DVAC: An intentionally vulnerable Android Application
The Damne Vulnerable Android Components – DVAC
Damn Vulnerable Android Components (DVAC) is an educational Android application intentionally designed to expose and demonstrate vulnerabilities related to various Android components such as Activities, Intents, Content Providers, and Broadcast Receivers. It is structured as a password manager application to manage and store passwords securely (LOL).
Inspired by the pioneering work of the Sieve application, which focused on similar vulnerabilities but is now outdated and incompatible with newer Android versions, DVAC aims to fill the gap by providing a modern, up-to-date platform for learning about Android security. DVAC provides a hands-on learning experience for beginners in Android pentesting and cybersecurity and is developed while keeping beginners who find it difficult to get proper lab for learning Android pentesting.
There are a total of 14 vulnerabilities in Damn Vulnerable Android Components –
- Hardcoded Credentials
- Bypass Login via Exported Activity
- Insecure Storage
- Insecure Exported Activity With Intent - Changing the password
- Changing the Password via Broadcast Receiver
- SQL Injection Content Provider
- Path Traversal Content Provider
- Exposed Service Over Ports
- Exposed Service Over Messaging
- Privilege Escalation - Pending Intent
- Denial Of Service via Broadcast Receiver
- Broadcast Sniffing
- Access Non-Exported Activity
- Access Non-Exported Content Provider
The development of DVAC was inspired by the Sieve APK, another vulnerable application focusing on Android component vulnerabilities. However, Sieve is outdated and does not function properly on newer versions of Android. DVAC aims to provide similar functionality while working on modern Android versions.
Download & Install
Copyright (C) 2024 zinja-coder
