Damn Vulnerable Hybrid Mobile App or DVHMA is a hybrid mobile app for Android that deliberately contains vulnerabilities. Its motivation is to empower security experts to test their tools and techniques legitimately, enable developers to better comprehend the normal pitfalls in developing hybrid mobile apps securely.
We assume that the
- Android SDK (https://developer.android.com/sdk/index.html) and
- Apache Cordova (https://cordova.apache.org/), version 8.0.0 (later versions might work)
Moreover, we assume a basic familiarity with the build system of Apache Cordova.
Also Read Libsodium – Easy To Use Software Library
Setting Environment Variables
export ANDROID_HOME=<Android SDK Installation Directory> export PATH=$ANDROID_HOME/tools:$PATH export PATH=$ANDROID_HOME/platform-tools:$PATH
cd DVHMA-Featherweight cordova plugin add ../plugins/DVHMA-Storage cordova plugin add ../plugins/DVHMA-WebIntent cordova platform add android cordova compile android
Running DVHMA in an Emulator
cordova run android
The development of this application started as part of the project ZertApps. ZertApps was a collaborative research project funded by the German Ministry for Research and Education. It is now developed and maintained by the Software Assurance & Security Research Team at The University of Sheffield, UK.
The core developers of DVHMA are:
- Achim D. Brucker and Michael Herzberg. On the Static Analysis of Hybrid Mobile Apps: A Report on the State of Apache Cordova Nation. In International Symposium on Engineering Secure Software and Systems (ESSoS). Lecture Notes in Computer Science (9639), pages 72-88, Springer-Verlag, 2016. https://www.brucker.ch/bibliography/abstract/brucker.ea-cordova-security-2016 doi: 10.1007/978-3-319-30806-7_5