A deliberately vulnerable mobile banking application designed for practicing mobile security testing. Features common vulnerabilities found in real-world applications, making it an ideal platform for security professionals, developers, and enthusiasts to learn mobile penetration testing..
commando-x/vuln-bank-mobile
Vulnerable Bank is an intentionally insecure mobile application built for security engineers, penetration testers, and mobile app security learners to practice and demonstrate real-world exploitation of insecure coding practices.
This mobile app acts as a frontend for the Vulnerable Bank API, a purposely vulnerable web API with typical banking features.
🆕 You can now download the compiled
.apkdirectly from GitHub Releases.
This APK includes all vulnerable features, static secrets, and works offline with your own hosted API server.
AndroidManifest.xmlSecurity professionals, students, and educators who want to:
git clone https://github.com/Commando-X/vuln-bank-mobile
cd vuln-bank-mobile
npm install
Start Metro server:
npx react-native start
In another terminal:
npx react-native run-android
⚠️ If testing on a real device, make sure to:
- Update
API_BASEinApp.tsxwith your server’s IP- Allow HTTP traffic by setting
android:usesCleartextTraffic="true"in your manifest
react-native-vector-iconsThis app is intended strictly for educational purposes.
Do NOT install this app on real production devices or use with real financial data.
All API endpoints are intentionally insecure and should only be used in isolated testing environments.
Badmus Al-Amir
Security Engineer • API Security Advocate • Mobile AppSec Educator
LinkedIn • GitHub
MIT — use it, break it, teach with it 🧠
