn

Read more, here.

Contributors

damn-vulnerable-bank's Issues

device dont see the backend IP

hello, i am running backend server on my computer, but device dont sea the IP, can you help me?

WebView Crashing

Hey! Is it bug or feature?)

Unable to setup in Genymotion Emulator

After installing the dvba.apk in genymotion error is showing
Please view the ss

Docker

node:19) UnhandledPromiseRejectionWarning: SequelizeHostNotFoundError: getaddrinfo ENOTFOUND mysql mysql:3306
at ConnectionManager.connect (/home/node/dvba/node_modules/sequelize/lib/dialects/mysql/connection-manager.js:120:17)
at process._tickCallback (internal/process/next_tick.js:68:7)
(node:19) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 1)
(node:19) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.

Very effective

Python

Process crashed: java.lang.OutOfMemoryError

Any solution regarding about this? When I try to login or signup the app crashes automatically.

Here's a screenshot of the errors

App doesn't start if phone is rooted

Is it normal that the app doesn't run if my phone is rooted? A "Phone is rooted" message appears and the app doesn't start. I'm not familiar with java so I don't know how to remove this block. I want to test only network and data exchange issues.
Thanks!

Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES]

Im using genymotion.

when I install the app I'm recieving this error
Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES]

any ideas.

Even if I drop the app directly it errors out.

error when starting the backendserver

I get this error when I try to start the backendserver

(node:320460) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag --unhandled-rejections=strict` (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 1)
(node:320460) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.
user@Latitude:~/Damn-Vulnerable-Bank/BackendServer$
online results say its something about not adding catch blocks to where promises are used. maybe issue is depricated packages?