3

I was just wondering how could i check my client's Android application for SQL Injection or other similar kind of bugs.

I mean if its an application, where should i write the queries. If through ADB, then how?

Robert Shane
  • 115
  • 2
  • 6
  • 1
    SANS course SEC 575 covers this quite well :D https://www.sans.org/security-training/mobile-device-security-ethical-hacking-1671-mid – adric May 17 '12 at 14:39

2 Answers2

3

SQL injection requires that some part of the application can take input and be persuaded to pass it to a database as SQL commands, so testing all input fields with your SQL test strings is key.

John S's question on how to test for SQL injection on input fields is relevant whether those fields are in an application or on a website.

Community
  • 1
Rory Alsop
  • 61,367
  • 12
  • 115
  • 320
0

Check out the DB browser app, depending on the nature of the sqlite db in the app you can manually connect to the db and insert your own queries into it. For xss that by definition requires a user input so just test as normal, right?

KDEx
  • 4,981
  • 2
  • 20
  • 34