A Vulnerable Android Application built with Kotlin
Security Testers • Security Professionals • Security Enthusiasts • Developers
AndroGoat is a purposely developed open-source vulnerable/insecure application using Kotlin. It serves as a learning tool for security professionals and developers to understand, exploit, and defend against vulnerabilities in the Android platform. As the first vulnerable app developed natively in Kotlin, AndroGoat is the perfect solution for anyone looking to master modern Android Application Security Testing.
I strongly believe this AndroGoat will help many people to learn Android Application Security Testing.
Happy learning!
The MASTG lists AndroGoat as a reference app - https://mas.owasp.org/MASTG/apps/android/MASTG-APP-0001/
-
Download the APK: Grab the latest compiled APK from the releases page.
-
Install on Device/Emulator: Enable Unknown Sources on your Android device or emulator and install the APK.
- Certificate Pinning using Network Security Config
- Hardcoding issues - AI
- Hardcoding issues - Cloud Service
- Input Validations - QR Code
- Unprotected Android Components – Content Providers
- Biometric Authentication
- Root Detection
- Emulator Detection
- Insecure Data Storage – Shared Prefs - 1
- Insecure Data Storage - Shared Prefs - 2
- Insecure Data Storage - SQLite
- Insecure Data Storage – Temp Files
- Insecure Data Storage – SD Card
- Keyboard Cache
- Insecure Logging
- Input Validations – XSS
- Input Validations – SQLi
- Input Validations – WebView
- Input Validations - QR Code
- Unprotected Android Components – Activity
- Unprotected Android Components –Service
- Unprotected Android Components – Broadcast Receivers
- Unprotected Android Components – Content Providers
- Insecure Clipboard Usage
- Hardcoding issues - Shopping Cart
- Hardcoding issues - AI
- Hardcoding issues - Cloud Service
- Network intercepting – HTTP
- Network intercepting – HTTPS
- Network intercepting – Certificate Pinning - OKHTTP3
- Network intercepting – Certificate Pinning - Network Security Config
- Misconfigured Network_Security_Config.xml
- Android Debuggable
- Android allowBackup
- Custom URL Scheme
- Broken Cryptography
- Misconfigured Firebase DB
- Binary Patching
- Biometric Authentication
We welcome contributions from the community!
- Create a PR
- Reach me out on [email protected]
Documentation can be found at https://medium.com/androgoat
Love AndroGoat? Give us a ⭐ on GitHub!
