Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was just wondering how could i check my client's Android application for SQL Injection or other similar kind of bugs.

I mean if its an application, where should i write the queries. If through ADB, then how?

share|improve this question
1  
SANS course SEC 575 covers this quite well :D sans.org/security-training/… –  adric May 17 '12 at 14:39
add comment

2 Answers

up vote 2 down vote accepted

SQL injection requires that some part of the application can take input and be persuaded to pass it to a database as SQL commands, so testing all input fields with your SQL test strings is key.

John S's question on how to test for SQL injection on input fields is relevant whether those fields are in an application or on a website.

share|improve this answer
add comment

Check out the DB browser app, depending on the nature of the sqlite db in the app you can manually connect to the db and insert your own queries into it. For xss that by definition requires a user input so just test as normal, right?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.