1

I am thinking of trying to make an Android API fuzzer (I never made a fuzzer before, but I understand the concepts), and I was wondering which API calls would be the most interesting ones to fuzz from the security point of view? I think probably SQL, communication and networking stuff would be the place to start but I was wondering if there are any specific ones that I should pay attention to?

Improve this question
3
  • 1
    I'd suggest playing around with something a little more accessible first. An Android fuzzer requires you to write a lot of code that talks to the target device, which makes the process quite a bit more complex.
    – Polynomial
    Jul 26, 2012 at 11:53
  • @Polynomial - would it be plausible to create a fuzzer as an android app, and monitor the output of fuzzing through adb->logcat (android debug bridge (shell))? I thought that would give me the right kind of access to what the fuzzer would output.
    – tkit
    Jul 26, 2012 at 12:01
  • 1
    Yes, that's a viable solution. However, you're still going to need to capture the fault and dig through for info. I'm not telling you not to try it, I'm just saying it might be a good idea to try something local (e.g. Windows / Linux) first.
    – Polynomial
    Jul 26, 2012 at 12:05

1 Answer 1

Reset to default
1

There is a project building android fuzzers from the polytechnic institute of Singapore here: http://androidfuzzing.com/

Have a look what they are doing.

Improve this answer
1
  • At the time of writing the link is not working.
    – aignas
    Feb 12, 2016 at 16:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .