Neura Market
vuln-bank logo

vuln-bank

Free

A deliberately vulnerable banking application designed for practicing Security Testing of Web App, APIs, AI integrated App and secure code reviews. Features common vulnerabilities found in real-world

CybersecurityFreeFree tier
Type
Open Source
Visit Website GitHub (691 stars)

About vuln-bank

VulnBank is an intentionally vulnerable banking application designed to teach and practice application security testing, including web apps, APIs, and AI-integrated features. It provides a realistic banking environment with common real-world vulnerabilities, making it ideal for security professionals, developers, and tooling companies to benchmark SAST/DAST tools and offensive security AI agents. The platform includes money transfers, virtual cards, loans, bill payments, AI customer support, and a mobile Android app, all deliberately insecure for educational purposes.

Key Features

Deliberately insecure web and API endpoints for penetration testing practice
AI-integrated customer support chatbot with potential vulnerabilities for testing
Vulnerable Android mobile app for mobile security testing
Realistic banking features: money transfers, virtual cards, loans, bill payments
Designed to benchmark SAST/DAST tools and offensive security AI agents
Free and open-source platform for security education

Pros & Cons

Pros
  • Realistic banking scenario covers multiple attack surfaces (web, API, mobile, AI)
  • Free and open-source, easily accessible for learning and testing
  • Includes AI integration for testing AI-specific security flaws
  • Suitable for both manual pentesting and automated tool benchmarking
  • Active community with over 50K simulated accounts for realistic scale
Cons
  • Intentionally insecure - not suitable for production or real financial use
  • Limited to banking domain, may not cover other industry-specific vulnerabilities
  • Requires local setup or deployment; no hosted demo version mentioned

Best For

Learning web application security and penetration testing techniquesPracticing API security testing and secure code reviewBenchmarking SAST, DAST, and AI-based security toolsTraining security professionals and developers on common vulnerabilitiesTesting offensive AI agents in a controlled, realistic banking environment

Alternatives to vuln-bank

giskard-oss

🐢 Open-Source Evaluation & Testing library for LLM Agents

ai-captcha-bypass

AI Captcha Bypass

backdoor-learning-resources

A list of backdoor learning resources

claude-bug-bounty

AI-powered bug bounty hunting from your terminal - recon, 20 vuln classes, autonomous hunting, and report generation. All inside Claude Code.

agentic-radar

A security scanner for your LLM agentic workflows

FAQ

What is VulnBank?
VulnBank is an intentionally vulnerable banking application designed for security testing education and benchmarking of SAST/DAST tools and AI security agents.
Who is VulnBank for?
It is built for security professionals, developers, and tooling companies to practice pentesting, secure code review, and evaluate offensive security AI agents.
Is VulnBank free?
Yes, VulnBank is free and open source. You can open a free account on the website or run it locally.
What vulnerabilities does VulnBank include?
The application includes common real-world vulnerabilities across web, API, mobile, and AI-integrated features, such as those found in banking applications.
Can I use VulnBank to benchmark AI agents?
Yes, VulnBank is specifically designed to help benchmark traditional SAST/DAST tools and offensive security AI agents.