Damn Vulnerable Hybrid Mobile App (DVHMA) is an hybrid mobile app (for
Android) that intentionally contains vulnerabilities. Its purpose is
to enable security professionals to test their tools and techniques
legally, help developers better understand the common pitfalls in
developing hybrid mobile apps securely.
Motivation and Scope
This app is developed to study pitfalls in developing hybrid apps,
e.g., using Apache Cordova or
securely. Currently, the main focus is to develop a deeper
to Java bridge.
We assume that the
Moreover, we assume a basic familiarity with the build system of
Setting Environment Variables
export ANDROID_HOME=<Android SDK Installation Directory>
cordova plugin add ../plugins/DVHMA-Storage
cordova plugin add ../plugins/DVHMA-WebIntent
cordova platform add android
cordova compile android
Running DVHMA in an Emulator
cordova run android
The development of this application started as part of the project
ZertApps. ZertApps was a collaborative
research project funded by the German Ministry for Research and
Education. It is now developed and maintained by the Software
Assurance & Security Research Team
at The University of Sheffield, UK.
The core developers of DVHMA are:
This project is under the Apache 2.0 License.
The master git repository for this project is hosted by the Software
Assurance & Security Research Team at