I am thinking of trying to make an Android API fuzzer (I never made a fuzzer before, but I understand the concepts), and I was wondering which API calls would be the most interesting ones to fuzz from the security point of view? I think probably SQL, communication and networking stuff would be the place to start but I was wondering if there are any specific ones that I should pay attention to?

  • 1
    I'd suggest playing around with something a little more accessible first. An Android fuzzer requires you to write a lot of code that talks to the target device, which makes the process quite a bit more complex.
    – Polynomial
    Jul 26, 2012 at 11:53
  • @Polynomial - would it be plausible to create a fuzzer as an android app, and monitor the output of fuzzing through adb->logcat (android debug bridge (shell))? I thought that would give me the right kind of access to what the fuzzer would output.
    – tkit
    Jul 26, 2012 at 12:01
  • 1
    Yes, that's a viable solution. However, you're still going to need to capture the fault and dig through for info. I'm not telling you not to try it, I'm just saying it might be a good idea to try something local (e.g. Windows / Linux) first.
    – Polynomial
    Jul 26, 2012 at 12:05

1 Answer 1


There is a project building android fuzzers from the polytechnic institute of Singapore here: http://androidfuzzing.com/

Have a look what they are doing.

  • At the time of writing the link is not working.
    – aignas
    Feb 12, 2016 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.