Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Damn-Vulnerable-Bank — Intentionally vulnerable Android banking app for practicing mobile security testing, featuring root detection, anti-debugging, SSL pinning, and common web/mobile vulnerabilities. | Kitploit
Tools/GitHubGitHub/rewanthtammana/damn-vulnerable-bank
Android SecurityVulnerability AnalysisMobile App PentestingLearning & EducationLabs & Practice
GitHubrewanthtammana/damn-vulnerable-bank

Damn-Vulnerable-Bank

Intentionally vulnerable Android banking app for practicing mobile security testing, featuring root detection, anti-debugging, SSL pinning, and common web/mobile vulnerabilities.

View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
Website
755239102 years agoReviewed by Kitploit

Damn Vulnerable Bank

Guide: https://rewanthtammana.com/damn-vulnerable-bank/

About application

Damn Vulnerable Bank is designed to be an intentionally vulnerable android application. All the details are documented in the guide, here.

Guide overview

Upcoming Sessions

NoNameCon

  • https://cfp.nonamecon.org/nnc2021/talk/WCKLTN/

Black Hat Europe

  • TBD

Features

  • Sign up
  • Login
  • My profile interface
  • Change password
  • Settings interface to update backend URL
  • Add fingerprint check before transferring/viewing funds
  • Add pin check before transferring/viewing funds
  • View balance
  • Transfer money
    • Via manual entry
    • Via QR scan
  • Add beneficiary
  • Delete beneficiary
  • View beneficiary
  • View transactions history
  • Download transactions history

List of vulnerabilities in the application

To keep things crisp and interesting, we hidden this section. Do not toggle this button if you want a fun and challenging experience. Try to explore the application, find all the possible vulnerabilities and then cross check your findings with this list.

Spoiler Alert
  • Root and emulator detection
  • Anti-debugging checks (prevents hooking with frida, jdb, etc)
  • SSL pinning - pin the certificate/public key
  • Obfuscate the entire code
  • Encrypt all requests and responses
  • Hardcoded sensitive information
  • Logcat leakage
  • Insecure storage (saved credit card numbers maybe)
  • Exported activities
  • JWT token
  • Webview integration
  • Deep links
  • IDOR

Backend to-do

  • Add profile and change-password routes
  • Create different secrets for admin and other users
  • Add dynamic generation of secrets to verify JWT tokens
  • Introduce bug in jwt verification
  • Find a way to store database and mount it while using docker
  • Dockerize environment

Core Team

Damn Vulnerable Bank was created by

Read more, here.

Contributors

Download Tool
Rewanth Tammana (Rest API)GithubLinkedIn
Akshansh Jaiswal (Android App)GithubLinkedIn
Hrushikesh Kakade (Android App)GithubLinkedIn