Damn Vulnerable Hybrid Mobile App (DVHMA) is an hybrid mobile app (for Android) that intentionally contains vulnerabilities.
您最多选择25个主题 主题必须以字母或数字开头,可以包含连字符 (-),并且长度不得超过35个字符
Achim D. Brucker 30f76ee118 Ignore Node/npm related tmp files. 1年前
DVHMA-Featherweight Minor configuration update. 1年前
DVHMA-OpenUI5 Moved Cordova version to 6.3.0 and updated compiled apps. 3 年前
plugins Initial commit of package.json. 1年前
releases Moved Cordova version to 6.3.0 and updated compiled apps. 3 年前
.gitignore Ignore Node/npm related tmp files. 1年前
CITATION Added citation information. 3 年前
LICENSE Initial commit 4 年前
README.md Added master repository URL. 1年前

README.md

DVHMA

Damn Vulnerable Hybrid Mobile App (DVHMA) is an hybrid mobile app (for Android) that intentionally contains vulnerabilities. Its purpose is to enable security professionals to test their tools and techniques legally, help developers better understand the common pitfalls in developing hybrid mobile apps securely.

Motivation and Scope

This app is developed to study pitfalls in developing hybrid apps, e.g., using Apache Cordova or SAP Kapsel, securely. Currently, the main focus is to develop a deeper understanding of injection vulnerabilities that exploit the JavaScript to Java bridge.

Installation

Prerequisites

We assume that the

Moreover, we assume a basic familiarity with the build system of Apache Cordova.

Building DVHMA

Setting Environment Variables

export ANDROID_HOME=<Android SDK Installation Directory>
export PATH=$ANDROID_HOME/tools:$PATH
export PATH=$ANDROID_HOME/platform-tools:$PATH

Compiling DVHMA

cd DVHMA-Featherweight
cordova plugin add ../plugins/DVHMA-Storage
cordova plugin add ../plugins/DVHMA-WebIntent 
cordova platform add android
cordova compile android

Running DVHMA in an Emulator

cordova run android 

Team Members

The development of this application started as part of the project ZertApps. ZertApps was a collaborative research project funded by the German Ministry for Research and Education. It is now developed and maintained by the Software Assurance & Security Research Team at The University of Sheffield, UK.

The core developers of DVHMA are:

License

This project is under the Apache 2.0 License.

SPDX-License-Identifier: Apache-2.0

Master Repository

The master git repository for this project is hosted by the Software Assurance & Security Research Team at https://git.logicalhacking.com/DASCA/DVHMA/.

Publications