Skip to content

DVMA v1.0.0

Latest
Latest

Choose a tag to compare

View all tags
@cpeoples cpeoples released this 23 Sep 23:18
· 14 commits to main since this release
v1.0.0
e5efe1a

DVMA v1.0.0

First stable release of the Damn Vulnerable Mobile App (DVMA), a
cross-platform Flutter training app that reproduces real mobile-security
weaknesses as runnable, standards-mapped modules for authorized education,
tooling validation, and research.

Highlights

  • 218 intentional-vulnerability modules across 15 categories, each mapped to
    OWASP MASVS, MASWE, MASTG v2 and CWE.
  • Cross-platform: 202 modules on Android, 164 on iOS, sharing one Dart and
    native seam.
  • Coverage beyond the classic Mobile Top 10: OWASP LLM/GenAI Top 10, Agentic
    AI Top 10, LLM-over-IPC/WebView, and privileged system-provider activation.
  • Every module is generated from one registry (tool/generate.dart), which
    keeps the router, screen stubs, docs and vulnerability manifest in sync.
    CI fails if any of them drift.
  • Companion attacker app for exercising IPC, content-provider and deep-link
    attack surfaces against the target.
  • Documentation site with per-module writeups, standards mappings and device
    root/jailbreak guides: https://cpeoples.github.io/dvma/

Categories

Insecure Data Storage, Insufficient Cryptography, Insecure Authentication and
Authorization, Insecure Communication, Improper Platform Usage, Code Quality
and Build Config, Insufficient Resilience, Supply Chain, Privacy, Input
Validation, AI/ML (LLM/GenAI), Agentic AI, AI plus Mobile, Native/WebView
Bridge, and Privileged System-Provider Activation.

Artifacts

  • dvma-1.0.0.apk: signed Android APK. A genuine AOT release build that
    intentionally stays debuggable (CWE-489) for training.
  • dvma-1.0.0.aab: signed Android App Bundle.
  • dvma-1.0.0-unsigned.ipa: unsigned iOS build of the DVMA app (bundle id
    com.dvma). Free Apple IDs re-sign it locally; see the install guide in the
    docs.
  • dvma-attacker-1.0.0.apk: the companion attacker app (com.dvma.attacker),
    a separate debug-build Android app that drives DVMA's cross-app modules
    (OTP leak, exported-component invocation, broadcast spoofing, service
    binding, task hijacking). Install it alongside DVMA on the same device; it
    requests no special permissions and only does anything when driven.

Safety

DVMA is intentionally vulnerable. Install and run it only on devices and
networks you own and control, for authorized security education and testing.
Do not deploy it to production or expose it to untrusted networks.

Build

Flutter is pinned via .tool-versions. main is fully green in CI with caching
disabled, so every build is clean and reproducible: lint, unit/widget tests,
Android emulator integration, Android and iOS release smoke builds, and
instrumentation/XCUITest compilation.

Assets 6
Loading