VulnBank — Application Security Assessment

Case summary

A controlled vulnerable-bank assessment spanning web, mobile, and source-code surfaces, with findings tied to account takeover, authorization, financial manipulation, data exposure, and insecure implementation.

Overview

The sections below are a concise case-file overview. The detailed assessment report is kept separate so the case page remains readable while the complete evidence and findings remain available to readers who want them.

Team engagement. This was a 12-person cohort engagement from my AfricaHackOn training. The report is the team’s, and this page summarizes the whole assessment.

Context

VulnBank is a deliberately vulnerable banking application, tested over 10 to 17 November 2025 as a simulated client engagement across three scoped assets: the website (vulnbank.org), the Android app (vulnbank.apk) and the GitHub source repository.

Objective

Show how weaknesses in the web app, API, mobile app and source code could affect account access, financial integrity and customer data, and report them with severity, proof of concept and remediation.

Scope and rules of engagement

Only the three assets above. No contact with staff, no out-of-scope exploitation, no data exfiltration, no denial of service, testing in off-peak hours, and every finding reported.

Approach

Passive and active reconnaissance (Nmap, Dirsearch, Nslookup), web and API testing with Burp Suite, source-code review of the repository, and mobile analysis with Jadx and MobSF.

Results: overall risk Critical

• Account takeover through a faulty password-reset flow, with a weak OTP (older API versions even return it). Critical.
• Privilege escalation and financial manipulation: self-assigning administrator access or changing a balance through registration or an intercepted request. Critical.
• Business-logic flaws: transfers did not validate negative or manipulated amounts, so balances could be increased. Critical.
• SQL injection and insecure data access: login bypass and retrieval of user data. High.
• Mobile weaknesses: no secure network validation, insecure storage and unsafe web views. High.

Impact

Full access to any customer account, fraudulent transactions, administrator control, exposure of internal secrets, and potential financial, reputational and regulatory damage.

Remediation priorities

Fix critical items within 48 hours, suspend new feature releases until resolved, require secure development and QA before release, and retest after fixes and before launch.

What I Learned

A small request-level trust failure becomes account takeover, a privacy breach or direct fraud once it reaches a sensitive banking function.