Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am thinking of trying to make an Android API fuzzer (I never made a fuzzer before, but I understand the concepts), and I was wondering which API calls would be the most interesting ones to fuzz from the security point of view? I think probably SQL, communication and networking stuff would be the place to start but I was wondering if there are any specific ones that I should pay attention to?

share|improve this question
1  
I'd suggest playing around with something a little more accessible first. An Android fuzzer requires you to write a lot of code that talks to the target device, which makes the process quite a bit more complex. –  Polynomial Jul 26 '12 at 11:53
    
@Polynomial - would it be plausible to create a fuzzer as an android app, and monitor the output of fuzzing through adb->logcat (android debug bridge (shell))? I thought that would give me the right kind of access to what the fuzzer would output. –  pootzko Jul 26 '12 at 12:01
1  
Yes, that's a viable solution. However, you're still going to need to capture the fault and dig through for info. I'm not telling you not to try it, I'm just saying it might be a good idea to try something local (e.g. Windows / Linux) first. –  Polynomial Jul 26 '12 at 12:05

1 Answer 1

There is a project building android fuzzers from the polytechnic institute of Singapore here: http://androidfuzzing.com/

Have a look what they are doing.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.