Nilesh Kumar

The following functions needs to be inspected for XSS as they might be 'possible' pointers to XSS. They could be a pointer to possible xss attacks: eval() document.write() innerHTML() write() Safe function: Instead of using innerHTML, one should use innerText()   XSS payload in Jason and their effects: A nice example from iSec Partners: var inboundJSON = {"people": [ {"name": "Joel", "address": “<script>badStuff();</script>", "phone": “911"} ] }; someObject.innerHTML(inboundJSON.people[0].address);               // Vulnerable document.write(inboundJSON.people[0].address);                             // Vulnerable someObject.innerText(inboundJSON.people[0].address                     // Not Vulnerable

A nice article on a detailed assessment strategy of Android applications. Well explained and comprehensively written. Article describes different stages in android assessment, tools, methodologies and native tools with screenshots. You can find the article here: Android Application Assessmen t Also have a look at Web application Security Course offered by InfosecInstitute.