Damn Vulnerable Bank

Guide: https://rewanthtammana.com/damn-vulnerable-bank/

About application

Damn Vulnerable Bank is designed to be an intentionally vulnerable android application. All the details are documented in the guide, here.

Upcoming Sessions

NoNameCon

• https://cfp.nonamecon.org/nnc2021/talk/WCKLTN/

Black Hat Europe

• TBD

Features

• [x] Sign up
• [x] Login
• [x] My profile interface
• [x] Change password
• [x] Settings interface to update backend URL
• [x] Add fingerprint check before transferring/viewing funds
• [x] Add pin check before transferring/viewing funds
• [x] View balance
• [x] Transfer money
  • [x] Via manual entry
  • [ ] Via QR scan
• [x] Add beneficiary
• [x] Delete beneficiary
• [x] View beneficiary
• [x] View transactions history
• [ ] Download transactions history

List of vulnerabilities in the application

To keep things crisp and interesting, we hidden this section. Do not toggle this button if you want a fun and challenging experience. Try to explore the application, find all the possible vulnerabilities and then cross check your findings with this list.

Backend to-do

• [x] Add profile and change-password routes
• [ ] Create different secrets for admin and other users
• [ ] Add dynamic generation of secrets to verify JWT tokens
• [ ] Introduce bug in jwt verification
• [x] Find a way to store database and mount it while using docker
• [X] Dockerize environment

Core Team

Damn Vulnerable Bank was created by

Read more, here.

Contributors