DVAC: An intentionally vulnerable Android Application

by ddos · April 2, 2025

The Damne Vulnerable Android Components – DVAC

Damn Vulnerable Android Components (DVAC) is an educational Android application intentionally designed to expose and demonstrate vulnerabilities related to various Android components such as Activities, Intents, Content Providers, and Broadcast Receivers. It is structured as a password manager application to manage and store passwords securely (LOL).

Inspired by the pioneering work of the Sieve application, which focused on similar vulnerabilities but is now outdated and incompatible with newer Android versions, DVAC aims to fill the gap by providing a modern, up-to-date platform for learning about Android security. DVAC provides a hands-on learning experience for beginners in Android pentesting and cybersecurity and is developed while keeping beginners who find it difficult to get proper lab for learning Android pentesting.

Vulnerabilities

There are a total of 14 vulnerabilities in Damn Vulnerable Android Components –

Hardcoded Credentials
Bypass Login via Exported Activity
Insecure Storage
Insecure Exported Activity With Intent - Changing the password
Changing the Password via Broadcast Receiver
SQL Injection Content Provider
Path Traversal Content Provider
Exposed Service Over Ports
Exposed Service Over Messaging
Privilege Escalation - Pending Intent
Denial Of Service via Broadcast Receiver
Broadcast Sniffing
Access Non-Exported Activity
Access Non-Exported Content Provider

Why DVAC?

The development of DVAC was inspired by the Sieve APK, another vulnerable application focusing on Android component vulnerabilities. However, Sieve is outdated and does not function properly on newer versions of Android. DVAC aims to provide similar functionality while working on modern Android versions.