Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What are some decent frameworks to test the security of Android applications?

With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for webapps) to have a good basis to start scanning.

OWASP has a guide that includes best practices for webapps. Often these are applicable as well to Android apps, but it would be nice if there is a dedicated framework.

share|improve this question
add comment

3 Answers

up vote 11 down vote accepted

Wireshark is a good tool to see if the application is sending sensitive data in cleartext over the network. Also, you can use ssh and adb to look at the data stored on the SD card and the file permissions, to see if sensitive data is being stored in cleartext.

Some free static analysis tools for Android applications:

  • Comdroid checks for vulnerabilities related to the use of Intents. See this presentation for description of those vulnerabilities, and other pitfalls.

  • Stowaway checks for overprivilege: i.e., it checks to see if the application requests permissions that its code doesn't seem to use.

Keep in mind that these are research tools. Moreover, they focus only on a very specific set of vulnerabilities. They are not a general-purpose static analysis tool, and are not substitute for a general-purpose security static analysis tool for Android (like Fortify); they are better thought of as a supplement for other tools available to you.

Some security static analysis vendors have support for analyzing Android applications, e.g., Fortify. Expect these to be expensive.

See also the following questions on this site:

share|improve this answer
add comment

There's Mercury from MWR Labs. I've not used it yet, but looks interesting.

share|improve this answer
add comment

Georgia Weidman published a framework on Android penetration testing here:

https://github.com/georgiaw/Smartphone-Pentest-Framework

She has a forum as well here and there is a nice teaser on vimeo.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.