Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I check if an Android application running on a not rooted device is "secure" without knowing its source?

I would look for:

  1. Plain text in Web-Requests (wireshark and emulator)

  2. SQL-injection (in EditTexts...)

  3. Doing stuff, that isn't always expected (i.e. fast clicking to check for race conditions)

Question: What else could be interesting for auditing Android apps?

share|improve this question
not sure if it can help, but see monkey. – bigstones Sep 12 '13 at 13:52
@bigstones Thank you! But I think The Monkey is better suited for automating testing scenarios. What I am looking for are test cases. – Kiril Sep 12 '13 at 13:54
Please define secure. Many apps are just a GUI for data stored on server. The server should then require secure API connections from the app, screen for SQL injections etc. – Petter Nordlander Oct 19 '13 at 18:54

One thing you might want to do is use a packet capture application to find out what the app is doing with the network. Is everything encrypted? What could a man-in-the-middle do?

share|improve this answer
Thanks for the link! Unfortunately it uses root to install tcpdump. But it would be a good to have a rooted phone for such testing scenarios. – Kiril Oct 19 '13 at 13:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.