An intentionally vulnerable Android shopping app built in Kotlin for security education and penetration testing practice.
InsecureShop is an intentionally vulnerable Android application built in Kotlin that mimics a shopping app. It is designed to educate developers and security professionals about real-world Android security vulnerabilities by providing a safe, hands-on environment for penetration testing practice. The app contains 19 documented security flaws commonly found in production Android applications.
Android developers, mobile security professionals, penetration testers, and students learning about Android application security who want practical experience identifying and exploiting vulnerabilities.
Developers choose InsecureShop because it focuses on real-world vulnerabilities actually discovered in penetration tests, uses modern Kotlin code, and works on non-rooted devices—providing a more realistic and accessible learning platform than hypothetical vulnerable apps.
An Intentionally designed Vulnerable Android Application built in Kotlin.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Contains 19 documented security flaws actually found in production apps during penetration tests, providing practical, hands-on learning scenarios beyond hypothetical examples.
Built with Kotlin, reflecting current Android development practices, making it relevant for developers working on contemporary apps.
All vulnerabilities can be exploited on standard, non-rooted Android devices, increasing accessibility for testing without special hardware or permissions.
Serves as a hands-on lab for understanding Android Deeplinks, Webviews, and common misconfigurations, based on real research highlighted in the README.
The hints and documentation at docs.insecureshopapp.com are still under development, making self-guided learning challenging without external resources or community support.
The project has moved to a new GitHub repository (hax0rgb/InsecureShop), which could lead to outdated setup instructions or fragmentation in issue tracking and updates.
Focuses on a fixed set of 19 vulnerabilities, which may not cover emerging threats or all Android security aspects, such as advanced root exploits or API-based attacks.