Intentionally vulnerable Android application.
An Intentionally Vulnerable Android Application for Security Education
Features • Screenshots • Installation • Challenges • Contributing • Support
Allsafe is an intentionally vulnerable Android application designed for security enthusiasts, pentesters, and developers to learn about Android application security. Unlike typical CTF-style apps, Allsafe simulates a real-world application using modern libraries and technologies, providing a practical learning experience for identifying and exploiting Android vulnerabilities.
# Download the latest APK from releases
wget https://github.com/t0thkr1s/allsafe/releases/latest/download/allsafe.apk
# Install via ADB
adb install allsafe.apk
# Clone the repository
git clone https://github.com/t0thkr1s/allsafe.git
cd allsafe
# Build the APK
./gradlew assembleDebug
# Install the APK
adb install app/build/outputs/apk/debug/app-debug.apk
The application contains various security challenges organized by difficulty:
Simple information disclosure vulnerability. Use the logcat command-line tool to discover sensitive information.
adb shell 'pidof infosecadventures.allsafe'
adb shell 'logcat --pid [PID] | grep secret'
Some credentials are left in the code. Your task is to reverse engineer the app and find sensitive information.
This is purely for Frida practice. Make the code believe that your device is not rooted!
Loading modules securely with third-party apps are not easy. Write a PoC application and exploit the vulnerability!
Another Frida-based task. No real vulnerability here, just have fun bypassing the secure flag!
Certificate pinning is implemented using the OkHttp library. You have to bypass it in order to view the traffic with Burp Suite.
There's a vulnerable broadcast recevier in the application. Trigger it with the correct data and you're done!
Similar to the insecure broadcast receiver, you need to provide the right query parameter to complete this task!
Just a regular SQL injection that you'd find in web applications. No need to reverse the code to bypass the login mechanism.
You can also complete this task without decompiling the application. Pop an alert dialog and read files!
In this task, you have to modify the execution flow of the application by editing the Smali code. Finally, rebuild and sign the APK!
The application uses a native library that validates the entered password. Reverse engineer the library to find the password then use Frida to hook the native method.
Check out my collection of Frida scripts for Android pentesting: https://github.com/t0thkr1s/frida
Contributions are welcome! Whether you've found a bug, have a suggestion, or want to add a new challenge:
git checkout -b feature/AmazingFeature)git commit -m 'Add some AmazingFeature')git push origin feature/AmazingFeature)If you found this project helpful or valuable, please consider:
Bitcoin (BTC)
bc1qd44kvj6zatjgn27n45uxd3nprzt6rm9x9g2yc8
Ethereum (ETH)
0x1835a58E866a668C48Ee63d32432C7Fe28aF54b4
This application is designed for educational purposes only. It should only be used in controlled environments where you have explicit permission. The developers assume no liability and are not responsible for any misuse or damage caused by this application.
Do not use this application:
This project is licensed under the GNU General Public License v3.0 - see the LICENSE file for details.