Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was just wondering how could i check my client's Android application for SQL Injection or other similar kind of bugs.

I mean if its an application, where should i write the queries. If through ADB, then how?

share|improve this question
SANS course SEC 575 covers this quite well :D… – adric May 17 '12 at 14:39
up vote 2 down vote accepted

SQL injection requires that some part of the application can take input and be persuaded to pass it to a database as SQL commands, so testing all input fields with your SQL test strings is key.

John S's question on how to test for SQL injection on input fields is relevant whether those fields are in an application or on a website.

share|improve this answer

Check out the DB browser app, depending on the nature of the sqlite db in the app you can manually connect to the db and insert your own queries into it. For xss that by definition requires a user input so just test as normal, right?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.