OWASP - User contributions [en]

Category:SWFIntruder

2008-06-11T15:52:36Z

Deanx: /* QuickStart */

== SWF Intruder Overview ==

[[Image:SWFIntruderSnapThumb.jpg|thumb|300px|right|SWFIntruder in action]]
SWFIntruder (pronounced Swiff Intruder) is the first tool specifically
developed for analyzing and testing security of Flash applications at runtime.
It helps to find flaws in Flash applications using the methodology originally
described by Stefano Di Paola in [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt Testing Flash Applications] (May 2007) and in
[http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt Finding Vulnerabilities in Flash Applications] (Nov 2007).

SWFIntruder was developed using ActionScript, Html and JavaScript resulting in
a tool taking advantage of the best features of those technologies in order to
get the best capabilities for analysis and interaction with the testing Flash movies.

SWFIntruder was developed by using only open source software.
Thanks to its generality, SWFIntruder is OS independant.

== Goals ==

SWFIntruder purpose is to analyze a Flash application for version =< 8 and to
help check in a semi automated fashion the presence of security issues like
Cross Site Scripting and Cross Site Flashing.

Moreover does help raise awareness around the subject of flash
applications security and how that can be used to and assist in the
security of applications.

== QuickStart ==

Tested on win32 and a few linux flavors.
Current version is 0.9.1.
Get it from [http://code.google.com/p/swfintruder/ Google code].

=== Latest Features ===

Permanent Preferences, Help Topics, ActionScript Object Explorer, Automated Xss testing fully customizable.

=== Video Tutorial ===

Watch ([http://video.google.it/videoplay?docid=6363609589793955143 medium quality]) or download ([http://www.mindedsecurity.com/labs/fileshare/SWFIntruderTutorial.swf high quality]) the flash tutorial taking you through some basic features of SWFIntruder.

=== Download ===

You can download the latest version of SWFIntruder from [http://code.google.com/p/swfintruder/ Google code].

== Requirements ==

1. Firefox 2.x [Needed]
2. FireBug Addon [Suggested]
3. Flash Player Plugin Ver >= 9 but < 9.0.124 [Needed]
4. Any Web Server [Needed]
5. Any OS [Needed :> ]

== Quick and Dirty Tutorial ==

* Download SWFIntruder latest version from Google Code.
* Uncompress it and save it somewhere in your webserver root directory.
* Browse to http://YourHost/swfintruderDir/.
'''Note''': Don't use '''[[localhost]]''' because Firefox will throw an exception.
better use 127.0.0.1 or 'your.FQDN.ltd'
* Use test.swf (a simple flawed swf movie) by filling the "Flash Movie Form" with http://YourHost/swfintruderDir/testSwf/test.swf '''or''' download a swf from some host and save it to an accessible path from your web server (http://YourHost/swfDirectory/external.swf).
* Fill the "Flash Movie" form with full URL pointing to the movie (http://YourHost/swfDirectory/test.swf) and click "Load".
* Wait 1 second for the test movie to be loaded.
* Enjoy browsing the objects.
* Test undefined variables by selecting some of them in the "Undefined Variables" and click 'start' on the Xss window.
* Wait for the test to be finished.
* If some XSS was found, it will be listed in the Xss area click on it to get the result on a new browser window.

== Features and Screenshots ==

* Basic predefined attack patterns.
* Highly customizable attacks.
* Highly customizable undefined variables.
* Semi automated Xss check.
* User configurable internal parameters.
* Log Window for debugging and tracking.
* History of latest 5 tested SWF files.
* ActionScript Objects runtime explorer in tree view.
* Persistent Configuration and Layout.

== Known Issues/Bugs ==

* You could get an error like the following:
*: '''Error: uncaught exception: [Exception... "Security error" code: "1000"'''
*: '''nsresult: "0x805303e8 (NS_ERROR_DOM_SECURITY_ERR)" location:'''
*: '''"http://localhost/swfintruder/js/globalStorage.js Line: 12"]'''
*:Try using the following [http://code.google.com/p/swfintruder/issues/detail?id=1 solutions].
* Sometime Firefox crashes. This is due to some problem in Firefox and not in SWF Intruder itself.
* If you use SWF Intruder under linux, the flash plugin eats a lot of memory.
* There's a pattern for which __resolve does not work:

frame 1 {
static.main(this)
}

*:where 'this' is _root but not explicitly set.

== Project Contributors ==

The Flash Security project is run by Stefano Di Paola. He can be contacted at '''stefano.dipaola AT mindedsecurity.com'''.

SWFintruder distributions are currently maintained on [[http://code.google.com/p/swfintruder/ Google code]].

== Project Sponsors ==

The SWF Intruder project is sponsored by
[http://www.mindedsecurity.com http://www.owasp.org/images/f/fe/MindedLogo.PNG]

Category:SWFIntruder

2008-06-11T15:52:05Z

Deanx: Changed flash requirements

== SWF Intruder Overview ==

[[Image:SWFIntruderSnapThumb.jpg|thumb|300px|right|SWFIntruder in action]]
SWFIntruder (pronounced Swiff Intruder) is the first tool specifically
developed for analyzing and testing security of Flash applications at runtime.
It helps to find flaws in Flash applications using the methodology originally
described by Stefano Di Paola in [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt Testing Flash Applications] (May 2007) and in
[http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt Finding Vulnerabilities in Flash Applications] (Nov 2007).

SWFIntruder was developed using ActionScript, Html and JavaScript resulting in
a tool taking advantage of the best features of those technologies in order to
get the best capabilities for analysis and interaction with the testing Flash movies.

SWFIntruder was developed by using only open source software.
Thanks to its generality, SWFIntruder is OS independant.

== Goals ==

SWFIntruder purpose is to analyze a Flash application for version =< 8 and to
help check in a semi automated fashion the presence of security issues like
Cross Site Scripting and Cross Site Flashing.

Moreover does help raise awareness around the subject of flash
applications security and how that can be used to and assist in the
security of applications.

== QuickStart ==

Tested on win32 and a few linux flavors.
Current version is 0.9.
Get it from [http://code.google.com/p/swfintruder/ Google code].

=== Latest Features ===

Permanent Preferences, Help Topics, ActionScript Object Explorer, Automated Xss testing fully customizable.

=== Video Tutorial ===

Watch ([http://video.google.it/videoplay?docid=6363609589793955143 medium quality]) or download ([http://www.mindedsecurity.com/labs/fileshare/SWFIntruderTutorial.swf high quality]) the flash tutorial taking you through some basic features of SWFIntruder.

=== Download ===

You can download the latest version of SWFIntruder from [http://code.google.com/p/swfintruder/ Google code].

== Requirements ==

1. Firefox 2.x [Needed]
2. FireBug Addon [Suggested]
3. Flash Player Plugin Ver >= 9 but < 9.0.124 [Needed]
4. Any Web Server [Needed]
5. Any OS [Needed :> ]

== Quick and Dirty Tutorial ==

* Download SWFIntruder latest version from Google Code.
* Uncompress it and save it somewhere in your webserver root directory.
* Browse to http://YourHost/swfintruderDir/.
'''Note''': Don't use '''[[localhost]]''' because Firefox will throw an exception.
better use 127.0.0.1 or 'your.FQDN.ltd'
* Use test.swf (a simple flawed swf movie) by filling the "Flash Movie Form" with http://YourHost/swfintruderDir/testSwf/test.swf '''or''' download a swf from some host and save it to an accessible path from your web server (http://YourHost/swfDirectory/external.swf).
* Fill the "Flash Movie" form with full URL pointing to the movie (http://YourHost/swfDirectory/test.swf) and click "Load".
* Wait 1 second for the test movie to be loaded.
* Enjoy browsing the objects.
* Test undefined variables by selecting some of them in the "Undefined Variables" and click 'start' on the Xss window.
* Wait for the test to be finished.
* If some XSS was found, it will be listed in the Xss area click on it to get the result on a new browser window.

== Features and Screenshots ==

* Basic predefined attack patterns.
* Highly customizable attacks.
* Highly customizable undefined variables.
* Semi automated Xss check.
* User configurable internal parameters.
* Log Window for debugging and tracking.
* History of latest 5 tested SWF files.
* ActionScript Objects runtime explorer in tree view.
* Persistent Configuration and Layout.

== Known Issues/Bugs ==

* You could get an error like the following:
*: '''Error: uncaught exception: [Exception... "Security error" code: "1000"'''
*: '''nsresult: "0x805303e8 (NS_ERROR_DOM_SECURITY_ERR)" location:'''
*: '''"http://localhost/swfintruder/js/globalStorage.js Line: 12"]'''
*:Try using the following [http://code.google.com/p/swfintruder/issues/detail?id=1 solutions].
* Sometime Firefox crashes. This is due to some problem in Firefox and not in SWF Intruder itself.
* If you use SWF Intruder under linux, the flash plugin eats a lot of memory.
* There's a pattern for which __resolve does not work:

frame 1 {
static.main(this)
}

*:where 'this' is _root but not explicitly set.

== Project Contributors ==

The Flash Security project is run by Stefano Di Paola. He can be contacted at '''stefano.dipaola AT mindedsecurity.com'''.

SWFintruder distributions are currently maintained on [[http://code.google.com/p/swfintruder/ Google code]].

== Project Sponsors ==

The SWF Intruder project is sponsored by
[http://www.mindedsecurity.com http://www.owasp.org/images/f/fe/MindedLogo.PNG]