diva-android - DIVA Android - Damn Insecure and vulnerable App fo

项目说明

DI

---

What is DIVA?

DIVA (Damn insecure and App) is an App intentionally designed to be insecure. We are releasing the Android of Diva. We thought it would be a nice way to start the year by contributing something to the security community. The aim of the App is to teach de/QA/security professionals, flaws that are generally present in the Apps due poor or insecure coding practices. If you are reading this, you want to either learn App pentesting or secure coding and I sincerely hope that DI your purpose. So, sit back and enjoy the ride.

Why name it Diva?

No offense to anyone, but I was bored with the name DV* and decided to name it more fancy :)

Who can use Diva?

The idea originated, from a de’s perspective. The Android security training for de becomes slightly boring with lot of theory and not much hands-on. SO, I created DIVA for our Android de training. Di secure de learning. With that said, it is an excellent learning tool for aspiring Android penetration testers and security professionals as it gives an insight into app including the source code. To sum it up:
* Android App de
* Android Penetration testers
* Security professionals
* Students

What is included in Diva?

I tried to put as much as possible in a short period of time. I am sure I ha out on some . Please ping me if you know of a good tat can be included in Diva. It covers common in Android apps ranging from insecure storage, input to access control issues. I have also included few in native code, which makes it more interesting from the perspective of co both Java and C .

Current Challenges include:

1. Insecure Logging
2. Hardcoding Issues – Part 1
3. Insecure Data Storage – Part 1
4. Insecure Data Storage – Part 2
5. Insecure Data Storage – Part 3
6. Insecure Data Storage – Part 4
7. Input Issues – Part 1
8. Input Issues – Part 2
9. Access Control Issues – Part 1
10. Access Control Issues – Part 2
11. Access Control Issues – Part 3
12. Hardcoding Issues – Part 2
13. Input Issues – Part 3

Can I contribute?

Yes, you can help by sending us the details of that we can implement in future of Di send an email to info [at] payatu.com with subject “DI”.

Where can I get Diva?

* The Source can be downloaded from github -
* You can also download the debug of the app from

How to compile Diva?

* Download the source
* Open the project in Android Studio
* For Nati - open command line
* $ cd <Project-dir>/app/src/main/jni
* $ make (This needs to be done only once, unless you make changes to the native code - in which case run "make clean && make")
* This will compile the nati and copy all the compiled in directory jniLibs which is required when building the app
* From the menu bar: Build->Make Project or Run->Run App

How to run Diva?

* Compile/download the app
* On your phone settings. Go to security and check Unknown Sources checkbox. This allows you to install apps outside of play store. You don’t need to do this if you are installing the app on an emulator.
* Connect your phone to the computer (make sure USB debugging is enabled on your phone) or run the emulator.
* cd <app-directory>
* adb install <apk-file>
* Start playing.

Feedback and Bug reports?

We would love to hear from you about your experience with Di send us an email on info (at) payatu dot com with Subject “DI” or “DIVA BUG” based on what you want to share. Please include the below in your email
1. Android (and API if possible)
2. Phone make and model (or Emulator Android/API if using an emulator)
3. Feedback/Bug details and steps to reproduce.

Author

Aseem Jakhar

About Payatu

Payatu is a boutique security testing company with specialization in:
* IoT Security
* Mobile Security
* Cloud security
* Web Security

We also organize two International Security Conferences
* nullcon International Security Conference -
* hardwear.io Hardware Security Conference -

Website:
Email: info (at) payatu dot com

项目信息

开发语言：Java

Star 数：1149

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕DIVA Android - Damn Insecure and vulnerable App for Android展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。