I am thinking of trying to make an Android API fuzzer (I never made a fuzzer before, but I understand the concepts), and I was wondering which API calls would be the most interesting ones to fuzz from the security point of view? I think probably SQL, communication and networking stuff would be the place to start but I was wondering if there are any specific ones that I should pay attention to?

  • 1
    I'd suggest playing around with something a little more accessible first. An Android fuzzer requires you to write a lot of code that talks to the target device, which makes the process quite a bit more complex. – Polynomial Jul 26 '12 at 11:53
  • @Polynomial - would it be plausible to create a fuzzer as an android app, and monitor the output of fuzzing through adb->logcat (android debug bridge (shell))? I thought that would give me the right kind of access to what the fuzzer would output. – pootzko Jul 26 '12 at 12:01
  • 1
    Yes, that's a viable solution. However, you're still going to need to capture the fault and dig through for info. I'm not telling you not to try it, I'm just saying it might be a good idea to try something local (e.g. Windows / Linux) first. – Polynomial Jul 26 '12 at 12:05

There is a project building android fuzzers from the polytechnic institute of Singapore here: http://androidfuzzing.com/

Have a look what they are doing.

| improve this answer | |
  • At the time of writing the link is not working. – aignas Feb 12 '16 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.