A vulnerable Android CTF application demonstrating real-world security vulnerabilities and exploitation techniques.
InjuredAndroid is a deliberately vulnerable Android application designed for security education through Capture The Flag (CTF) challenges. It demonstrates real-world mobile security vulnerabilities based on bug bounty findings and creative exploitation scenarios. The app provides hands-on learning opportunities for understanding Android application security risks.
Security researchers, bug bounty hunters, penetration testers, and developers looking to understand Android security vulnerabilities and exploitation techniques.
Developers choose InjuredAndroid because it offers practical, CTF-style challenges based on real bug bounty findings rather than theoretical examples. It provides a safe environment to practice exploitation techniques that are actually encountered in security assessments.
A vulnerable Android application that shows simple examples of vulnerabilities in a ctf style.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Based on actual bug bounty findings, providing practical scenarios that mirror real security assessments encountered by researchers.
Includes up to three tips per challenge via exclamatory buttons, offering guidance without outright spoiling solutions, as noted in the README.
Captured flags are automatically registered in the Flags Overview activity, simplifying progress tracking for users.
Focuses on learning through doing, with challenges like WebView XSS that demonstrate creative exploitation techniques in a safe environment.
Requires ADB, Android Studio, Flutter, and NDK for building from source, as outlined in the README, which can be barrier for quick starts.
Decompiling the app is recommended, implying users need familiarity with reverse engineering tools and Android internals, not ideal for absolute beginners.
Focuses solely on client-side Android vulnerabilities, excluding server-side issues or broader mobile platform comparisons, which may narrow its educational value.