A hands-on reference for mobile security researchers, bug bounty hunters, and anyone preparing for Android penetration testing.
Press enter or click to view image in full size
Table of Contents
- Introduction
- Why Another Vulnerable App?
- The Build Pipeline
- Vulnerability Classes
- Lab Setup
- Key Lessons
- Get the Code
Introduction
When you are learning Android security, finding a real target to practice on is the hard part. Real apps have legal constraints, rate limits, and changing attack surfaces. Intentionally vulnerable apps like DIVA and InsecureBankv2 exist, but they are old, require Gradle to build, skip several vulnerability classes, and were not designed to reflect modern Android behavior (API 33+).
So I built one from scratch.
VulnLab is a purpose-built vulnerable Android app that covers all major vulnerability classes from the OWASP Mobile Top 10 and the Android attack surface. Every class has working exploit commands, real emulator screenshots, and source code annotated with…