https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=PuhleyOWASP - User contributions [en]2026-05-16T09:54:26ZUser contributionsMediaWiki 1.27.2https://wiki.owasp.org/index.php?title=OWASP_Machine_Learning_Resources&diff=231850OWASP Machine Learning Resources2017-07-26T00:18:10Z<p>Puhley: Added HTTP data set</p>
<hr />
<div><big>'''DRAFT VERSION'''</big><br /><br />
<br /><br />
<br /><br />
<br />
== Introduction ==<br />
<br /><br />
This page is intended to provide machine learning security resources for security researchers who are new to the field. It includes a few introductory resources for the basics of machine learning as well as examples of machine learning applied to security problems on different platforms. While there are many resources and conference talks available on the web, this page focuses on open-source projects and information that would be of interest to security researchers as a place to start learning. Rather than reinvent existing information, the approach of this page is to maintain context and accuracy by linking to original source materials. <br /><br />
<br /><br />
<br />
== Security Aspects of Machine Learning ==<br />
Machine Learning as it relates to security can be broken down into three broad categories.<br />
<br /><br />
# Adversarial Machine Learning - This technique attempts to confuse ML algorithms into returning the attacker's selected data instead of the expected response. <br />
# Machine learning for improved security analysis - Machine learning can be used in security log analysis in order to better detect or prevent attacks. Typical applications include detecting anomalies, predicting values, or classifying data into two or more categories.<br />
# Attacks against machine learning software - These attacks target the software that is being used for machine learning with the hopes of causing a denial-of-service attack or arbitrary code execution. These types of attacks typically result in a software patch for the impacted library or service.<br />
<br /><br />
<br />
== Getting Started with the Basics of Machine Learning ==<br />
There are many free videos and interactive demos for machine learning available on the web. These are just a few options: <br /><br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/playlist?list=PLOU2XLYxmsIIuiBfYad6rFYQU_jL2ryal Machine Learning Recipes with Josh Gordon] - This Google Developer YouTube series focuses on TensorFlow and SciKit learn. The target audience is people who are new to machine learning and are able to read Python. - Josh Gordon, Google Developer YouTube channel, 2017. <br /><br />
<br />
=== Hands On Learning ===<br />
* [http://playground.tensorflow.org/ Tensorflow Playground] - This web page allows you to play with neural networks from your web browser. The goal of the exercises are to design neural networks to match different data sets. <br /><br />
* [https://gallery.cortanaintelligence.com/Experiment/Binary-Classification-Network-intrusion-detection-2 Azure Binary Classification: Network Intrusion Detection] - This lab demonstrates intrusion detection security analysis using Azure's Machine Learning environment. The lab exercise can be performed using a free account. In addition, the Cortana Intelligence Gallery has other types of anomaly detection examples from Microsoft and other contributors available from this site. <br /><br />
<br />
=== Cheat Sheets ===<br />
* [http://download.microsoft.com/download/A/6/1/A613E11E-8F9C-424A-B99D-65344785C288/microsoft-machine-learning-algorithm-cheat-sheet-v6.pdf Microsoft Azure Machine Learning: Algorithm Cheat Sheet] - "This cheat sheet helps you choose the best Azure Machine Learning Studio algorithm for your predictive analytics solution. Your decision is driven by both the nature of your data and the question you’re trying to answer." Microsoft provides this documentation on how to interpret the cheat sheet: [https://docs.microsoft.com/en-us/azure/machine-learning/machine-learning-algorithm-choice How to choose algorithms for Microsoft Azure Machine Learning] While this reference is specific to Microsoft, many of the concepts are universal. <br /><br />
* [https://s3.amazonaws.com/assets.datacamp.com/blog_assets/Scikit_Learn_Cheat_Sheet_Python.pdf Python for data science cheat sheet] - A cheat sheet for the different Scikit machine learning Python modules. <br /><br />
* [http://scikit-learn.org/stable/tutorial/machine_learning_map/index.html Scikit Learn: Choosing the right estimator] - "The flowchart below is designed to give users a bit of a rough guide on how to approach problems with regard to which estimators to try on your data." <br /><br />
<br /><br />
<br />
== ML Security Resources == <br />
=== Consolidated Resource Sites ===<br />
* [https://www.mlsecproject.org/ MLSec Project] - "MLSec Project is a select community of like-minded individuals that want to work together on using machine learning and data science in information security. It features open source projects, blog posts and community content to help further the understanding of how this technology can help defenders handle the growing complexity and verbosity of their environments and tools."<br />
* [https://github.com/yenchenlin/awesome-adversarial-machine-learning Awesome Adversarial Machine Learning] - A github project which is "A curated list of awesome adversarial machine learning resources" including blogs, papers, and talks.<br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/watch?v=6Slj2FV9CLA Advances in Cloud-Scale Machine Learning for Cyberdefense] - "Picking an attacker's signals out of billions of log events in near real time from petabyte scale storage is a daunting task, but Microsoft has been using security data science at cloud scale to successfully disrupt attacker. This session presents the latest frameworks, techniques and the unconventional machine learning algorithms that Microsoft uses to protect its infrastructure and customers." - Mark Russinovich, BlueHat 2017 <br /><br />
* [https://www.youtube.com/watch?v=fRklX97iGIw Machine Learning and the Cloud: Disrupting Threat Detection and Prevention] - "Machine learning with large data sets gives unprecedented insights and anomaly detection capability. Learn how Microsoft uses the agility and scale of the cloud to protect its infrastructure and customers by applying data mining and machine learning algorithms and security domain learnings to the vast amounts of data and telemetry gathered by its many different systems and services." - Mark Russinovich, RSA USA 2016. <br /><br />
* [https://www.youtube.com/watch?v=Wh7nvpVQ_58 Predictive Security: Using Big Data to Fortify Your Defenses] - "This session shows you how to build a predictive analytics stack on AWS, which harnesses the power of Amazon Machine Learning in conjunction with Amazon Elasticsearch Service, AWS CloudTrail, and VPC Flow Logs to perform tasks such as anomaly detection and log analysis. We also demonstrate how you can use AWS Lambda to act on this information in an automated fashion, such as performing updates to AWS WAF and security groups, leading to an improved security posture and alleviating operational burden on your security teams." - Michael Capicotto & Matt Nowina, AWS re:Invent 2016 <br /><br />
<br />
=== Blogs ===<br />
* [https://blog.openai.com/adversarial-example-research/ Attacking Machine Learning with Adversarial Examples] - "In this post we’ll show how adversarial examples work across different mediums, and will discuss why securing systems against them can be difficult." - February 24, 2017 <br /><br />
<br /><br />
<br />
== Tools ==<br />
* [http://www.cs.waikato.ac.nz/ml/weka/ Weka] - "Weka is a collection of machine learning algorithms for data mining tasks. The algorithms can either be applied directly to a dataset or called from your own Java code. Weka contains tools for data pre-processing, classification, regression, clustering, association rules, and visualization. It is also well-suited for developing new machine learning schemes." <br /><br />
<br /><br />
<br />
== Languages and Libraries ==<br />
* [http://scikit-learn.org/stable/ Scikit-Learn] - Data mining and data analysis in Python that is built on NumPy, SciPy, and matplotlib. <br /><br />
<br />
* [https://www.tensorflow.org/ Tensor Flow] - TensorFlow™ is an open source software library for numerical computation using data flow graphs. Nodes in the graph represent mathematical operations, while the graph edges represent the multidimensional data arrays (tensors) communicated between them. The flexible architecture allows you to deploy computation to one or more CPUs or GPUs in a desktop, server, or mobile device with a single API. <br /><br />
<br />
* [https://www.r-project.org/ R Project] - The R language is widely used among statisticians and data miners for developing statistical software and data analysis. <br /><br />
<br />
* [https://www.continuum.io/downloads Anaconda] - "The open source version of Anaconda is a high performance distribution of Python and R and includes over 100 of the most popular Python, R and Scala packages for data science. ... If you don't have time or disk space for the entire distribution, try Miniconda which contains only conda and Python. Then install just the individual packages you want through the conda command." <br /><br />
<br />
* [https://keras.io/ Keras] - "Keras is a high-level neural networks API, written in Python and capable of running on top of either TensorFlow, CNTK or Theano. It was developed with a focus on enabling fast experimentation." <br /><br />
<br /><br />
<br />
== Data Sets ==<br />
* [http://archive.ics.uci.edu/ml/datasets.html UCI ML Data Sets] University of California, Irvine has a collection of machine learning data sets across many fields. Within their collection, their are security relevant data sets if you search for topics such as spam, phishing, etc. <br/><br />
<br />
* [http://www.isi.csic.es/dataset/ HTTP DATASET CSIC 2010] "The HTTP dataset CSIC 2010 contains thousands of web requests automatically generated. It can be used for the testing of web attack protection systems. It was developed at the “Information Security Institute” of CSIC (Spanish Research National Council)." <br /><br />
<br />
* [https://github.com/joshsaxe/eXposeDeepNeuralNetwork eXpose Deep Nueral Network] This is an open-source deep neural network project that attempts to detect malicious URLs, file paths and registry keys with proper training. Data sets can be found in the data/models directory the in the sample_scores.json files. <br/><br />
<br />
* [http://www.kdd.org/kdd-cup/view/kdd-cup-1999/Data KDD Cup 1999: Computer Network Intrusion Detection] The goal of the KDD Cup competition in 1999 was to learn a predictive model (i.e. a classifier) capable of distinguishing between legitimate and illegitimate connections in a computer network. This is a link to the large data set used for that competition. The other tabs on the page provide additional context on the data. <br/></div>Puhleyhttps://wiki.owasp.org/index.php?title=OWASP_Machine_Learning_Resources&diff=231849OWASP Machine Learning Resources2017-07-25T23:42:34Z<p>Puhley: Re-ordering</p>
<hr />
<div><big>'''DRAFT VERSION'''</big><br /><br />
<br /><br />
<br /><br />
<br />
== Introduction ==<br />
<br /><br />
This page is intended to provide machine learning security resources for security researchers who are new to the field. It includes a few introductory resources for the basics of machine learning as well as examples of machine learning applied to security problems on different platforms. While there are many resources and conference talks available on the web, this page focuses on open-source projects and information that would be of interest to security researchers as a place to start learning. Rather than reinvent existing information, the approach of this page is to maintain context and accuracy by linking to original source materials. <br /><br />
<br /><br />
<br />
== Security Aspects of Machine Learning ==<br />
Machine Learning as it relates to security can be broken down into three broad categories.<br />
<br /><br />
# Adversarial Machine Learning - This technique attempts to confuse ML algorithms into returning the attacker's selected data instead of the expected response. <br />
# Machine learning for improved security analysis - Machine learning can be used in security log analysis in order to better detect or prevent attacks. Typical applications include detecting anomalies, predicting values, or classifying data into two or more categories.<br />
# Attacks against machine learning software - These attacks target the software that is being used for machine learning with the hopes of causing a denial-of-service attack or arbitrary code execution. These types of attacks typically result in a software patch for the impacted library or service.<br />
<br /><br />
<br />
== Getting Started with the Basics of Machine Learning ==<br />
There are many free videos and interactive demos for machine learning available on the web. These are just a few options: <br /><br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/playlist?list=PLOU2XLYxmsIIuiBfYad6rFYQU_jL2ryal Machine Learning Recipes with Josh Gordon] - This Google Developer YouTube series focuses on TensorFlow and SciKit learn. The target audience is people who are new to machine learning and are able to read Python. - Josh Gordon, Google Developer YouTube channel, 2017. <br /><br />
<br />
=== Hands On Learning ===<br />
* [http://playground.tensorflow.org/ Tensorflow Playground] - This web page allows you to play with neural networks from your web browser. The goal of the exercises are to design neural networks to match different data sets. <br /><br />
* [https://gallery.cortanaintelligence.com/Experiment/Binary-Classification-Network-intrusion-detection-2 Azure Binary Classification: Network Intrusion Detection] - This lab demonstrates intrusion detection security analysis using Azure's Machine Learning environment. The lab exercise can be performed using a free account. In addition, the Cortana Intelligence Gallery has other types of anomaly detection examples from Microsoft and other contributors available from this site. <br /><br />
<br />
=== Cheat Sheets ===<br />
* [http://download.microsoft.com/download/A/6/1/A613E11E-8F9C-424A-B99D-65344785C288/microsoft-machine-learning-algorithm-cheat-sheet-v6.pdf Microsoft Azure Machine Learning: Algorithm Cheat Sheet] - "This cheat sheet helps you choose the best Azure Machine Learning Studio algorithm for your predictive analytics solution. Your decision is driven by both the nature of your data and the question you’re trying to answer." Microsoft provides this documentation on how to interpret the cheat sheet: [https://docs.microsoft.com/en-us/azure/machine-learning/machine-learning-algorithm-choice How to choose algorithms for Microsoft Azure Machine Learning] While this reference is specific to Microsoft, many of the concepts are universal. <br /><br />
* [https://s3.amazonaws.com/assets.datacamp.com/blog_assets/Scikit_Learn_Cheat_Sheet_Python.pdf Python for data science cheat sheet] - A cheat sheet for the different Scikit machine learning Python modules. <br /><br />
* [http://scikit-learn.org/stable/tutorial/machine_learning_map/index.html Scikit Learn: Choosing the right estimator] - "The flowchart below is designed to give users a bit of a rough guide on how to approach problems with regard to which estimators to try on your data." <br /><br />
<br /><br />
<br />
== ML Security Resources == <br />
=== Consolidated Resource Sites ===<br />
* [https://www.mlsecproject.org/ MLSec Project] - "MLSec Project is a select community of like-minded individuals that want to work together on using machine learning and data science in information security. It features open source projects, blog posts and community content to help further the understanding of how this technology can help defenders handle the growing complexity and verbosity of their environments and tools."<br />
* [https://github.com/yenchenlin/awesome-adversarial-machine-learning Awesome Adversarial Machine Learning] - A github project which is "A curated list of awesome adversarial machine learning resources" including blogs, papers, and talks.<br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/watch?v=6Slj2FV9CLA Advances in Cloud-Scale Machine Learning for Cyberdefense] - "Picking an attacker's signals out of billions of log events in near real time from petabyte scale storage is a daunting task, but Microsoft has been using security data science at cloud scale to successfully disrupt attacker. This session presents the latest frameworks, techniques and the unconventional machine learning algorithms that Microsoft uses to protect its infrastructure and customers." - Mark Russinovich, BlueHat 2017 <br /><br />
* [https://www.youtube.com/watch?v=fRklX97iGIw Machine Learning and the Cloud: Disrupting Threat Detection and Prevention] - "Machine learning with large data sets gives unprecedented insights and anomaly detection capability. Learn how Microsoft uses the agility and scale of the cloud to protect its infrastructure and customers by applying data mining and machine learning algorithms and security domain learnings to the vast amounts of data and telemetry gathered by its many different systems and services." - Mark Russinovich, RSA USA 2016. <br /><br />
* [https://www.youtube.com/watch?v=Wh7nvpVQ_58 Predictive Security: Using Big Data to Fortify Your Defenses] - "This session shows you how to build a predictive analytics stack on AWS, which harnesses the power of Amazon Machine Learning in conjunction with Amazon Elasticsearch Service, AWS CloudTrail, and VPC Flow Logs to perform tasks such as anomaly detection and log analysis. We also demonstrate how you can use AWS Lambda to act on this information in an automated fashion, such as performing updates to AWS WAF and security groups, leading to an improved security posture and alleviating operational burden on your security teams." - Michael Capicotto & Matt Nowina, AWS re:Invent 2016 <br /><br />
<br />
=== Blogs ===<br />
* [https://blog.openai.com/adversarial-example-research/ Attacking Machine Learning with Adversarial Examples] - "In this post we’ll show how adversarial examples work across different mediums, and will discuss why securing systems against them can be difficult." - February 24, 2017 <br /><br />
<br /><br />
<br />
== Tools ==<br />
* [http://www.cs.waikato.ac.nz/ml/weka/ Weka] - "Weka is a collection of machine learning algorithms for data mining tasks. The algorithms can either be applied directly to a dataset or called from your own Java code. Weka contains tools for data pre-processing, classification, regression, clustering, association rules, and visualization. It is also well-suited for developing new machine learning schemes." <br /><br />
<br /><br />
<br />
== Languages and Libraries ==<br />
* [http://scikit-learn.org/stable/ Scikit-Learn] - Data mining and data analysis in Python that is built on NumPy, SciPy, and matplotlib. <br /><br />
<br />
* [https://www.tensorflow.org/ Tensor Flow] - TensorFlow™ is an open source software library for numerical computation using data flow graphs. Nodes in the graph represent mathematical operations, while the graph edges represent the multidimensional data arrays (tensors) communicated between them. The flexible architecture allows you to deploy computation to one or more CPUs or GPUs in a desktop, server, or mobile device with a single API. <br /><br />
<br />
* [https://www.r-project.org/ R Project] - The R language is widely used among statisticians and data miners for developing statistical software and data analysis. <br /><br />
<br />
* [https://www.continuum.io/downloads Anaconda] - "The open source version of Anaconda is a high performance distribution of Python and R and includes over 100 of the most popular Python, R and Scala packages for data science. ... If you don't have time or disk space for the entire distribution, try Miniconda which contains only conda and Python. Then install just the individual packages you want through the conda command." <br /><br />
<br />
* [https://keras.io/ Keras] - "Keras is a high-level neural networks API, written in Python and capable of running on top of either TensorFlow, CNTK or Theano. It was developed with a focus on enabling fast experimentation." <br /><br />
<br /><br />
<br />
== Data Sets ==<br />
* [http://archive.ics.uci.edu/ml/datasets.html UCI ML Data Sets] University of California, Irvine has a collection of machine learning data sets across many fields. Within their collection, their are security relevant data sets if you search for topics such as spam, phishing, etc. <br/><br />
<br />
* [https://github.com/joshsaxe/eXposeDeepNeuralNetwork eXpose Deep Nueral Network] This is an open-source deep neural network project that attempts to detect malicious URLs, file paths and registry keys with proper training. Data sets can be found in the data/models directory the in the sample_scores.json files. <br/><br />
<br />
* [http://www.kdd.org/kdd-cup/view/kdd-cup-1999/Data KDD Cup 1999: Computer Network Intrusion Detection] The goal of the KDD Cup competition in 1999 was to learn a predictive model (i.e. a classifier) capable of distinguishing between legitimate and illegitimate connections in a computer network. This is a link to the large data set used for that competition. The other tabs on the page provide additional context on the data. <br/></div>Puhleyhttps://wiki.owasp.org/index.php?title=OWASP_Machine_Learning_Resources&diff=231848OWASP Machine Learning Resources2017-07-25T23:40:22Z<p>Puhley: Adding UCI ML data sets</p>
<hr />
<div><big>'''DRAFT VERSION'''</big><br /><br />
<br /><br />
<br /><br />
<br />
== Introduction ==<br />
<br /><br />
This page is intended to provide machine learning security resources for security researchers who are new to the field. It includes a few introductory resources for the basics of machine learning as well as examples of machine learning applied to security problems on different platforms. While there are many resources and conference talks available on the web, this page focuses on open-source projects and information that would be of interest to security researchers as a place to start learning. Rather than reinvent existing information, the approach of this page is to maintain context and accuracy by linking to original source materials. <br /><br />
<br /><br />
<br />
== Security Aspects of Machine Learning ==<br />
Machine Learning as it relates to security can be broken down into three broad categories.<br />
<br /><br />
# Adversarial Machine Learning - This technique attempts to confuse ML algorithms into returning the attacker's selected data instead of the expected response. <br />
# Machine learning for improved security analysis - Machine learning can be used in security log analysis in order to better detect or prevent attacks. Typical applications include detecting anomalies, predicting values, or classifying data into two or more categories.<br />
# Attacks against machine learning software - These attacks target the software that is being used for machine learning with the hopes of causing a denial-of-service attack or arbitrary code execution. These types of attacks typically result in a software patch for the impacted library or service.<br />
<br /><br />
<br />
== Getting Started with the Basics of Machine Learning ==<br />
There are many free videos and interactive demos for machine learning available on the web. These are just a few options: <br /><br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/playlist?list=PLOU2XLYxmsIIuiBfYad6rFYQU_jL2ryal Machine Learning Recipes with Josh Gordon] - This Google Developer YouTube series focuses on TensorFlow and SciKit learn. The target audience is people who are new to machine learning and are able to read Python. - Josh Gordon, Google Developer YouTube channel, 2017. <br /><br />
<br />
=== Hands On Learning ===<br />
* [http://playground.tensorflow.org/ Tensorflow Playground] - This web page allows you to play with neural networks from your web browser. The goal of the exercises are to design neural networks to match different data sets. <br /><br />
* [https://gallery.cortanaintelligence.com/Experiment/Binary-Classification-Network-intrusion-detection-2 Azure Binary Classification: Network Intrusion Detection] - This lab demonstrates intrusion detection security analysis using Azure's Machine Learning environment. The lab exercise can be performed using a free account. In addition, the Cortana Intelligence Gallery has other types of anomaly detection examples from Microsoft and other contributors available from this site. <br /><br />
<br />
=== Cheat Sheets ===<br />
* [http://download.microsoft.com/download/A/6/1/A613E11E-8F9C-424A-B99D-65344785C288/microsoft-machine-learning-algorithm-cheat-sheet-v6.pdf Microsoft Azure Machine Learning: Algorithm Cheat Sheet] - "This cheat sheet helps you choose the best Azure Machine Learning Studio algorithm for your predictive analytics solution. Your decision is driven by both the nature of your data and the question you’re trying to answer." Microsoft provides this documentation on how to interpret the cheat sheet: [https://docs.microsoft.com/en-us/azure/machine-learning/machine-learning-algorithm-choice How to choose algorithms for Microsoft Azure Machine Learning] While this reference is specific to Microsoft, many of the concepts are universal. <br /><br />
* [https://s3.amazonaws.com/assets.datacamp.com/blog_assets/Scikit_Learn_Cheat_Sheet_Python.pdf Python for data science cheat sheet] - A cheat sheet for the different Scikit machine learning Python modules. <br /><br />
* [http://scikit-learn.org/stable/tutorial/machine_learning_map/index.html Scikit Learn: Choosing the right estimator] - "The flowchart below is designed to give users a bit of a rough guide on how to approach problems with regard to which estimators to try on your data." <br /><br />
<br /><br />
<br />
== ML Security Resources == <br />
=== Consolidated Resource Sites ===<br />
* [https://www.mlsecproject.org/ MLSec Project] - "MLSec Project is a select community of like-minded individuals that want to work together on using machine learning and data science in information security. It features open source projects, blog posts and community content to help further the understanding of how this technology can help defenders handle the growing complexity and verbosity of their environments and tools."<br />
* [https://github.com/yenchenlin/awesome-adversarial-machine-learning Awesome Adversarial Machine Learning] - A github project which is "A curated list of awesome adversarial machine learning resources" including blogs, papers, and talks.<br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/watch?v=6Slj2FV9CLA Advances in Cloud-Scale Machine Learning for Cyberdefense] - "Picking an attacker's signals out of billions of log events in near real time from petabyte scale storage is a daunting task, but Microsoft has been using security data science at cloud scale to successfully disrupt attacker. This session presents the latest frameworks, techniques and the unconventional machine learning algorithms that Microsoft uses to protect its infrastructure and customers." - Mark Russinovich, BlueHat 2017 <br /><br />
* [https://www.youtube.com/watch?v=fRklX97iGIw Machine Learning and the Cloud: Disrupting Threat Detection and Prevention] - "Machine learning with large data sets gives unprecedented insights and anomaly detection capability. Learn how Microsoft uses the agility and scale of the cloud to protect its infrastructure and customers by applying data mining and machine learning algorithms and security domain learnings to the vast amounts of data and telemetry gathered by its many different systems and services." - Mark Russinovich, RSA USA 2016. <br /><br />
* [https://www.youtube.com/watch?v=Wh7nvpVQ_58 Predictive Security: Using Big Data to Fortify Your Defenses] - "This session shows you how to build a predictive analytics stack on AWS, which harnesses the power of Amazon Machine Learning in conjunction with Amazon Elasticsearch Service, AWS CloudTrail, and VPC Flow Logs to perform tasks such as anomaly detection and log analysis. We also demonstrate how you can use AWS Lambda to act on this information in an automated fashion, such as performing updates to AWS WAF and security groups, leading to an improved security posture and alleviating operational burden on your security teams." - Michael Capicotto & Matt Nowina, AWS re:Invent 2016 <br /><br />
<br />
=== Blogs ===<br />
* [https://blog.openai.com/adversarial-example-research/ Attacking Machine Learning with Adversarial Examples] - "In this post we’ll show how adversarial examples work across different mediums, and will discuss why securing systems against them can be difficult." - February 24, 2017 <br /><br />
<br /><br />
<br />
== Tools ==<br />
* [http://www.cs.waikato.ac.nz/ml/weka/ Weka] - "Weka is a collection of machine learning algorithms for data mining tasks. The algorithms can either be applied directly to a dataset or called from your own Java code. Weka contains tools for data pre-processing, classification, regression, clustering, association rules, and visualization. It is also well-suited for developing new machine learning schemes." <br /><br />
<br /><br />
<br />
== Languages and Libraries ==<br />
* [http://scikit-learn.org/stable/ Scikit-Learn] - Data mining and data analysis in Python that is built on NumPy, SciPy, and matplotlib. <br /><br />
<br />
* [https://www.tensorflow.org/ Tensor Flow] - TensorFlow™ is an open source software library for numerical computation using data flow graphs. Nodes in the graph represent mathematical operations, while the graph edges represent the multidimensional data arrays (tensors) communicated between them. The flexible architecture allows you to deploy computation to one or more CPUs or GPUs in a desktop, server, or mobile device with a single API. <br /><br />
<br />
* [https://www.r-project.org/ R Project] - The R language is widely used among statisticians and data miners for developing statistical software and data analysis. <br /><br />
<br />
* [https://www.continuum.io/downloads Anaconda] - "The open source version of Anaconda is a high performance distribution of Python and R and includes over 100 of the most popular Python, R and Scala packages for data science. ... If you don't have time or disk space for the entire distribution, try Miniconda which contains only conda and Python. Then install just the individual packages you want through the conda command." <br /><br />
<br />
* [https://keras.io/ Keras] - "Keras is a high-level neural networks API, written in Python and capable of running on top of either TensorFlow, CNTK or Theano. It was developed with a focus on enabling fast experimentation." <br /><br />
<br /><br />
<br />
== Data Sets ==<br />
* [http://www.kdd.org/kdd-cup/view/kdd-cup-1999/Data KDD Cup 1999: Computer Network Intrusion Detection] The goal of the KDD Cup competition in 1999 was to learn a predictive model (i.e. a classifier) capable of distinguishing between legitimate and illegitimate connections in a computer network. This is a link to the large data set used for that competition. The other tabs on the page provide additional context on the data. <br/><br />
<br />
* [https://github.com/joshsaxe/eXposeDeepNeuralNetwork eXpose Deep Nueral Network] This is an open-source deep neural network project that attempts to detect malicious URLs, file paths and registry keys with proper training. Data sets can be found in the data/models directory the in the sample_scores.json files. <br/><br />
<br />
* [http://archive.ics.uci.edu/ml/datasets.html UCI ML Data Sets] University of California, Irvine has a collection of machine learning data sets across many fields. Within their collection, their are security relevant data sets if you search for topics such as spam, phishing, etc. <br/></div>Puhleyhttps://wiki.owasp.org/index.php?title=OWASP_Machine_Learning_Resources&diff=231847OWASP Machine Learning Resources2017-07-25T22:29:32Z<p>Puhley: Adding eXpose to data sets.</p>
<hr />
<div><big>'''DRAFT VERSION'''</big><br /><br />
<br /><br />
<br /><br />
<br />
== Introduction ==<br />
<br /><br />
This page is intended to provide machine learning security resources for security researchers who are new to the field. It includes a few introductory resources for the basics of machine learning as well as examples of machine learning applied to security problems on different platforms. While there are many resources and conference talks available on the web, this page focuses on open-source projects and information that would be of interest to security researchers as a place to start learning. Rather than reinvent existing information, the approach of this page is to maintain context and accuracy by linking to original source materials. <br /><br />
<br /><br />
<br />
== Security Aspects of Machine Learning ==<br />
Machine Learning as it relates to security can be broken down into three broad categories.<br />
<br /><br />
# Adversarial Machine Learning - This technique attempts to confuse ML algorithms into returning the attacker's selected data instead of the expected response. <br />
# Machine learning for improved security analysis - Machine learning can be used in security log analysis in order to better detect or prevent attacks. Typical applications include detecting anomalies, predicting values, or classifying data into two or more categories.<br />
# Attacks against machine learning software - These attacks target the software that is being used for machine learning with the hopes of causing a denial-of-service attack or arbitrary code execution. These types of attacks typically result in a software patch for the impacted library or service.<br />
<br /><br />
<br />
== Getting Started with the Basics of Machine Learning ==<br />
There are many free videos and interactive demos for machine learning available on the web. These are just a few options: <br /><br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/playlist?list=PLOU2XLYxmsIIuiBfYad6rFYQU_jL2ryal Machine Learning Recipes with Josh Gordon] - This Google Developer YouTube series focuses on TensorFlow and SciKit learn. The target audience is people who are new to machine learning and are able to read Python. - Josh Gordon, Google Developer YouTube channel, 2017. <br /><br />
<br />
=== Hands On Learning ===<br />
* [http://playground.tensorflow.org/ Tensorflow Playground] - This web page allows you to play with neural networks from your web browser. The goal of the exercises are to design neural networks to match different data sets. <br /><br />
* [https://gallery.cortanaintelligence.com/Experiment/Binary-Classification-Network-intrusion-detection-2 Azure Binary Classification: Network Intrusion Detection] - This lab demonstrates intrusion detection security analysis using Azure's Machine Learning environment. The lab exercise can be performed using a free account. In addition, the Cortana Intelligence Gallery has other types of anomaly detection examples from Microsoft and other contributors available from this site. <br /><br />
<br />
=== Cheat Sheets ===<br />
* [http://download.microsoft.com/download/A/6/1/A613E11E-8F9C-424A-B99D-65344785C288/microsoft-machine-learning-algorithm-cheat-sheet-v6.pdf Microsoft Azure Machine Learning: Algorithm Cheat Sheet] - "This cheat sheet helps you choose the best Azure Machine Learning Studio algorithm for your predictive analytics solution. Your decision is driven by both the nature of your data and the question you’re trying to answer." Microsoft provides this documentation on how to interpret the cheat sheet: [https://docs.microsoft.com/en-us/azure/machine-learning/machine-learning-algorithm-choice How to choose algorithms for Microsoft Azure Machine Learning] While this reference is specific to Microsoft, many of the concepts are universal. <br /><br />
* [https://s3.amazonaws.com/assets.datacamp.com/blog_assets/Scikit_Learn_Cheat_Sheet_Python.pdf Python for data science cheat sheet] - A cheat sheet for the different Scikit machine learning Python modules. <br /><br />
* [http://scikit-learn.org/stable/tutorial/machine_learning_map/index.html Scikit Learn: Choosing the right estimator] - "The flowchart below is designed to give users a bit of a rough guide on how to approach problems with regard to which estimators to try on your data." <br /><br />
<br /><br />
<br />
== ML Security Resources == <br />
=== Consolidated Resource Sites ===<br />
* [https://www.mlsecproject.org/ MLSec Project] - "MLSec Project is a select community of like-minded individuals that want to work together on using machine learning and data science in information security. It features open source projects, blog posts and community content to help further the understanding of how this technology can help defenders handle the growing complexity and verbosity of their environments and tools."<br />
* [https://github.com/yenchenlin/awesome-adversarial-machine-learning Awesome Adversarial Machine Learning] - A github project which is "A curated list of awesome adversarial machine learning resources" including blogs, papers, and talks.<br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/watch?v=6Slj2FV9CLA Advances in Cloud-Scale Machine Learning for Cyberdefense] - "Picking an attacker's signals out of billions of log events in near real time from petabyte scale storage is a daunting task, but Microsoft has been using security data science at cloud scale to successfully disrupt attacker. This session presents the latest frameworks, techniques and the unconventional machine learning algorithms that Microsoft uses to protect its infrastructure and customers." - Mark Russinovich, BlueHat 2017 <br /><br />
* [https://www.youtube.com/watch?v=fRklX97iGIw Machine Learning and the Cloud: Disrupting Threat Detection and Prevention] - "Machine learning with large data sets gives unprecedented insights and anomaly detection capability. Learn how Microsoft uses the agility and scale of the cloud to protect its infrastructure and customers by applying data mining and machine learning algorithms and security domain learnings to the vast amounts of data and telemetry gathered by its many different systems and services." - Mark Russinovich, RSA USA 2016. <br /><br />
* [https://www.youtube.com/watch?v=Wh7nvpVQ_58 Predictive Security: Using Big Data to Fortify Your Defenses] - "This session shows you how to build a predictive analytics stack on AWS, which harnesses the power of Amazon Machine Learning in conjunction with Amazon Elasticsearch Service, AWS CloudTrail, and VPC Flow Logs to perform tasks such as anomaly detection and log analysis. We also demonstrate how you can use AWS Lambda to act on this information in an automated fashion, such as performing updates to AWS WAF and security groups, leading to an improved security posture and alleviating operational burden on your security teams." - Michael Capicotto & Matt Nowina, AWS re:Invent 2016 <br /><br />
<br />
=== Blogs ===<br />
* [https://blog.openai.com/adversarial-example-research/ Attacking Machine Learning with Adversarial Examples] - "In this post we’ll show how adversarial examples work across different mediums, and will discuss why securing systems against them can be difficult." - February 24, 2017 <br /><br />
<br /><br />
<br />
== Tools ==<br />
* [http://www.cs.waikato.ac.nz/ml/weka/ Weka] - "Weka is a collection of machine learning algorithms for data mining tasks. The algorithms can either be applied directly to a dataset or called from your own Java code. Weka contains tools for data pre-processing, classification, regression, clustering, association rules, and visualization. It is also well-suited for developing new machine learning schemes." <br /><br />
<br /><br />
<br />
== Languages and Libraries ==<br />
* [http://scikit-learn.org/stable/ Scikit-Learn] - Data mining and data analysis in Python that is built on NumPy, SciPy, and matplotlib. <br /><br />
<br />
* [https://www.tensorflow.org/ Tensor Flow] - TensorFlow™ is an open source software library for numerical computation using data flow graphs. Nodes in the graph represent mathematical operations, while the graph edges represent the multidimensional data arrays (tensors) communicated between them. The flexible architecture allows you to deploy computation to one or more CPUs or GPUs in a desktop, server, or mobile device with a single API. <br /><br />
<br />
* [https://www.r-project.org/ R Project] - The R language is widely used among statisticians and data miners for developing statistical software and data analysis. <br /><br />
<br />
* [https://www.continuum.io/downloads Anaconda] - "The open source version of Anaconda is a high performance distribution of Python and R and includes over 100 of the most popular Python, R and Scala packages for data science. ... If you don't have time or disk space for the entire distribution, try Miniconda which contains only conda and Python. Then install just the individual packages you want through the conda command." <br /><br />
<br />
* [https://keras.io/ Keras] - "Keras is a high-level neural networks API, written in Python and capable of running on top of either TensorFlow, CNTK or Theano. It was developed with a focus on enabling fast experimentation." <br /><br />
<br /><br />
<br />
== Data Sets ==<br />
* [http://www.kdd.org/kdd-cup/view/kdd-cup-1999/Data KDD Cup 1999: Computer Network Intrusion Detection] The goal of the KDD Cup competition in 1999 was to learn a predictive model (i.e. a classifier) capable of distinguishing between legitimate and illegitimate connections in a computer network. This is a link to the large data set used for that competition. The other tabs on the page provide additional context on the data. <br/><br />
<br />
* [https://github.com/joshsaxe/eXposeDeepNeuralNetwork eXpose Deep Nueral Network] This is an open-source deep neural network project that attempts to detect malicious URLs, file paths and registry keys with proper training. Data sets can be found in the data/models directory the in the sample_scores.json files. <br/></div>Puhleyhttps://wiki.owasp.org/index.php?title=OWASP_Machine_Learning_Resources&diff=231844OWASP Machine Learning Resources2017-07-25T19:00:27Z<p>Puhley: Added link to Keras</p>
<hr />
<div><big>'''DRAFT VERSION'''</big><br /><br />
<br /><br />
<br /><br />
<br />
== Introduction ==<br />
<br /><br />
This page is intended to provide machine learning security resources for security researchers who are new to the field. It includes a few introductory resources for the basics of machine learning as well as examples of machine learning applied to security problems on different platforms. While there are many resources and conference talks available on the web, this page focuses on open-source projects and information that would be of interest to security researchers as a place to start learning. Rather than reinvent existing information, the approach of this page is to maintain context and accuracy by linking to original source materials. <br /><br />
<br /><br />
<br />
== Security Aspects of Machine Learning ==<br />
Machine Learning as it relates to security can be broken down into three broad categories.<br />
<br /><br />
# Adversarial Machine Learning - This technique attempts to confuse ML algorithms into returning the attacker's selected data instead of the expected response. <br />
# Machine learning for improved security analysis - Machine learning can be used in security log analysis in order to better detect or prevent attacks. Typical applications include detecting anomalies, predicting values, or classifying data into two or more categories.<br />
# Attacks against machine learning software - These attacks target the software that is being used for machine learning with the hopes of causing a denial-of-service attack or arbitrary code execution. These types of attacks typically result in a software patch for the impacted library or service.<br />
<br /><br />
<br />
== Getting Started with the Basics of Machine Learning ==<br />
There are many free videos and interactive demos for machine learning available on the web. These are just a few options: <br /><br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/playlist?list=PLOU2XLYxmsIIuiBfYad6rFYQU_jL2ryal Machine Learning Recipes with Josh Gordon] - This Google Developer YouTube series focuses on TensorFlow and SciKit learn. The target audience is people who are new to machine learning and are able to read Python. - Josh Gordon, Google Developer YouTube channel, 2017. <br /><br />
<br />
=== Hands On Learning ===<br />
* [http://playground.tensorflow.org/ Tensorflow Playground] - This web page allows you to play with neural networks from your web browser. The goal of the exercises are to design neural networks to match different data sets. <br /><br />
* [https://gallery.cortanaintelligence.com/Experiment/Binary-Classification-Network-intrusion-detection-2 Azure Binary Classification: Network Intrusion Detection] - This lab demonstrates intrusion detection security analysis using Azure's Machine Learning environment. The lab exercise can be performed using a free account. In addition, the Cortana Intelligence Gallery has other types of anomaly detection examples from Microsoft and other contributors available from this site. <br /><br />
<br />
=== Cheat Sheets ===<br />
* [http://download.microsoft.com/download/A/6/1/A613E11E-8F9C-424A-B99D-65344785C288/microsoft-machine-learning-algorithm-cheat-sheet-v6.pdf Microsoft Azure Machine Learning: Algorithm Cheat Sheet] - "This cheat sheet helps you choose the best Azure Machine Learning Studio algorithm for your predictive analytics solution. Your decision is driven by both the nature of your data and the question you’re trying to answer." Microsoft provides this documentation on how to interpret the cheat sheet: [https://docs.microsoft.com/en-us/azure/machine-learning/machine-learning-algorithm-choice How to choose algorithms for Microsoft Azure Machine Learning] While this reference is specific to Microsoft, many of the concepts are universal. <br /><br />
* [https://s3.amazonaws.com/assets.datacamp.com/blog_assets/Scikit_Learn_Cheat_Sheet_Python.pdf Python for data science cheat sheet] - A cheat sheet for the different Scikit machine learning Python modules. <br /><br />
* [http://scikit-learn.org/stable/tutorial/machine_learning_map/index.html Scikit Learn: Choosing the right estimator] - "The flowchart below is designed to give users a bit of a rough guide on how to approach problems with regard to which estimators to try on your data." <br /><br />
<br /><br />
<br />
== ML Security Resources == <br />
=== Consolidated Resource Sites ===<br />
* [https://www.mlsecproject.org/ MLSec Project] - "MLSec Project is a select community of like-minded individuals that want to work together on using machine learning and data science in information security. It features open source projects, blog posts and community content to help further the understanding of how this technology can help defenders handle the growing complexity and verbosity of their environments and tools."<br />
* [https://github.com/yenchenlin/awesome-adversarial-machine-learning Awesome Adversarial Machine Learning] - A github project which is "A curated list of awesome adversarial machine learning resources" including blogs, papers, and talks.<br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/watch?v=6Slj2FV9CLA Advances in Cloud-Scale Machine Learning for Cyberdefense] - "Picking an attacker's signals out of billions of log events in near real time from petabyte scale storage is a daunting task, but Microsoft has been using security data science at cloud scale to successfully disrupt attacker. This session presents the latest frameworks, techniques and the unconventional machine learning algorithms that Microsoft uses to protect its infrastructure and customers." - Mark Russinovich, BlueHat 2017 <br /><br />
* [https://www.youtube.com/watch?v=fRklX97iGIw Machine Learning and the Cloud: Disrupting Threat Detection and Prevention] - "Machine learning with large data sets gives unprecedented insights and anomaly detection capability. Learn how Microsoft uses the agility and scale of the cloud to protect its infrastructure and customers by applying data mining and machine learning algorithms and security domain learnings to the vast amounts of data and telemetry gathered by its many different systems and services." - Mark Russinovich, RSA USA 2016. <br /><br />
* [https://www.youtube.com/watch?v=Wh7nvpVQ_58 Predictive Security: Using Big Data to Fortify Your Defenses] - "This session shows you how to build a predictive analytics stack on AWS, which harnesses the power of Amazon Machine Learning in conjunction with Amazon Elasticsearch Service, AWS CloudTrail, and VPC Flow Logs to perform tasks such as anomaly detection and log analysis. We also demonstrate how you can use AWS Lambda to act on this information in an automated fashion, such as performing updates to AWS WAF and security groups, leading to an improved security posture and alleviating operational burden on your security teams." - Michael Capicotto & Matt Nowina, AWS re:Invent 2016 <br /><br />
<br />
=== Blogs ===<br />
* [https://blog.openai.com/adversarial-example-research/ Attacking Machine Learning with Adversarial Examples] - "In this post we’ll show how adversarial examples work across different mediums, and will discuss why securing systems against them can be difficult." - February 24, 2017 <br /><br />
<br /><br />
<br />
== Tools ==<br />
* [http://www.cs.waikato.ac.nz/ml/weka/ Weka] - "Weka is a collection of machine learning algorithms for data mining tasks. The algorithms can either be applied directly to a dataset or called from your own Java code. Weka contains tools for data pre-processing, classification, regression, clustering, association rules, and visualization. It is also well-suited for developing new machine learning schemes." <br /><br />
<br /><br />
<br />
== Languages and Libraries ==<br />
* [http://scikit-learn.org/stable/ Scikit-Learn] - Data mining and data analysis in Python that is built on NumPy, SciPy, and matplotlib. <br /><br />
<br />
* [https://www.tensorflow.org/ Tensor Flow] - TensorFlow™ is an open source software library for numerical computation using data flow graphs. Nodes in the graph represent mathematical operations, while the graph edges represent the multidimensional data arrays (tensors) communicated between them. The flexible architecture allows you to deploy computation to one or more CPUs or GPUs in a desktop, server, or mobile device with a single API. <br /><br />
<br />
* [https://www.r-project.org/ R Project] - The R language is widely used among statisticians and data miners for developing statistical software and data analysis. <br /><br />
<br />
* [https://www.continuum.io/downloads Anaconda] - "The open source version of Anaconda is a high performance distribution of Python and R and includes over 100 of the most popular Python, R and Scala packages for data science. ... If you don't have time or disk space for the entire distribution, try Miniconda which contains only conda and Python. Then install just the individual packages you want through the conda command." <br /><br />
<br />
* [https://keras.io/ Keras] - "Keras is a high-level neural networks API, written in Python and capable of running on top of either TensorFlow, CNTK or Theano. It was developed with a focus on enabling fast experimentation." <br /><br />
<br /><br />
<br />
== Data Sets ==<br />
* [http://www.kdd.org/kdd-cup/view/kdd-cup-1999/Data KDD Cup 1999: Computer Network Intrusion Detection] The goal of the KDD Cup competition in 1999 was to learn a predictive model (i.e. a classifier) capable of distinguishing between legitimate and illegitimate connections in a computer network. This is a link to the large data set used for that competition. The other tabs on the page provide additional context. <br/></div>Puhleyhttps://wiki.owasp.org/index.php?title=OWASP_Machine_Learning_Resources&diff=231836OWASP Machine Learning Resources2017-07-24T22:46:46Z<p>Puhley: Adding a Data Sets section.</p>
<hr />
<div><big>'''DRAFT VERSION'''</big><br /><br />
<br /><br />
<br /><br />
<br />
== Introduction ==<br />
<br /><br />
This page is intended to provide machine learning security resources for security researchers who are new to the field. It includes a few introductory resources for the basics of machine learning as well as examples of machine learning applied to security problems on different platforms. While there are many resources and conference talks available on the web, this page focuses on open-source projects and information that would be of interest to security researchers as a place to start learning. Rather than reinvent existing information, the approach of this page is to maintain context and accuracy by linking to original source materials.<br /><br />
<br /><br />
<br />
== Security Aspects of Machine Learning ==<br />
Machine Learning as it relates to security can be broken down into three broad categories.<br />
<br /><br />
# Adversarial Machine Learning - This technique attempts to confuse ML algorithms into returning the attacker's selected data instead of the expected response. <br />
# Machine learning for improved security analysis - Machine learning can be used in security log analysis in order to better detect or prevent attacks. Typical applications include detecting anomalies, predicting values, or classifying data into two or more categories.<br />
# Attacks against machine learning software - These attacks target the software that is being used for machine learning with the hopes of causing a denial-of-service attack or arbitrary code execution. These types of attacks typically result in a software patch for the impacted library or service.<br />
<br /><br />
<br />
== Getting Started with the Basics of Machine Learning ==<br />
There are many free videos and interactive demos for machine learning available on the web. These are just a few options:<br /><br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/playlist?list=PLOU2XLYxmsIIuiBfYad6rFYQU_jL2ryal Machine Learning Recipes with Josh Gordon] - This Google Developer YouTube series focuses on TensorFlow and SciKit learn. The target audience is people who are new to machine learning and are able to read Python. - Josh Gordon, Google Developer YouTube channel, 2017.<br /><br />
<br />
=== Hands On Learning ===<br />
* [http://playground.tensorflow.org/ Tensorflow Playground] - This web page allows you to play with neural networks from your web browser. The goal of the exercises are to design neural networks to match different data sets.<br /><br />
* [https://gallery.cortanaintelligence.com/Experiment/Binary-Classification-Network-intrusion-detection-2 Azure Binary Classification: Network Intrusion Detection] - This lab demonstrates intrusion detection security analysis using Azure's Machine Learning environment. The lab exercise can be performed using a free account. In addition, the Cortana Intelligence Gallery has other types of anomaly detection examples from Microsoft and other contributors available from this site.<br /><br />
<br />
=== Cheat Sheets ===<br />
* [http://download.microsoft.com/download/A/6/1/A613E11E-8F9C-424A-B99D-65344785C288/microsoft-machine-learning-algorithm-cheat-sheet-v6.pdf Microsoft Azure Machine Learning: Algorithm Cheat Sheet] - "This cheat sheet helps you choose the best Azure Machine Learning Studio algorithm for your predictive analytics solution. Your decision is driven by both the nature of your data and the question you’re trying to answer." Microsoft provides this documentation on how to interpret the cheat sheet: [https://docs.microsoft.com/en-us/azure/machine-learning/machine-learning-algorithm-choice How to choose algorithms for Microsoft Azure Machine Learning] While this reference is specific to Microsoft, many of the concepts are universal. <br /><br />
* [https://s3.amazonaws.com/assets.datacamp.com/blog_assets/Scikit_Learn_Cheat_Sheet_Python.pdf Python for data science cheat sheet] - A cheat sheet for the different Scikit machine learning Python modules.<br /><br />
* [http://scikit-learn.org/stable/tutorial/machine_learning_map/index.html Scikit Learn: Choosing the right estimator] - "The flowchart below is designed to give users a bit of a rough guide on how to approach problems with regard to which estimators to try on your data."<br /><br />
<br /><br />
<br />
== ML Security Resources == <br />
=== Consolidated Resource Sites ===<br />
* [https://www.mlsecproject.org/ MLSec Project] - "MLSec Project is a select community of like-minded individuals that want to work together on using machine learning and data science in information security. It features open source projects, blog posts and community content to help further the understanding of how this technology can help defenders handle the growing complexity and verbosity of their environments and tools."<br />
* [https://github.com/yenchenlin/awesome-adversarial-machine-learning Awesome Adversarial Machine Learning] - A github project which is "A curated list of awesome adversarial machine learning resources" including blogs, papers, and talks.<br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/watch?v=6Slj2FV9CLA Advances in Cloud-Scale Machine Learning for Cyberdefense] - "Picking an attacker's signals out of billions of log events in near real time from petabyte scale storage is a daunting task, but Microsoft has been using security data science at cloud scale to successfully disrupt attacker. This session presents the latest frameworks, techniques and the unconventional machine learning algorithms that Microsoft uses to protect its infrastructure and customers." - Mark Russinovich, BlueHat 2017 <br /><br />
* [https://www.youtube.com/watch?v=fRklX97iGIw Machine Learning and the Cloud: Disrupting Threat Detection and Prevention] - "Machine learning with large data sets gives unprecedented insights and anomaly detection capability. Learn how Microsoft uses the agility and scale of the cloud to protect its infrastructure and customers by applying data mining and machine learning algorithms and security domain learnings to the vast amounts of data and telemetry gathered by its many different systems and services." - Mark Russinovich, RSA USA 2016.<br /><br />
* [https://www.youtube.com/watch?v=Wh7nvpVQ_58 Predictive Security: Using Big Data to Fortify Your Defenses] - "This session shows you how to build a predictive analytics stack on AWS, which harnesses the power of Amazon Machine Learning in conjunction with Amazon Elasticsearch Service, AWS CloudTrail, and VPC Flow Logs to perform tasks such as anomaly detection and log analysis. We also demonstrate how you can use AWS Lambda to act on this information in an automated fashion, such as performing updates to AWS WAF and security groups, leading to an improved security posture and alleviating operational burden on your security teams." - Michael Capicotto & Matt Nowina, AWS re:Invent 2016 <br /><br />
<br />
=== Blogs ===<br />
* [https://blog.openai.com/adversarial-example-research/ Attacking Machine Learning with Adversarial Examples] - "In this post we’ll show how adversarial examples work across different mediums, and will discuss why securing systems against them can be difficult." - February 24, 2017<br /><br />
<br /><br />
<br />
== Tools ==<br />
* [http://www.cs.waikato.ac.nz/ml/weka/ Weka] - "Weka is a collection of machine learning algorithms for data mining tasks. The algorithms can either be applied directly to a dataset or called from your own Java code. Weka contains tools for data pre-processing, classification, regression, clustering, association rules, and visualization. It is also well-suited for developing new machine learning schemes."<br /><br />
<br /><br />
<br />
== Languages and Libraries ==<br />
* [http://scikit-learn.org/stable/ Scikit-Learn] - Data mining and data analysis in Python that is built on NumPy, SciPy, and matplotlib.<br /><br />
<br />
* [https://www.tensorflow.org/ Tensor Flow] - TensorFlow™ is an open source software library for numerical computation using data flow graphs. Nodes in the graph represent mathematical operations, while the graph edges represent the multidimensional data arrays (tensors) communicated between them. The flexible architecture allows you to deploy computation to one or more CPUs or GPUs in a desktop, server, or mobile device with a single API.<br /><br />
<br />
* [https://www.r-project.org/ R Project] - The R language is widely used among statisticians and data miners for developing statistical software and data analysis.<br /><br />
<br />
* [https://www.continuum.io/downloads Anaconda] - "The open source version of Anaconda is a high performance distribution of Python and R and includes over 100 of the most popular Python, R and Scala packages for data science. ... If you don't have time or disk space for the entire distribution, try Miniconda which contains only conda and Python. Then install just the individual packages you want through the conda command."<br /><br />
<br /><br />
<br />
== Data Sets ==<br />
* [http://www.kdd.org/kdd-cup/view/kdd-cup-1999/Data KDD Cup 1999: Computer Network Intrusion Detection] The goal of the KDD Cup competition in 1999 was to learn a predictive model (i.e. a classifier) capable of distinguishing between legitimate and illegitimate connections in a computer network. This is a link to the large data set used for that competition. The other tabs on the page provide additional context. <br/></div>Puhleyhttps://wiki.owasp.org/index.php?title=OWASP_Machine_Learning_Resources&diff=231621OWASP Machine Learning Resources2017-07-12T17:56:41Z<p>Puhley: Added a reference to Anaconda.</p>
<hr />
<div><big>'''DRAFT VERSION'''</big><br /><br />
<br /><br />
<br /><br />
<br />
== Introduction ==<br />
<br /><br />
This page is intended to provide machine learning security resources for security researchers who are new to the field. It includes a few introductory resources for the basics of machine learning as well as examples of machine learning applied to security problems on different platforms. While there are many resources and conference talks available on the web, this page focuses on open-source projects and information that would be of interest to security researchers as a place to start learning. Rather than reinvent existing information, the approach of this page is to maintain context and accuracy by linking to original source materials.<br /><br />
<br /><br />
<br />
== Security Aspects of Machine Learning ==<br />
Machine Learning as it relates to security can be broken down into three broad categories.<br />
<br /><br />
# Adversarial Machine Learning - This technique attempts to confuse ML algorithms into returning the attacker's selected data instead of the expected response. <br />
# Machine learning for improved security analysis - Machine learning can be used in security log analysis in order to better detect or prevent attacks. Typical applications include detecting anomalies, predicting values, or classifying data into two or more categories.<br />
# Attacks against machine learning software - These attacks target the software that is being used for machine learning with the hopes of causing a denial-of-service attack or arbitrary code execution. These types of attacks typically result in a software patch for the impacted library or service.<br />
<br /><br />
<br />
== Getting Started with the Basics of Machine Learning ==<br />
There are many free videos and interactive demos for machine learning available on the web. These are just a few options:<br /><br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/playlist?list=PLOU2XLYxmsIIuiBfYad6rFYQU_jL2ryal Machine Learning Recipes with Josh Gordon] - This Google Developer YouTube series focuses on TensorFlow and SciKit learn. The target audience is people who are new to machine learning and are able to read Python. - Josh Gordon, Google Developer YouTube channel, 2017.<br /><br />
<br />
=== Hands On Learning ===<br />
* [http://playground.tensorflow.org/ Tensorflow Playground] - This web page allows you to play with neural networks from your web browser. The goal of the exercises are to design neural networks to match different data sets.<br /><br />
* [https://gallery.cortanaintelligence.com/Experiment/Binary-Classification-Network-intrusion-detection-2 Azure Binary Classification: Network Intrusion Detection] - This lab demonstrates intrusion detection security analysis using Azure's Machine Learning environment. The lab exercise can be performed using a free account. In addition, the Cortana Intelligence Gallery has other types of anomaly detection examples from Microsoft and other contributors available from this site.<br /><br />
<br />
=== Cheat Sheets ===<br />
* [http://download.microsoft.com/download/A/6/1/A613E11E-8F9C-424A-B99D-65344785C288/microsoft-machine-learning-algorithm-cheat-sheet-v6.pdf Microsoft Azure Machine Learning: Algorithm Cheat Sheet] - "This cheat sheet helps you choose the best Azure Machine Learning Studio algorithm for your predictive analytics solution. Your decision is driven by both the nature of your data and the question you’re trying to answer." Microsoft provides this documentation on how to interpret the cheat sheet: [https://docs.microsoft.com/en-us/azure/machine-learning/machine-learning-algorithm-choice How to choose algorithms for Microsoft Azure Machine Learning] While this reference is specific to Microsoft, many of the concepts are universal. <br /><br />
* [https://s3.amazonaws.com/assets.datacamp.com/blog_assets/Scikit_Learn_Cheat_Sheet_Python.pdf Python for data science cheat sheet] - A cheat sheet for the different Scikit machine learning Python modules.<br /><br />
* [http://scikit-learn.org/stable/tutorial/machine_learning_map/index.html Scikit Learn: Choosing the right estimator] - "The flowchart below is designed to give users a bit of a rough guide on how to approach problems with regard to which estimators to try on your data."<br /><br />
<br /><br />
<br />
== ML Security Resources == <br />
=== Consolidated Resource Sites ===<br />
* [https://www.mlsecproject.org/ MLSec Project] - "MLSec Project is a select community of like-minded individuals that want to work together on using machine learning and data science in information security. It features open source projects, blog posts and community content to help further the understanding of how this technology can help defenders handle the growing complexity and verbosity of their environments and tools."<br />
* [https://github.com/yenchenlin/awesome-adversarial-machine-learning Awesome Adversarial Machine Learning] - A github project which is "A curated list of awesome adversarial machine learning resources" including blogs, papers, and talks.<br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/watch?v=6Slj2FV9CLA Advances in Cloud-Scale Machine Learning for Cyberdefense] - "Picking an attacker's signals out of billions of log events in near real time from petabyte scale storage is a daunting task, but Microsoft has been using security data science at cloud scale to successfully disrupt attacker. This session presents the latest frameworks, techniques and the unconventional machine learning algorithms that Microsoft uses to protect its infrastructure and customers." - Mark Russinovich, BlueHat 2017 <br /><br />
* [https://www.youtube.com/watch?v=fRklX97iGIw Machine Learning and the Cloud: Disrupting Threat Detection and Prevention] - "Machine learning with large data sets gives unprecedented insights and anomaly detection capability. Learn how Microsoft uses the agility and scale of the cloud to protect its infrastructure and customers by applying data mining and machine learning algorithms and security domain learnings to the vast amounts of data and telemetry gathered by its many different systems and services." - Mark Russinovich, RSA USA 2016.<br /><br />
* [https://www.youtube.com/watch?v=Wh7nvpVQ_58 Predictive Security: Using Big Data to Fortify Your Defenses] - "This session shows you how to build a predictive analytics stack on AWS, which harnesses the power of Amazon Machine Learning in conjunction with Amazon Elasticsearch Service, AWS CloudTrail, and VPC Flow Logs to perform tasks such as anomaly detection and log analysis. We also demonstrate how you can use AWS Lambda to act on this information in an automated fashion, such as performing updates to AWS WAF and security groups, leading to an improved security posture and alleviating operational burden on your security teams." - Michael Capicotto & Matt Nowina, AWS re:Invent 2016 <br /><br />
<br />
=== Blogs ===<br />
* [https://blog.openai.com/adversarial-example-research/ Attacking Machine Learning with Adversarial Examples] - "In this post we’ll show how adversarial examples work across different mediums, and will discuss why securing systems against them can be difficult." - February 24, 2017<br /><br />
<br /><br />
<br />
== Tools ==<br />
* [http://www.cs.waikato.ac.nz/ml/weka/ Weka] - "Weka is a collection of machine learning algorithms for data mining tasks. The algorithms can either be applied directly to a dataset or called from your own Java code. Weka contains tools for data pre-processing, classification, regression, clustering, association rules, and visualization. It is also well-suited for developing new machine learning schemes."<br /><br />
<br /><br />
<br />
== Languages and Libraries ==<br />
* [http://scikit-learn.org/stable/ Scikit-Learn] - Data mining and data analysis in Python that is built on NumPy, SciPy, and matplotlib.<br /><br />
<br />
* [https://www.tensorflow.org/ Tensor Flow] - TensorFlow™ is an open source software library for numerical computation using data flow graphs. Nodes in the graph represent mathematical operations, while the graph edges represent the multidimensional data arrays (tensors) communicated between them. The flexible architecture allows you to deploy computation to one or more CPUs or GPUs in a desktop, server, or mobile device with a single API.<br /><br />
<br />
* [https://www.r-project.org/ R Project] - The R language is widely used among statisticians and data miners for developing statistical software and data analysis.<br /><br />
<br />
* [https://www.continuum.io/downloads Anaconda] - "The open source version of Anaconda is a high performance distribution of Python and R and includes over 100 of the most popular Python, R and Scala packages for data science. ... If you don't have time or disk space for the entire distribution, try Miniconda which contains only conda and Python. Then install just the individual packages you want through the conda command."<br /></div>Puhleyhttps://wiki.owasp.org/index.php?title=OWASP_Machine_Learning_Resources&diff=231601OWASP Machine Learning Resources2017-07-12T04:57:38Z<p>Puhley: Added bullets for readability.</p>
<hr />
<div><big>'''DRAFT VERSION'''</big><br /><br />
<br /><br />
<br /><br />
<br />
== Introduction ==<br />
<br /><br />
This page is intended to provide machine learning security resources for security researchers who are new to the field. It includes a few introductory resources for the basics of machine learning as well as examples of machine learning applied to security problems on different platforms. While there are many resources and conference talks available on the web, this page focuses on open-source projects and information that would be of interest to security researchers as a place to start learning. Rather than reinvent existing information, the approach of this page is to maintain context and accuracy by linking to original source materials.<br /><br />
<br /><br />
<br />
== Security Aspects of Machine Learning ==<br />
Machine Learning as it relates to security can be broken down into three broad categories.<br />
<br /><br />
# Adversarial Machine Learning - This technique attempts to confuse ML algorithms into returning the attacker's selected data instead of the expected response. <br />
# Machine learning for improved security analysis - Machine learning can be used in security log analysis in order to better detect or prevent attacks. Typical applications include detecting anomalies, predicting values, or classifying data into two or more categories.<br />
# Attacks against machine learning software - These attacks target the software that is being used for machine learning with the hopes of causing a denial-of-service attack or arbitrary code execution. These types of attacks typically result in a software patch for the impacted library or service.<br />
<br /><br />
<br />
== Getting Started with the Basics of Machine Learning ==<br />
There are many free videos and interactive demos for machine learning available on the web. These are just a few options:<br /><br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/playlist?list=PLOU2XLYxmsIIuiBfYad6rFYQU_jL2ryal Machine Learning Recipes with Josh Gordon] - This Google Developer YouTube series focuses on TensorFlow and SciKit learn. The target audience is people who are new to machine learning and are able to read Python. - Josh Gordon, Google Developer YouTube channel, 2017.<br /><br />
<br />
=== Hands On Learning ===<br />
* [http://playground.tensorflow.org/ Tensorflow Playground] - This web page allows you to play with neural networks from your web browser. The goal of the exercises are to design neural networks to match different data sets.<br /><br />
* [https://gallery.cortanaintelligence.com/Experiment/Binary-Classification-Network-intrusion-detection-2 Azure Binary Classification: Network Intrusion Detection] - This lab demonstrates intrusion detection security analysis using Azure's Machine Learning environment. The lab exercise can be performed using a free account. In addition, the Cortana Intelligence Gallery has other types of anomaly detection examples from Microsoft and other contributors available from this site.<br /><br />
<br />
=== Cheat Sheets ===<br />
* [http://download.microsoft.com/download/A/6/1/A613E11E-8F9C-424A-B99D-65344785C288/microsoft-machine-learning-algorithm-cheat-sheet-v6.pdf Microsoft Azure Machine Learning: Algorithm Cheat Sheet] - "This cheat sheet helps you choose the best Azure Machine Learning Studio algorithm for your predictive analytics solution. Your decision is driven by both the nature of your data and the question you’re trying to answer." Microsoft provides this documentation on how to interpret the cheat sheet: [https://docs.microsoft.com/en-us/azure/machine-learning/machine-learning-algorithm-choice How to choose algorithms for Microsoft Azure Machine Learning] While this reference is specific to Microsoft, many of the concepts are universal. <br /><br />
* [https://s3.amazonaws.com/assets.datacamp.com/blog_assets/Scikit_Learn_Cheat_Sheet_Python.pdf Python for data science cheat sheet] - A cheat sheet for the different Scikit machine learning Python modules.<br /><br />
* [http://scikit-learn.org/stable/tutorial/machine_learning_map/index.html Scikit Learn: Choosing the right estimator] - "The flowchart below is designed to give users a bit of a rough guide on how to approach problems with regard to which estimators to try on your data."<br /><br />
<br /><br />
<br />
== ML Security Resources == <br />
=== Consolidated Resource Sites ===<br />
* [https://www.mlsecproject.org/ MLSec Project] - "MLSec Project is a select community of like-minded individuals that want to work together on using machine learning and data science in information security. It features open source projects, blog posts and community content to help further the understanding of how this technology can help defenders handle the growing complexity and verbosity of their environments and tools."<br />
* [https://github.com/yenchenlin/awesome-adversarial-machine-learning Awesome Adversarial Machine Learning] - A github project which is "A curated list of awesome adversarial machine learning resources" including blogs, papers, and talks.<br />
<br />
=== Videos ===<br />
* [https://www.youtube.com/watch?v=6Slj2FV9CLA Advances in Cloud-Scale Machine Learning for Cyberdefense] - "Picking an attacker's signals out of billions of log events in near real time from petabyte scale storage is a daunting task, but Microsoft has been using security data science at cloud scale to successfully disrupt attacker. This session presents the latest frameworks, techniques and the unconventional machine learning algorithms that Microsoft uses to protect its infrastructure and customers." - Mark Russinovich, BlueHat 2017 <br /><br />
* [https://www.youtube.com/watch?v=fRklX97iGIw Machine Learning and the Cloud: Disrupting Threat Detection and Prevention] - "Machine learning with large data sets gives unprecedented insights and anomaly detection capability. Learn how Microsoft uses the agility and scale of the cloud to protect its infrastructure and customers by applying data mining and machine learning algorithms and security domain learnings to the vast amounts of data and telemetry gathered by its many different systems and services." - Mark Russinovich, RSA USA 2016.<br /><br />
* [https://www.youtube.com/watch?v=Wh7nvpVQ_58 Predictive Security: Using Big Data to Fortify Your Defenses] - "This session shows you how to build a predictive analytics stack on AWS, which harnesses the power of Amazon Machine Learning in conjunction with Amazon Elasticsearch Service, AWS CloudTrail, and VPC Flow Logs to perform tasks such as anomaly detection and log analysis. We also demonstrate how you can use AWS Lambda to act on this information in an automated fashion, such as performing updates to AWS WAF and security groups, leading to an improved security posture and alleviating operational burden on your security teams." - Michael Capicotto & Matt Nowina, AWS re:Invent 2016 <br /><br />
<br />
=== Blogs ===<br />
* [https://blog.openai.com/adversarial-example-research/ Attacking Machine Learning with Adversarial Examples] - "In this post we’ll show how adversarial examples work across different mediums, and will discuss why securing systems against them can be difficult." - February 24, 2017<br /><br />
<br /><br />
<br />
== Tools ==<br />
* [http://www.cs.waikato.ac.nz/ml/weka/ Weka] - "Weka is a collection of machine learning algorithms for data mining tasks. The algorithms can either be applied directly to a dataset or called from your own Java code. Weka contains tools for data pre-processing, classification, regression, clustering, association rules, and visualization. It is also well-suited for developing new machine learning schemes."<br /><br />
<br /><br />
<br />
== Languages and Libraries ==<br />
* [http://scikit-learn.org/stable/ Scikit-Learn] - Data mining and data analysis in Python that is built on NumPy, SciPy, and matplotlib.<br /><br />
<br />
* [https://www.tensorflow.org/ Tensor Flow] - TensorFlow™ is an open source software library for numerical computation using data flow graphs. Nodes in the graph represent mathematical operations, while the graph edges represent the multidimensional data arrays (tensors) communicated between them. The flexible architecture allows you to deploy computation to one or more CPUs or GPUs in a desktop, server, or mobile device with a single API.<br /><br />
<br />
* [https://www.r-project.org/ R Project] - The R language is widely used among statisticians and data miners for developing statistical software and data analysis.<br /></div>Puhleyhttps://wiki.owasp.org/index.php?title=OWASP_Machine_Learning_Resources&diff=231598OWASP Machine Learning Resources2017-07-12T02:29:09Z<p>Puhley: Adding a few clarifications.</p>
<hr />
<div><big>'''DRAFT VERSION'''</big><br /><br />
<br /><br />
<br /><br />
<br />
== Introduction ==<br />
<br /><br />
This page is intended to provide machine learning security resources for security researchers who are new to the field. It includes a few introductory resources for the basics of machine learning as well as examples of machine learning applied to security problems on different platforms. While there are many resources and conference talks available on the web, this page focuses on open-source projects and information that would be of interest to security researchers as a place to start learning. Rather than reinvent existing information, the approach of this page is to maintain context and accuracy by linking to original source materials.<br /><br />
<br /><br />
<br />
== Security Aspects of Machine Learning ==<br />
Machine Learning as it relates to security can be broken down into three broad categories.<br />
<br /><br />
# Adversarial Machine Learning - This technique attempts to confuse ML algorithms into returning the attacker's selected data instead of the expected response. <br />
# Machine learning for improved security analysis - Machine learning can be used in security log analysis in order to better detect or prevent attacks. Typical applications include detecting anomalies, predicting values, or classifying data into two or more categories.<br />
# Attacks against machine learning software - These attacks target the software that is being used for machine learning with the hopes of causing a denial-of-service attack or arbitrary code execution. These types of attacks typically result in a software patch for the impacted library or service.<br />
<br /><br />
<br />
== Getting Started with the Basics of Machine Learning ==<br />
There are many free videos and interactive demos for machine learning available on the web. These are just a few options:<br /><br />
<br />
=== Videos ===<br />
[https://www.youtube.com/playlist?list=PLOU2XLYxmsIIuiBfYad6rFYQU_jL2ryal Machine Learning Recipes with Josh Gordon] - This Google Developer YouTube series focuses on TensorFlow and SciKit learn. The target audience is people who are new to machine learning and are able to read Python. - Josh Gordon, Google Developer YouTube channel, 2017.<br /><br />
<br />
=== Hands On Learning ===<br />
[http://playground.tensorflow.org/ Tensorflow Playground] - This web page allows you to play with neural networks from your web browser. The goal of the exercises are to design neural networks to match different data sets.<br /><br />
[https://gallery.cortanaintelligence.com/Experiment/Binary-Classification-Network-intrusion-detection-2 Azure Binary Classification: Network Intrusion Detection] - This lab demonstrates intrusion detection security analysis using Azure's Machine Learning environment. The lab exercise can be performed using a free account. In addition, the Cortana Intelligence Gallery has other types of anomaly detection examples from Microsoft and other contributors available from this site.<br /><br />
<br />
=== Cheat Sheets ===<br />
[http://download.microsoft.com/download/A/6/1/A613E11E-8F9C-424A-B99D-65344785C288/microsoft-machine-learning-algorithm-cheat-sheet-v6.pdf Microsoft Azure Machine Learning: Algorithm Cheat Sheet] - "This cheat sheet helps you choose the best Azure Machine Learning Studio algorithm for your predictive analytics solution. Your decision is driven by both the nature of your data and the question you’re trying to answer." Microsoft provides this documentation on how to interpret the cheat sheet: [https://docs.microsoft.com/en-us/azure/machine-learning/machine-learning-algorithm-choice How to choose algorithms for Microsoft Azure Machine Learning] <br /><br />
[https://s3.amazonaws.com/assets.datacamp.com/blog_assets/Scikit_Learn_Cheat_Sheet_Python.pdf Python for data science cheat sheet] - A cheat sheet for the different Scikit machine learning Python modules.<br /><br />
[http://scikit-learn.org/stable/tutorial/machine_learning_map/index.html Scikit Learn: Choosing the right estimator] - "The flowchart below is designed to give users a bit of a rough guide on how to approach problems with regard to which estimators to try on your data."<br /><br />
<br /><br />
<br />
== ML Security Resources == <br />
=== Consolidated Resource Sites ===<br />
[https://www.mlsecproject.org/ MLSec Project] - "MLSec Project is a select community of like-minded individuals that want to work together on using machine learning and data science in information security. It features open source projects, blog posts and community content to help further the understanding of how this technology can help defenders handle the growing complexity and verbosity of their environments and tools."<br />
<br /><br />
[https://github.com/yenchenlin/awesome-adversarial-machine-learning Awesome Adversarial Machine Learning] - A github project which is "A curated list of awesome adversarial machine learning resources" including blogs, papers, and talks.<br />
<br /><br />
<br />
=== Videos ===<br />
[https://www.youtube.com/watch?v=6Slj2FV9CLA Advances in Cloud-Scale Machine Learning for Cyberdefense] - "Picking an attacker's signals out of billions of log events in near real time from petabyte scale storage is a daunting task, but Microsoft has been using security data science at cloud scale to successfully disrupt attacker. This session presents the latest frameworks, techniques and the unconventional machine learning algorithms that Microsoft uses to protect its infrastructure and customers." - Mark Russinovich, BlueHat 2017 <br /><br />
[https://www.youtube.com/watch?v=fRklX97iGIw Machine Learning and the Cloud: Disrupting Threat Detection and Prevention] - "Machine learning with large data sets gives unprecedented insights and anomaly detection capability. Learn how Microsoft uses the agility and scale of the cloud to protect its infrastructure and customers by applying data mining and machine learning algorithms and security domain learnings to the vast amounts of data and telemetry gathered by its many different systems and services." - Mark Russinovich, RSA USA 2016.<br /><br />
[https://www.youtube.com/watch?v=Wh7nvpVQ_58 Predictive Security: Using Big Data to Fortify Your Defenses] - "This session shows you how to build a predictive analytics stack on AWS, which harnesses the power of Amazon Machine Learning in conjunction with Amazon Elasticsearch Service, AWS CloudTrail, and VPC Flow Logs to perform tasks such as anomaly detection and log analysis. We also demonstrate how you can use AWS Lambda to act on this information in an automated fashion, such as performing updates to AWS WAF and security groups, leading to an improved security posture and alleviating operational burden on your security teams." - Michael Capicotto & Matt Nowina, AWS re:Invent 2016 <br /><br />
<br />
=== Blogs ===<br />
[https://blog.openai.com/adversarial-example-research/ Attacking Machine Learning with Adversarial Examples] - "In this post we’ll show how adversarial examples work across different mediums, and will discuss why securing systems against them can be difficult." - February 24, 2017<br /><br />
<br /><br />
<br />
== Tools ==<br />
[http://www.cs.waikato.ac.nz/ml/weka/ Weka] - "Weka is a collection of machine learning algorithms for data mining tasks. The algorithms can either be applied directly to a dataset or called from your own Java code. Weka contains tools for data pre-processing, classification, regression, clustering, association rules, and visualization. It is also well-suited for developing new machine learning schemes."<br /><br />
<br /><br />
<br />
== Languages and Libraries ==<br />
[http://scikit-learn.org/stable/ Scikit-Learn] - Data mining and data analysis in Python that is built on NumPy, SciPy, and matplotlib.<br /><br />
<br />
[https://www.tensorflow.org/ Tensor Flow] - TensorFlow™ is an open source software library for numerical computation using data flow graphs. Nodes in the graph represent mathematical operations, while the graph edges represent the multidimensional data arrays (tensors) communicated between them. The flexible architecture allows you to deploy computation to one or more CPUs or GPUs in a desktop, server, or mobile device with a single API.<br /><br />
<br />
[https://www.r-project.org/ R Project] - The R language is widely used among statisticians and data miners for developing statistical software and data analysis.<br /></div>Puhleyhttps://wiki.owasp.org/index.php?title=OWASP_Machine_Learning_Resources&diff=231547OWASP Machine Learning Resources2017-07-11T05:31:17Z<p>Puhley: Typo fix</p>
<hr />
<div><big>'''DRAFT VERSION'''</big><br /><br />
<br /><br />
<br /><br />
<br />
== Introduction ==<br />
<br /><br />
This page is intended to provide machine learning security resources for security researchers who are new to the field. It includes a few introductory resources for the basics of machine learning as well as examples of machine learning applied to security problems on different platforms. While there are many resources and conference talks available on the web, this page focuses on open-source projects and information that would be of interest to security researchers as a place to start learning. Rather than reinvent existing information, the approach of this page is to maintain context and accuracy by linking to original source materials.<br /><br />
<br /><br />
<br />
== Security Aspects of Machine Learning ==<br />
Machine Learning as it relates to security can be broken down into three broad categories.<br />
<br /><br />
# Adversarial Machine Learning - This technique attempts to confuse ML algorithms into returning the attacker's selected data instead of the expected response. <br />
# Machine learning for improved security analysis - Machine learning can be used in security log analysis in order to better detect or prevent attacks.<br />
# Attacks against machine learning software - These attacks target the software that is being used for machine learning with the hopes of causing a denial-of-service attack or arbitrary code execution. These types of attacks typically result in a software patch for the impacted library or service.<br />
<br /><br />
<br />
== Getting Started with the Basics of Machine Learning ==<br />
There are many free videos and interactive demos for machine learning available on the web. These are just a few options:<br /><br />
<br />
=== Videos ===<br />
[https://www.youtube.com/playlist?list=PLOU2XLYxmsIIuiBfYad6rFYQU_jL2ryal Machine Learning Recipes with Josh Gordon] - This Google Developer YouTube series focuses on TensorFlow and SciKit learn. The target audience is people who are new to machine learning and are able to read Python. - Josh Gordon, Google Developer YouTube channel, 2017.<br /><br />
<br />
=== Hands On Learning ===<br />
[http://playground.tensorflow.org/ Tensorflow Playground] - This web page allows you to play with neural networks from your web browser. The goal of the exercises are to design neural networks to match different data sets.<br /><br />
[https://gallery.cortanaintelligence.com/Experiment/Binary-Classification-Network-intrusion-detection-2 Azure Binary Classification: Network Intrusion Detection] - This lab demonstrates intrusion detection security analysis using Azure's Machine Learning environment. The lab exercise can be performed using a free account. In addition, the Cortana Intelligence Gallery has other types of anomaly detection examples from Microsoft and other contributors available from this site.<br /><br />
<br />
=== Cheat Sheets ===<br />
[http://download.microsoft.com/download/A/6/1/A613E11E-8F9C-424A-B99D-65344785C288/microsoft-machine-learning-algorithm-cheat-sheet-v6.pdf Microsoft Azure Machine Learning: Algorithm Cheat Sheet] - "This cheat sheet helps you choose the best Azure Machine Learning Studio algorithm for your predictive analytics solution. Your decision is driven by both the nature of your data and the question you’re trying to answer." <br /><br />
[https://s3.amazonaws.com/assets.datacamp.com/blog_assets/Scikit_Learn_Cheat_Sheet_Python.pdf Python for data science cheat sheet] - A cheat sheet for the different Scikit machine learning Python modules.<br /><br />
[http://scikit-learn.org/stable/tutorial/machine_learning_map/index.html Scikit Learn: Choosing the right estimator] - "The flowchart below is designed to give users a bit of a rough guide on how to approach problems with regard to which estimators to try on your data."<br /><br />
<br /><br />
<br />
== ML Security Resources == <br />
=== Consolidated Resource Sites ===<br />
[https://www.mlsecproject.org/ MLSec Project] - "MLSec Project is a select community of like-minded individuals that want to work together on using machine learning and data science in information security. It features open source projects, blog posts and community content to help further the understanding of how this technology can help defenders handle the growing complexity and verbosity of their environments and tools."<br />
<br /><br />
[https://github.com/yenchenlin/awesome-adversarial-machine-learning Awesome Adversarial Machine Learning] - A github project which is "A curated list of awesome adversarial machine learning resources" including blogs, papers, and talks.<br />
<br /><br />
<br />
=== Videos ===<br />
[https://www.youtube.com/watch?v=6Slj2FV9CLA Advances in Cloud-Scale Machine Learning for Cyberdefense] - "Picking an attacker's signals out of billions of log events in near real time from petabyte scale storage is a daunting task, but Microsoft has been using security data science at cloud scale to successfully disrupt attacker. This session presents the latest frameworks, techniques and the unconventional machine learning algorithms that Microsoft uses to protect its infrastructure and customers." - Mark Russinovich, BlueHat 2017 <br /><br />
[https://www.youtube.com/watch?v=fRklX97iGIw Machine Learning and the Cloud: Disrupting Threat Detection and Prevention] - "Machine learning with large data sets gives unprecedented insights and anomaly detection capability. Learn how Microsoft uses the agility and scale of the cloud to protect its infrastructure and customers by applying data mining and machine learning algorithms and security domain learnings to the vast amounts of data and telemetry gathered by its many different systems and services." - Mark Russinovich, RSA USA 2016.<br /><br />
[https://www.youtube.com/watch?v=Wh7nvpVQ_58 Predictive Security: Using Big Data to Fortify Your Defenses] - "This session shows you how to build a predictive analytics stack on AWS, which harnesses the power of Amazon Machine Learning in conjunction with Amazon Elasticsearch Service, AWS CloudTrail, and VPC Flow Logs to perform tasks such as anomaly detection and log analysis. We also demonstrate how you can use AWS Lambda to act on this information in an automated fashion, such as performing updates to AWS WAF and security groups, leading to an improved security posture and alleviating operational burden on your security teams." - Michael Capicotto & Matt Nowina, AWS re:Invent 2016 <br /><br />
<br />
=== Blogs ===<br />
[https://blog.openai.com/adversarial-example-research/ Attacking Machine Learning with Adversarial Examples] - "In this post we’ll show how adversarial examples work across different mediums, and will discuss why securing systems against them can be difficult." - February 24, 2017<br /><br />
<br /><br />
<br />
== Tools ==<br />
[http://www.cs.waikato.ac.nz/ml/weka/ Weka] - "Weka is a collection of machine learning algorithms for data mining tasks. The algorithms can either be applied directly to a dataset or called from your own Java code. Weka contains tools for data pre-processing, classification, regression, clustering, association rules, and visualization. It is also well-suited for developing new machine learning schemes."<br /><br />
<br /><br />
<br />
== Languages and Libraries ==<br />
[http://scikit-learn.org/stable/ Scikit-Learn] - Data mining and data analysis in Python that is built on NumPy, SciPy, and matplotlib.<br /><br />
<br />
[https://www.tensorflow.org/ Tensor Flow] - TensorFlow™ is an open source software library for numerical computation using data flow graphs. Nodes in the graph represent mathematical operations, while the graph edges represent the multidimensional data arrays (tensors) communicated between them. The flexible architecture allows you to deploy computation to one or more CPUs or GPUs in a desktop, server, or mobile device with a single API.<br /><br />
<br />
[https://www.r-project.org/ R Project] - The R language is widely used among statisticians and data miners for developing statistical software and data analysis.<br /></div>Puhleyhttps://wiki.owasp.org/index.php?title=OWASP_Machine_Learning_Resources&diff=231033OWASP Machine Learning Resources2017-06-27T17:01:56Z<p>Puhley: First rough draft of a possible machine learning resource page. Needs further review.</p>
<hr />
<div><big>'''DRAFT VERSION'''</big><br /><br />
<br /><br />
<br /><br />
<br />
== Introduction ==<br />
<br /><br />
This page is intended to provide machine learning security resources for security researchers who are new to the field. It includes a few introductory resources for the basics of machine learning as well as examples of machine learning applied to security problems on different platforms. While there are many resources and conference talks available on the web, this page focuses on open-source projects and information that would be of interest to security researchers as a place to start learning. Rather than reinvent existing information, the approach of this page is to maintain context and accuracy by linking to original source materials.<br /><br />
<br /><br />
<br />
== Security Aspects of Machine Learning ==<br />
Machine Learning as it relates to security can be broken down into three broad categories.<br />
<br /><br />
# Adversarial Machine Learning - This technique attempts to confuse ML algorithms into returning the attacker's selected data instead of the expected response. <br />
# Machine learning for improved security analysis - Machine learning can be used in security log analysis in order to better detect or prevent attacks.<br />
# Attacks against machine learning software - These attacks target the software that is being used for machine learning with the hopes of causing a denial-of-service attack or arbitrary code execution. These types of attacks typically result in a software patch for the impacted library or service.<br />
<br /><br />
<br />
== Getting Started with the Basics of Machine Learning ==<br />
There are many free videos and interactive demos for machine learning available on the web. These are just a few options:<br /><br />
<br />
=== Videos ===<br />
[https://www.youtube.com/playlist?list=PLOU2XLYxmsIIuiBfYad6rFYQU_jL2ryal Machine Learning Recipes with Josh Gordon] - This Google Developer YouTube series focuses on TensorFlow and SciKit learn. The target audience is people who are new to machine learning and are able to read Python. - Josh Gordon, Google Developer YouTube channel, 2017.<br /><br />
<br />
=== Hands On Learning ===<br />
[http://playground.tensorflow.org/ Tensorflow Playground] - This web page allows you to play with neural networks from your web browser. The goal of the exercises are to design neural networks to match different data sets.<br /><br />
[https://gallery.cortanaintelligence.com/Experiment/Binary-Classification-Network-intrusion-detection-2 Azure Binary Classification: Network Intrusion Detection] - This lab demonstrates intrusion detection security analysis using Azure's Machine Learning environment. The lab exercise can be performed using a free account. In addition, the Cortana Intelligence Gallery has other types of anomaly detection examples from Microsoft and other contributors available from this site.<br /><br />
<br />
=== Cheatsheets ===<br />
[http://download.microsoft.com/download/A/6/1/A613E11E-8F9C-424A-B99D-65344785C288/microsoft-machine-learning-algorithm-cheat-sheet-v6.pdf Microsoft Azure Machine Learning: Algorithm Cheat Sheet] - "This cheat sheet helps you choose the best Azure Machine Learning Studio algorithm for your predictive analytics solution. Your decision is driven by both the nature of your data and the question you’re trying to answer." <br/><br />
[https://s3.amazonaws.com/assets.datacamp.com/blog_assets/Scikit_Learn_Cheat_Sheet_Python.pdf Python for data science cheat sheet] - A cheat sheet for the different Scikit machine learning Python modules.<br/><br />
[http://scikit-learn.org/stable/tutorial/machine_learning_map/index.html Scikit Learn: Choosing the right estimator] - "The flowchart below is designed to give users a bit of a rough guide on how to approach problems with regard to which estimators to try on your data."<br/><br />
<br /><br />
<br />
== ML Security Resources == <br />
=== Consolidated resource sites ===<br />
[https://www.mlsecproject.org/ MLSec Project] - "MLSec Project is a select community of like-minded individuals that want to work together on using machine learning and data science in information security. It features open source projects, blog posts and community content to help further the understanding of how this technology can help defenders handle the growing complexity and verbosity of their environments and tools."<br />
<br /><br />
[https://github.com/yenchenlin/awesome-adversarial-machine-learning Awesome Adversarial Machine Learning] - A github project which is "A curated list of awesome adversarial machine learning resources" including blogs, papers, and talks.<br />
<br /><br />
<br />
=== Videos ===<br />
[https://www.youtube.com/watch?v=6Slj2FV9CLA Advances in Cloud-Scale Machine Learning for Cyberdefense] - "Picking an attacker's signals out of billions of log events in near real time from petabyte scale storage is a daunting task, but Microsoft has been using security data science at cloud scale to successfully disrupt attacker. This session presents the latest frameworks, techniques and the unconventional machine learning algorithms that Microsoft uses to protect its infrastructure and customers." - Mark Russinovich, BlueHat 2017 <br /><br />
[https://www.youtube.com/watch?v=fRklX97iGIw Machine Learning and the Cloud: Disrupting Threat Detection and Prevention] - "Machine learning with large data sets gives unprecedented insights and anomaly detection capability. Learn how Microsoft uses the agility and scale of the cloud to protect its infrastructure and customers by applying data mining and machine learning algorithms and security domain learnings to the vast amounts of data and telemetry gathered by its many different systems and services." - Mark Russinovich, RSA USA 2016.<br /><br />
[https://www.youtube.com/watch?v=Wh7nvpVQ_58 Predictive Security: Using Big Data to Fortify Your Defenses] - "This session shows you how to build a predictive analytics stack on AWS, which harnesses the power of Amazon Machine Learning in conjunction with Amazon Elasticsearch Service, AWS CloudTrail, and VPC Flow Logs to perform tasks such as anomaly detection and log analysis. We also demonstrate how you can use AWS Lambda to act on this information in an automated fashion, such as performing updates to AWS WAF and security groups, leading to an improved security posture and alleviating operational burden on your security teams." - Michael Capicotto & Matt Nowina, AWS re:Invent 2016 <br /><br />
<br />
=== Blogs ===<br />
[https://blog.openai.com/adversarial-example-research/ Attacking Machine Learning with Adversarial Examples] - "In this post we’ll show how adversarial examples work across different mediums, and will discuss why securing systems against them can be difficult." - February 24, 2017<br /><br />
<br /><br />
<br />
== Tools ==<br />
[http://www.cs.waikato.ac.nz/ml/weka/ Weka] - "Weka is a collection of machine learning algorithms for data mining tasks. The algorithms can either be applied directly to a dataset or called from your own Java code. Weka contains tools for data pre-processing, classification, regression, clustering, association rules, and visualization. It is also well-suited for developing new machine learning schemes."<br /><br />
<br /><br />
<br />
== Languages and Libraries ==<br />
[http://scikit-learn.org/stable/ Scikit-Learn] - Data mining and data analysis in Python that is built on NumPy, SciPy, and matplotlib.<br /><br />
<br />
[https://www.tensorflow.org/ Tensor Flow] - TensorFlow™ is an open source software library for numerical computation using data flow graphs. Nodes in the graph represent mathematical operations, while the graph edges represent the multidimensional data arrays (tensors) communicated between them. The flexible architecture allows you to deploy computation to one or more CPUs or GPUs in a desktop, server, or mobile device with a single API.<br /><br />
<br />
[https://www.r-project.org/ R Project] - The R language is widely used among statisticians and data miners for developing statistical software and data analysis.<br /></div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=180853Category:OWASP Flash Security Project2014-08-21T00:19:41Z<p>Puhley: </p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators_.2F_De-obfuscators Obfuscators/De-obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], 12th March 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31st July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/security/articles/flash-player-sandbox-bridge.html The Flash Player sandbox bridge] - This Adobe Developer Center article describes how the new LoaderInfo sandbox bridge APIs can be used as a safer alternative to Security.allowDomain(*).<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.2ka.org/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.swfwire.com/inspector SWFWire Inspector] An open source AIR application for viewing images, shapes, and even syntax-highlighted ActionScript 3 within SWF files.<br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
* [http://www.free-decompiler.com/flash/ JPEXS Free Flash Decompiler (FFDec)] JPEXS Free Flash Decompiler (FFDec) is free opensource Flash SWF Decompiler. Program can view source code of ActionScript 1/2 or 3 parts, export it or edit (p-code editor for AS3). Texts or images can be edited or replaced. The SWF decompiler can also export shapes, images, sounds or movies. SWF to FLA format conversion is also available. <br />
<br />
<br><br />
<br />
== Obfuscators / De-obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[https://github.com/F-Secure/Sulo Sulo] Sulo is an open-source project from F-Secure. It can log decrypted strings from SecureSWF-protected files and it can dynamically save swf objects loaded with Loader.loadBytes() to disk.<br />
<br />
*[http://sourceforge.net/p/swf-reader/wiki/Home/ SWF Reader] SWF Reader can edit and deobfuscate SWFs. It has implemented a few deobfuscators for AS2 and AS3 Flash but mostly concentrates on AS3 SWFs<br />
<br />
*[http://www.buraks.com/swfrul/ SWF Revealer] There are two versions of Buraks SWF Revealer. This link points to one version. There is another version is which is an add-on to Buraks ActionScript Viewer.<br />
<br />
*[http://swfid.zz.mu/ SWF ID] Detect common SWF protectors, SWF obfuscators, SWF cryptors and SWF compilers.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=180852Category:OWASP Flash Security Project2014-08-21T00:18:43Z<p>Puhley: </p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators_.2F_De-obfuscators Obfuscators/De-obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], 12th March 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31st July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/security/articles/flash-player-sandbox-bridge.html The Flash Player sandbox bridge] - This Adobe Developer Center article describes how the new LoaderInfo sandbox bridge APIs can be used as a safer alternative to Security.allowDomain(*).<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.2ka.org/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.swfwire.com/inspector SWFWire Inspector] An open source AIR application for viewing images, shapes, and even syntax-highlighted ActionScript 3 within SWF files.<br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
* [http://www.free-decompiler.com/flash/ JPEXS Free Flash Decompiler (FFDec)] JPEXS Free Flash Decompiler (FFDec) is free opensource Flash SWF Decompiler. Program can view source code of ActionScript 1/2 or 3 parts, export it or edit (p-code editor for AS3). Texts or images can be edited or replaced. The SWF decompiler can also export shapes, images, sounds or movies. SWF to FLA format conversion is also available. <br />
<br />
<br><br />
<br />
== Obfuscators/De-obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[https://github.com/F-Secure/Sulo Sulo] Sulo is an open-source project from F-Secure. It can log decrypted strings from SecureSWF-protected files and it can dynamically save swf objects loaded with Loader.loadBytes() to disk.<br />
<br />
*[http://sourceforge.net/p/swf-reader/wiki/Home/ SWF Reader] SWF Reader can edit and deobfuscate SWFs. It has implemented a few deobfuscators for AS2 and AS3 Flash but mostly concentrates on AS3 SWFs<br />
<br />
*[http://www.buraks.com/swfrul/ SWF Revealer] There are two versions of Buraks SWF Revealer. This link points to one version. There is another version is which is an add-on to Buraks ActionScript Viewer.<br />
<br />
*[http://swfid.zz.mu/ SWF ID] Detect common SWF protectors, SWF obfuscators, SWF cryptors and SWF compilers.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=180851Category:OWASP Flash Security Project2014-08-21T00:18:01Z<p>Puhley: </p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators/De-obfuscators Obfuscators/De-obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], 12th March 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31st July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/security/articles/flash-player-sandbox-bridge.html The Flash Player sandbox bridge] - This Adobe Developer Center article describes how the new LoaderInfo sandbox bridge APIs can be used as a safer alternative to Security.allowDomain(*).<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.2ka.org/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.swfwire.com/inspector SWFWire Inspector] An open source AIR application for viewing images, shapes, and even syntax-highlighted ActionScript 3 within SWF files.<br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
* [http://www.free-decompiler.com/flash/ JPEXS Free Flash Decompiler (FFDec)] JPEXS Free Flash Decompiler (FFDec) is free opensource Flash SWF Decompiler. Program can view source code of ActionScript 1/2 or 3 parts, export it or edit (p-code editor for AS3). Texts or images can be edited or replaced. The SWF decompiler can also export shapes, images, sounds or movies. SWF to FLA format conversion is also available. <br />
<br />
<br><br />
<br />
== Obfuscators/De-obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[https://github.com/F-Secure/Sulo Sulo] Sulo is an open-source project from F-Secure. It can log decrypted strings from SecureSWF-protected files and it can dynamically save swf objects loaded with Loader.loadBytes() to disk.<br />
<br />
*[http://sourceforge.net/p/swf-reader/wiki/Home/ SWF Reader] SWF Reader can edit and deobfuscate SWFs. It has implemented a few deobfuscators for AS2 and AS3 Flash but mostly concentrates on AS3 SWFs<br />
<br />
*[http://www.buraks.com/swfrul/ SWF Revealer] There are two versions of Buraks SWF Revealer. This link points to one version. There is another version is which is an add-on to Buraks ActionScript Viewer.<br />
<br />
*[http://swfid.zz.mu/ SWF ID] Detect common SWF protectors, SWF obfuscators, SWF cryptors and SWF compilers.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=180850Category:OWASP Flash Security Project2014-08-21T00:17:27Z<p>Puhley: </p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators/De-obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], 12th March 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31st July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/security/articles/flash-player-sandbox-bridge.html The Flash Player sandbox bridge] - This Adobe Developer Center article describes how the new LoaderInfo sandbox bridge APIs can be used as a safer alternative to Security.allowDomain(*).<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.2ka.org/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.swfwire.com/inspector SWFWire Inspector] An open source AIR application for viewing images, shapes, and even syntax-highlighted ActionScript 3 within SWF files.<br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
* [http://www.free-decompiler.com/flash/ JPEXS Free Flash Decompiler (FFDec)] JPEXS Free Flash Decompiler (FFDec) is free opensource Flash SWF Decompiler. Program can view source code of ActionScript 1/2 or 3 parts, export it or edit (p-code editor for AS3). Texts or images can be edited or replaced. The SWF decompiler can also export shapes, images, sounds or movies. SWF to FLA format conversion is also available. <br />
<br />
<br><br />
<br />
== Obfuscators/De-obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[https://github.com/F-Secure/Sulo Sulo] Sulo is an open-source project from F-Secure. It can log decrypted strings from SecureSWF-protected files and it can dynamically save swf objects loaded with Loader.loadBytes() to disk.<br />
<br />
*[http://sourceforge.net/p/swf-reader/wiki/Home/ SWF Reader] SWF Reader can edit and deobfuscate SWFs. It has implemented a few deobfuscators for AS2 and AS3 Flash but mostly concentrates on AS3 SWFs<br />
<br />
*[http://www.buraks.com/swfrul/ SWF Revealer] There are two versions of Buraks SWF Revealer. This link points to one version. There is another version is which is an add-on to Buraks ActionScript Viewer.<br />
<br />
*[http://swfid.zz.mu/ SWF ID] Detect common SWF protectors, SWF obfuscators, SWF cryptors and SWF compilers.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=180849Category:OWASP Flash Security Project2014-08-21T00:17:01Z<p>Puhley: </p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators/De-obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], 12th March 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31st July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/security/articles/flash-player-sandbox-bridge.html The Flash Player sandbox bridge] - This Adobe Developer Center article describes how the new LoaderInfo sandbox bridge APIs can be used as a safer alternative to Security.allowDomain(*).<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.2ka.org/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.swfwire.com/inspector SWFWire Inspector] An open source AIR application for viewing images, shapes, and even syntax-highlighted ActionScript 3 within SWF files.<br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
* [http://www.free-decompiler.com/flash/ JPEXS Free Flash Decompiler (FFDec)] JPEXS Free Flash Decompiler (FFDec) is free opensource Flash SWF Decompiler. Program can view source code of ActionScript 1/2 or 3 parts, export it or edit (p-code editor for AS3). Texts or images can be edited or replaced. The SWF decompiler can also export shapes, images, sounds or movies. SWF to FLA format conversion is also available. <br />
<br />
<br><br />
<br />
== Obfuscators/De-oobfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[https://github.com/F-Secure/Sulo Sulo] Sulo is an open-source project from F-Secure. It can log decrypted strings from SecureSWF-protected files and it can dynamically save swf objects loaded with Loader.loadBytes() to disk.<br />
<br />
*[http://sourceforge.net/p/swf-reader/wiki/Home/ SWF Reader] SWF Reader can edit and deobfuscate SWFs. It has implemented a few deobfuscators for AS2 and AS3 Flash but mostly concentrates on AS3 SWFs<br />
<br />
*[http://www.buraks.com/swfrul/ SWF Revealer] There are two versions of Buraks SWF Revealer. This link points to one version. There is another version is which is an add-on to Buraks ActionScript Viewer.<br />
<br />
*[http://swfid.zz.mu/ SWF ID] Detect common SWF protectors, SWF obfuscators, SWF cryptors and SWF compilers.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=176640ColdFusion Security Resources2014-06-07T06:56:42Z<p>Puhley: </p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[http://blogs.coldfusion.com/post.cfm/e-seminar-on-security-best-practices-for-coldfusion E-seminar on Security Best Practices for ColdFusion] A July 2013 Adobe e-seminar on security best practices for ColdFusion.<br><br />
[https://www.adobe.com/cfusion/event/index.cfm?id=2077374&loc=en%5Fus&event=register%5Fno%5Fsession Securing applications with ColdFusion 10 Security Enhancements] A 2012 Adobe e-seminar presentation by Shilpi Khariwal on security improvements in ColdFusion 10.<br><br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf11/cfml-developer-security-guide.pdf ColdFusion Developer Security Guide] A developer guide for secure coding by Pete Freitag. Quoting the paper: In this guide we will discuss several vulnerabilities that pertain to web applications. Most of the vulnerabilities discussed in this guide are not unique to ColdFusion, however the mitigation techniques discussed are ColdFusion specific.<br><br />
[http://blogs.coldfusion.com/assets/content/security/Security%20Best%20Practices%20for%20ColdFusion.pdf Security Best Practices for ColdFusion] These are the slides to the July 2013 Adobe e-seminar on Security Best Practices for ColdFusion.<br><br />
[http://blogs.coldfusion.com/assets/content/security/Securing%20applications%20with%20ColdFusion%2010%20security%20enhancements.pdf Securing Applications with ColdFusion 10 Security Enhancements] The slides from Shilpi Khariwal's 2012 e-seminar on ColdFusion 10 security features.<br><br />
[http://www.petefreitag.com/item/807.cfm ColdFusion 10 Security Enhancements] Pete Freitag's ColdFusion Developer Week 2012 presentation on the new security features available in ColdFusion 10.<br><br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements-cf11.html Security Improvements in ColdFusion 11] An Adobe ColdFusion blog providing details on the security features and enhancements to ColdFusion 11.<br><br />
[http://blogs.coldfusion.com/post.cfm/security-enhancements-in-coldfusion-splendor-pbkdf2-and-antisamy Security Enhancements in ColdFusion Splendor - PBKDF2 and AntiSamy] An Adobe ColdFusion blog providing insight into two new features in ColdFusion 11 (codename Splendor).<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf11/cf11-lockdown-guide.pdf ColdFusion 11 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 11.<br><br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br><br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf10/cf10-lockdown-guide.pdf ColdFusion 10 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 10.<br><br />
[http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/91025512-cf9-lockdownguide-wp-ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
[http://www.raymondcamden.com/index.cfm/2012/4/11/Security-Profile-Admin-Extension-for-ColdFusion-10 Security Profile Admin Extension for ColdFusion 10] This tool produces a one page report covering those security options set up during installation. It can be modified for CF 9.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=176639ColdFusion Security Resources2014-06-07T06:55:43Z<p>Puhley: </p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[http://blogs.coldfusion.com/post.cfm/e-seminar-on-security-best-practices-for-coldfusion E-seminar on Security Best Practices for ColdFusion] A July 2013 Adobe e-seminar on security best practices for ColdFusion.<br><br />
[https://www.adobe.com/cfusion/event/index.cfm?id=2077374&loc=en%5Fus&event=register%5Fno%5Fsession Securing applications with ColdFusion 10 Security Enhancements] A 2012 Adobe e-seminar presentation by Shilpi Khariwal on security improvements in ColdFusion 10.<br><br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://blogs.coldfusion.com/assets/content/security/Security%20Best%20Practices%20for%20ColdFusion.pdf Security Best Practices for ColdFusion] These are the slides to the July 2013 Adobe e-seminar on Security Best Practices for ColdFusion.<br><br />
[http://blogs.coldfusion.com/assets/content/security/Securing%20applications%20with%20ColdFusion%2010%20security%20enhancements.pdf Securing Applications with ColdFusion 10 Security Enhancements] The slides from Shilpi Khariwal's 2012 e-seminar on ColdFusion 10 security features.<br><br />
[http://www.petefreitag.com/item/807.cfm ColdFusion 10 Security Enhancements] Pete Freitag's ColdFusion Developer Week 2012 presentation on the new security features available in ColdFusion 10.<br><br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements-cf11.html Security Improvements in ColdFusion 11] An Adobe ColdFusion blog providing details on the security features and enhancements to ColdFusion 11.<br><br />
[http://blogs.coldfusion.com/post.cfm/security-enhancements-in-coldfusion-splendor-pbkdf2-and-antisamy Security Enhancements in ColdFusion Splendor - PBKDF2 and AntiSamy] An Adobe ColdFusion blog providing insight into two new features in ColdFusion 11 (codename Splendor).<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf11/cfml-developer-security-guide.pdf ColdFusion Developer Security Guide] A developer guide for secure coding by Pete Freitag. Quoting the paper: In this guide we will discuss several vulnerabilities that pertain to web applications. Most of the vulnerabilities discussed in this guide are not unique to ColdFusion, however the mitigation techniques discussed are ColdFusion specific.<br><br />
[http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf11/cf11-lockdown-guide.pdf ColdFusion 11 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 11.<br><br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br><br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf10/cf10-lockdown-guide.pdf ColdFusion 10 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 10.<br><br />
[http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/91025512-cf9-lockdownguide-wp-ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
[http://www.raymondcamden.com/index.cfm/2012/4/11/Security-Profile-Admin-Extension-for-ColdFusion-10 Security Profile Admin Extension for ColdFusion 10] This tool produces a one page report covering those security options set up during installation. It can be modified for CF 9.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=174517ColdFusion Security Resources2014-05-08T00:20:01Z<p>Puhley: </p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[http://blogs.coldfusion.com/post.cfm/e-seminar-on-security-best-practices-for-coldfusion E-seminar on Security Best Practices for ColdFusion] A July 2013 Adobe e-seminar on security best practices for ColdFusion.<br><br />
[https://www.adobe.com/cfusion/event/index.cfm?id=2077374&loc=en%5Fus&event=register%5Fno%5Fsession Securing applications with ColdFusion 10 Security Enhancements] A 2012 Adobe e-seminar presentation by Shilpi Khariwal on security improvements in ColdFusion 10.<br><br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://blogs.coldfusion.com/assets/content/security/Security%20Best%20Practices%20for%20ColdFusion.pdf Security Best Practices for ColdFusion] These are the slides to the July 2013 Adobe e-seminar on Security Best Practices for ColdFusion.<br><br />
[http://blogs.coldfusion.com/assets/content/security/Securing%20applications%20with%20ColdFusion%2010%20security%20enhancements.pdf Securing Applications with ColdFusion 10 Security Enhancements] The slides from Shilpi Khariwal's 2012 e-seminar on ColdFusion 10 security features.<br><br />
[http://www.petefreitag.com/item/807.cfm ColdFusion 10 Security Enhancements] Pete Freitag's ColdFusion Developer Week 2012 presentation on the new security features available in ColdFusion 10.<br><br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements-cf11.html Security Improvements in ColdFusion 11] An Adobe ColdFusion blog providing details on the security features and enhancements to ColdFusion 11.<br><br />
[http://blogs.coldfusion.com/post.cfm/security-enhancements-in-coldfusion-splendor-pbkdf2-and-antisamy Security Enhancements in ColdFusion Splendor - PBKDF2 and AntiSamy] An Adobe ColdFusion blog providing insight into two new features in ColdFusion 11 (codename Splendor).<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf11/cf11-lockdown-guide.pdf ColdFusion 11 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 11.<br><br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br><br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf10/cf10-lockdown-guide.pdf ColdFusion 10 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 10.<br><br />
[http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/91025512-cf9-lockdownguide-wp-ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
[http://www.raymondcamden.com/index.cfm/2012/4/11/Security-Profile-Admin-Extension-for-ColdFusion-10 Security Profile Admin Extension for ColdFusion 10] This tool produces a one page report covering those security options set up during installation. It can be modified for CF 9.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=174516ColdFusion Security Resources2014-05-08T00:16:13Z<p>Puhley: </p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[http://blogs.coldfusion.com/post.cfm/e-seminar-on-security-best-practices-for-coldfusion E-seminar on Security Best Practices for ColdFusion] A July 2013 Adobe e-seminar on security best practices for ColdFusion.<br><br />
[https://www.adobe.com/cfusion/event/index.cfm?id=2077374&loc=en%5Fus&event=register%5Fno%5Fsession Securing applications with ColdFusion 10 Security Enhancements] A 2012 Adobe e-seminar presentation by Shilpi Khariwal on security improvements in ColdFusion 10.<br><br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://blogs.coldfusion.com/assets/content/security/Security%20Best%20Practices%20for%20ColdFusion.pdf Security Best Practices for ColdFusion] These are the slides to the July 2013 Adobe e-seminar on Security Best Practices for ColdFusion.<br><br />
[http://blogs.coldfusion.com/assets/content/security/Securing%20applications%20with%20ColdFusion%2010%20security%20enhancements.pdf Securing Applications with ColdFusion 10 Security Enhancements] The slides from Shilpi Khariwal's 2012 e-seminar on ColdFusion 10 security features.<br><br />
[http://www.petefreitag.com/item/807.cfm ColdFusion 10 Security Enhancements] Pete Freitag's ColdFusion Developer Week 2012 presentation on the new security features available in ColdFusion 10.<br><br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements-cf11.html Security Improvements in ColdFusion 11] An Adobe ColdFusion blog providing details on the security features and enhancements to ColdFusion 11.<br><br />
[http://blogs.coldfusion.com/post.cfm/security-enhancements-in-coldfusion-splendor-pbkdf2-and-antisamy Security Enhancements in ColdFusion Splendor - PBKDF2 and AntiSamy] An Adobe ColdFusion blog providing insight into two new features in ColdFusion 11 (codename Splendor).<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br><br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf10/cf10-lockdown-guide.pdf ColdFusion 10 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 10.<br><br />
[http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/91025512-cf9-lockdownguide-wp-ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
[http://www.raymondcamden.com/index.cfm/2012/4/11/Security-Profile-Admin-Extension-for-ColdFusion-10 Security Profile Admin Extension for ColdFusion 10] This tool produces a one page report covering those security options set up during installation. It can be modified for CF 9.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=174515ColdFusion Security Resources2014-05-08T00:15:04Z<p>Puhley: </p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[http://blogs.coldfusion.com/post.cfm/e-seminar-on-security-best-practices-for-coldfusion E-seminar on Security Best Practices for ColdFusion] A July 2013 Adobe e-seminar on security best practices for ColdFusion.<br><br />
[https://www.adobe.com/cfusion/event/index.cfm?id=2077374&loc=en%5Fus&event=register%5Fno%5Fsession Securing applications with ColdFusion 10 Security Enhancements] A 2012 Adobe e-seminar presentation by Shilpi Khariwal on security improvements in ColdFusion 10.<br><br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://blogs.coldfusion.com/assets/content/security/Security%20Best%20Practices%20for%20ColdFusion.pdf Security Best Practices for ColdFusion] These are the slides to the July 2013 Adobe e-seminar on Security Best Practices for ColdFusion.<br><br />
[http://blogs.coldfusion.com/assets/content/security/Securing%20applications%20with%20ColdFusion%2010%20security%20enhancements.pdf Securing Applications with ColdFusion 10 Security Enhancements] The slides from Shilpi Khariwal's 2012 e-seminar on ColdFusion 10 security features.<br><br />
[http://www.petefreitag.com/item/807.cfm ColdFusion 10 Security Enhancements] Pete Freitag's ColdFusion Developer Week 2012 presentation on the new security features available in ColdFusion 10.<br><br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements-cf11.html http://www.adobe.com/devnet/coldfusion/articles/security-improvements-cf11.html] An Adobe ColdFusion blog providing details on the security features and enhancements to ColdFusion 11.<br><br />
[http://blogs.coldfusion.com/post.cfm/security-enhancements-in-coldfusion-splendor-pbkdf2-and-antisamy Security Enhancements in ColdFusion Splendor - PBKDF2 and AntiSamy] An Adobe ColdFusion blog providing insight into two new features in ColdFusion 11 (codename Splendor).<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br><br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf10/cf10-lockdown-guide.pdf ColdFusion 10 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 10.<br><br />
[http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/91025512-cf9-lockdownguide-wp-ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
[http://www.raymondcamden.com/index.cfm/2012/4/11/Security-Profile-Admin-Extension-for-ColdFusion-10 Security Profile Admin Extension for ColdFusion 10] This tool produces a one page report covering those security options set up during installation. It can be modified for CF 9.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=172945Category:OWASP Flash Security Project2014-04-17T02:29:25Z<p>Puhley: </p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], 12th March 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31st July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/security/articles/flash-player-sandbox-bridge.html The Flash Player sandbox bridge] - This Adobe Developer Center article describes how the new LoaderInfo sandbox bridge APIs can be used as a safer alternative to Security.allowDomain(*).<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.2ka.org/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.swfwire.com/inspector SWFWire Inspector] An open source AIR application for viewing images, shapes, and even syntax-highlighted ActionScript 3 within SWF files.<br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
* [http://www.free-decompiler.com/flash/ JPEXS Free Flash Decompiler (FFDec)] JPEXS Free Flash Decompiler (FFDec) is free opensource Flash SWF Decompiler. Program can view source code of ActionScript 1/2 or 3 parts, export it or edit (p-code editor for AS3). Texts or images can be edited or replaced. The SWF decompiler can also export shapes, images, sounds or movies. SWF to FLA format conversion is also available. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://sourceforge.net/p/swf-reader/wiki/Home/ SWF Reader] SWF Reader can edit and deobfuscate SWFs. It has implemented a few deobfuscators for AS2 and AS3 Flash but mostly concentrates on AS3 SWFs<br />
<br />
*[http://www.buraks.com/swfrul/ SWF Revealer] There are two versions of Buraks SWF Revealer. This link points to one version. There is another version is which is an add-on to Buraks ActionScript Viewer.<br />
<br />
*[http://swfid.zz.mu/ SWF ID] Detect common SWF protectors, SWF obfuscators, SWF cryptors and SWF compilers.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=172154ColdFusion Security Resources2014-04-09T22:05:11Z<p>Puhley: </p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[http://blogs.coldfusion.com/post.cfm/e-seminar-on-security-best-practices-for-coldfusion E-seminar on Security Best Practices for ColdFusion] A July 2013 Adobe e-seminar on security best practices for ColdFusion.<br><br />
[https://www.adobe.com/cfusion/event/index.cfm?id=2077374&loc=en%5Fus&event=register%5Fno%5Fsession Securing applications with ColdFusion 10 Security Enhancements] A 2012 Adobe e-seminar presentation by Shilpi Khariwal on security improvements in ColdFusion 10.<br><br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://blogs.coldfusion.com/assets/content/security/Security%20Best%20Practices%20for%20ColdFusion.pdf Security Best Practices for ColdFusion] These are the slides to the July 2013 Adobe e-seminar on Security Best Practices for ColdFusion.<br><br />
[http://blogs.coldfusion.com/assets/content/security/Securing%20applications%20with%20ColdFusion%2010%20security%20enhancements.pdf Securing Applications with ColdFusion 10 Security Enhancements] The slides from Shilpi Khariwal's 2012 e-seminar on ColdFusion 10 security features.<br><br />
[http://www.petefreitag.com/item/807.cfm ColdFusion 10 Security Enhancements] Pete Freitag's ColdFusion Developer Week 2012 presentation on the new security features available in ColdFusion 10.<br><br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://blogs.coldfusion.com/post.cfm/security-enhancements-in-coldfusion-splendor-pbkdf2-and-antisamy Security Enhancements in ColdFusion Splendor - PBKDF2 and AntiSamy] An Adobe ColdFusion blog providing insight into two new features in ColdFusion 11 (codename Splendor).<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br><br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf10/cf10-lockdown-guide.pdf ColdFusion 10 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 10.<br><br />
[http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/91025512-cf9-lockdownguide-wp-ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
[http://www.raymondcamden.com/index.cfm/2012/4/11/Security-Profile-Admin-Extension-for-ColdFusion-10 Security Profile Admin Extension for ColdFusion 10] This tool produces a one page report covering those security options set up during installation. It can be modified for CF 9.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=168958Category:OWASP Flash Security Project2014-02-25T19:34:30Z<p>Puhley: </p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], 12th March 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31st July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/security/articles/flash-player-sandbox-bridge.html The Flash Player sandbox bridge] - This Adobe Developer Center article describes how the new LoaderInfo sandbox bridge APIs can be used as a safer alternative to Security.allowDomain(*).<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.2ka.org/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.swfwire.com/inspector SWFWire Inspector] An open source AIR application for viewing images, shapes, and even syntax-highlighted ActionScript 3 within SWF files.<br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://sourceforge.net/p/swf-reader/wiki/Home/ SWF Reader] SWF Reader can edit and deobfuscate SWFs. It has implemented a few deobfuscators for AS2 and AS3 Flash but mostly concentrates on AS3 SWFs<br />
<br />
*[http://www.buraks.com/swfrul/ SWF Revealer] There are two versions of Buraks SWF Revealer. This link points to one version. There is another version is which is an add-on to Buraks ActionScript Viewer.<br />
<br />
*[http://swfid.zz.mu/ SWF ID] Detect common SWF protectors, SWF obfuscators, SWF cryptors and SWF compilers.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=168768Category:OWASP Flash Security Project2014-02-23T04:24:41Z<p>Puhley: </p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], 12th March 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31st July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/security/articles/flash-player-sandbox-bridge.html The Flash Player sandbox bridge] - This Adobe Developer Center article describes how the new LoaderInfo sandbox bridge APIs can be used as a safer alternative to Security.allowDomain(*).<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.2ka.org/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.swfwire.com/inspector SWFWire Inspector] An open source AIR application for viewing images, shapes, and even syntax-highlighted ActionScript 3 within SWF files.<br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://sourceforge.net/p/swf-reader/wiki/Home/ SWF Reader] SWF Reader can edit and deobfuscate SWFs. It has implemented a few deobfuscators for AS2 and AS3 Flash but mostly concentrates on AS3 SWFs.<br />
<br />
*[http://swfid.zz.mu/ SWF ID] Detect common SWF protectors, SWF obfuscators, SWF cryptors and SWF compilers.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=168767Category:OWASP Flash Security Project2014-02-23T04:19:04Z<p>Puhley: </p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], 12th March 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31st July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/security/articles/flash-player-sandbox-bridge.html The Flash Player sandbox bridge] - This Adobe Developer Center article describes how the new LoaderInfo sandbox bridge APIs can be used as a safer alternative to Security.allowDomain(*).<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.swfwire.com/inspector SWFWire Inspector] An open source AIR application for viewing images, shapes, and even syntax-highlighted ActionScript 3 within SWF files.<br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://sourceforge.net/p/swf-reader/wiki/Home/ SWF Reader] SWF Reader can edit and deobfuscate SWFs. It has implemented a few deobfuscators for AS2 and AS3 Flash but mostly concentrates on AS3 SWFs.<br />
<br />
*[http://swfid.zz.mu/ SWF ID] Detect common SWF protectors, SWF obfuscators, SWF cryptors and SWF compilers.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=168765Category:OWASP Flash Security Project2014-02-22T19:19:31Z<p>Puhley: </p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], 12th March 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31st July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/security/articles/flash-player-sandbox-bridge.html The Flash Player sandbox bridge] - This Adobe Developer Center article describes how the new LoaderInfo sandbox bridge APIs can be used as a safer alternative to Security.allowDomain(*).<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.swfwire.com/inspector SWFWire Inspector] An open source AIR application for viewing images, shapes, and even syntax-highlighted ActionScript 3 within SWF files.<br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://swfid.zz.mu/ SWF ID] Detect common SWF protectors, SWF obfuscators, SWF cryptors and SWF compilers.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=166818Category:OWASP Flash Security Project2014-01-29T09:07:06Z<p>Puhley: </p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], 12th March 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31st July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/security/articles/flash-player-sandbox-bridge.html The Flash Player sandbox bridge] - This Adobe Developer Center article describes how the new LoaderInfo sandbox bridge APIs can be used as a safer alternative to Security.allowDomain(*).<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.swfwire.com/inspector SWFWire Inspector] An open source AIR application for viewing images, shapes, and even syntax-highlighted ActionScript 3 within SWF files.<br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=157796ColdFusion Security Resources2013-09-04T00:39:20Z<p>Puhley: </p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[http://blogs.coldfusion.com/post.cfm/e-seminar-on-security-best-practices-for-coldfusion E-seminar on Security Best Practices for ColdFusion] A July 2013 Adobe e-seminar on security best practices for ColdFusion.<br><br />
[https://www.adobe.com/cfusion/event/index.cfm?id=2077374&loc=en%5Fus&event=register%5Fno%5Fsession Securing applications with ColdFusion 10 Security Enhancements] A 2012 Adobe e-seminar presentation by Shilpi Khariwal on security improvements in ColdFusion 10.<br><br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://blogs.coldfusion.com/assets/content/security/Security%20Best%20Practices%20for%20ColdFusion.pdf Security Best Practices for ColdFusion] These are the slides to the July 2013 Adobe e-seminar on Security Best Practices for ColdFusion.<br><br />
[http://blogs.coldfusion.com/assets/content/security/Securing%20applications%20with%20ColdFusion%2010%20security%20enhancements.pdf Securing Applications with ColdFusion 10 Security Enhancements] The slides from Shilpi Khariwal's 2012 e-seminar on ColdFusion 10 security features.<br><br />
[http://www.petefreitag.com/item/807.cfm ColdFusion 10 Security Enhancements] Pete Freitag's ColdFusion Developer Week 2012 presentation on the new security features available in ColdFusion 10.<br><br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br><br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf10/cf10-lockdown-guide.pdf ColdFusion 10 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 10.<br><br />
[http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/91025512-cf9-lockdownguide-wp-ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
[http://www.raymondcamden.com/index.cfm/2012/4/11/Security-Profile-Admin-Extension-for-ColdFusion-10 Security Profile Admin Extension for ColdFusion 10] This tool produces a one page report covering those security options set up during installation. It can be modified for CF 9.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=142078ColdFusion Security Resources2013-01-09T16:09:34Z<p>Puhley: /* References */</p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[https://www.adobe.com/cfusion/event/index.cfm?id=2077374&loc=en%5Fus&event=register%5Fno%5Fsession Securing applications with ColdFusion 10 Security Enhancements] A 2012 Adobe e-seminar presentation by Shilpi Khariwal on security improvements in ColdFusion 10.<br><br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://blogs.coldfusion.com/assets/content/security/Securing%20applications%20with%20ColdFusion%2010%20security%20enhancements.pdf Securing Applications with ColdFusion 10 Security Enhancements] The slides from Shilpi Khariwal's 2012 e-seminar on ColdFusion 10 security features.<br><br />
[http://www.petefreitag.com/item/807.cfm ColdFusion 10 Security Enhancements] Pete Freitag's ColdFusion Developer Week 2012 presentation on the new security features available in ColdFusion 10.<br><br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br><br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf10/cf10-lockdown-guide.pdf ColdFusion 10 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 10.<br><br />
[http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/91025512-cf9-lockdownguide-wp-ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
[http://www.raymondcamden.com/index.cfm/2012/4/11/Security-Profile-Admin-Extension-for-ColdFusion-10 Security Profile Admin Extension for ColdFusion 10] This tool produces a one page report covering those security options set up during installation. It can be modified for CF 9.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=141793Category:OWASP Flash Security Project2013-01-04T00:47:49Z<p>Puhley: /* Articles */</p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], 12th March 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31st July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/security/articles/flash-player-sandbox-bridge.html The Flash Player sandbox bridge] - This Adobe Developer Center article describes how the new LoaderInfo sandbox bridge APIs can be used as a safer alternative to Security.allowDomain(*).<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=134475ColdFusion Security Resources2012-08-19T16:06:07Z<p>Puhley: /* White Papers/Presentations */</p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[https://www.adobe.com/cfusion/event/index.cfm?id=2077374&loc=en%5Fus&event=register%5Fno%5Fsession Securing applications with ColdFusion 10 Security Enhancements] A 2012 Adobe e-seminar presentation by Shilpi Khariwal on security improvements in ColdFusion 10.<br><br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://blogs.coldfusion.com/assets/content/security/Securing%20applications%20with%20ColdFusion%2010%20security%20enhancements.pdf Securing Applications with ColdFusion 10 Security Enhancements] The slides from Shilpi Khariwal's 2012 e-seminar on ColdFusion 10 security features.<br><br />
[http://www.petefreitag.com/item/807.cfm ColdFusion 10 Security Enhancements] Pete Freitag's ColdFusion Developer Week 2012 presentation on the new security features available in ColdFusion 10.<br><br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br><br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/products/coldfusion/whitepapers/pdf/91025512_cf9_lockdownguide_wp_ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
[http://www.raymondcamden.com/index.cfm/2012/4/11/Security-Profile-Admin-Extension-for-ColdFusion-10 Security Profile Admin Extension for ColdFusion 10] This tool produces a one page report covering those security options set up during installation. It can be modified for CF 9.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=134474ColdFusion Security Resources2012-08-19T16:03:51Z<p>Puhley: /* Videos */</p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[https://www.adobe.com/cfusion/event/index.cfm?id=2077374&loc=en%5Fus&event=register%5Fno%5Fsession Securing applications with ColdFusion 10 Security Enhancements] A 2012 Adobe e-seminar presentation by Shilpi Khariwal on security improvements in ColdFusion 10.<br><br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://www.petefreitag.com/item/807.cfm ColdFusion 10 Security Enhancements] Pete Freitag's ColdFusion Developer Week 2012 presentation on the new security features available in ColdFusion 10.<br><br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br><br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/products/coldfusion/whitepapers/pdf/91025512_cf9_lockdownguide_wp_ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
[http://www.raymondcamden.com/index.cfm/2012/4/11/Security-Profile-Admin-Extension-for-ColdFusion-10 Security Profile Admin Extension for ColdFusion 10] This tool produces a one page report covering those security options set up during installation. It can be modified for CF 9.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=133828Category:OWASP Flash Security Project2012-08-02T17:43:33Z<p>Puhley: /* White Papers / Presentations */</p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], 12th March 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31st July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=133827Category:OWASP Flash Security Project2012-08-02T17:42:34Z<p>Puhley: /* White Papers / Presentations */</p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], March 12, 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31 July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=133826Category:OWASP Flash Security Project2012-08-02T17:38:28Z<p>Puhley: /* White Papers / Presentations */</p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], March 12, 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], OWASP AppSec (2007), San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC (2010), Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA (2012), Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], DefCon 17 (2009), Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL (2010), Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=133825Category:OWASP Flash Security Project2012-08-02T17:32:54Z<p>Puhley: /* White Papers / Presentations */</p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], March 12, 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf] This Black Hat USA 2012 presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31 July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=133824Category:OWASP Flash Security Project2012-08-02T17:32:28Z<p>Puhley: /* White Papers / Presentations */</p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], March 12, 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf] This Black Hat USA 2012 presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.<br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31 July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=133810Category:OWASP Flash Security Project2012-08-02T16:34:41Z<p>Puhley: /* AMF Tools */</p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], March 12, 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31 July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.<br />
<br />
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.<br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=131106ColdFusion Security Resources2012-06-07T19:28:20Z<p>Puhley: /* White Papers/Presentations */</p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://www.petefreitag.com/item/807.cfm ColdFusion 10 Security Enhancements] Pete Freitag's ColdFusion Developer Week 2012 presentation on the new security features available in ColdFusion 10.<br><br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br><br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/products/coldfusion/whitepapers/pdf/91025512_cf9_lockdownguide_wp_ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
[http://www.raymondcamden.com/index.cfm/2012/4/11/Security-Profile-Admin-Extension-for-ColdFusion-10 Security Profile Admin Extension for ColdFusion 10] This tool produces a one page report covering those security options set up during installation. It can be modified for CF 9.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=131015ColdFusion Security Resources2012-06-06T01:58:31Z<p>Puhley: /* Articles */</p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br><br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br><br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/products/coldfusion/whitepapers/pdf/91025512_cf9_lockdownguide_wp_ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
[http://www.raymondcamden.com/index.cfm/2012/4/11/Security-Profile-Admin-Extension-for-ColdFusion-10 Security Profile Admin Extension for ColdFusion 10] This tool produces a one page report covering those security options set up during installation. It can be modified for CF 9.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=131014ColdFusion Security Resources2012-06-06T01:58:17Z<p>Puhley: /* References */</p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br><br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/products/coldfusion/whitepapers/pdf/91025512_cf9_lockdownguide_wp_ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
[http://www.raymondcamden.com/index.cfm/2012/4/11/Security-Profile-Admin-Extension-for-ColdFusion-10 Security Profile Admin Extension for ColdFusion 10] This tool produces a one page report covering those security options set up during installation. It can be modified for CF 9.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=131013ColdFusion Security Resources2012-06-06T01:57:57Z<p>Puhley: /* Tools */</p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/products/coldfusion/whitepapers/pdf/91025512_cf9_lockdownguide_wp_ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
[http://www.raymondcamden.com/index.cfm/2012/4/11/Security-Profile-Admin-Extension-for-ColdFusion-10 Security Profile Admin Extension for ColdFusion 10] This tool produces a one page report covering those security options set up during installation. It can be modified for CF 9.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=131012ColdFusion Security Resources2012-06-06T01:53:12Z<p>Puhley: /* References */</p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://help.adobe.com/en_US/ColdFusion/10.0/Developing/WSe61e35da8d3185183e145c0d1353e31f559-8000.html Security Enhancements in ColdFusion 10] The official Adobe ColdFusion 10 reference documentation describing the new security protections available in ColdFusion 10.<br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/products/coldfusion/whitepapers/pdf/91025512_cf9_lockdownguide_wp_ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=ColdFusion_Security_Resources&diff=131011ColdFusion Security Resources2012-06-06T01:49:15Z<p>Puhley: /* Articles */</p>
<hr />
<div>== Overview ==<br />
The ColdFusion Security Resources project is an organized index of all the ColdFusion security resources on the Internet that would be useful to ColdFusion developers.<br><br />
<br />
== Goals ==<br />
The Security Resources projects aims to enable developers to easily find ColdFusion tools and resources regardless of whether they were developed by Adobe, OWASP or the ColdFusion development community.<br><br />
<br><br />
<br />
==Videos==<br />
[http://www.youtube.com/watch?v=lKri4nnVzA0 DeConstructing ColdFusion] This BlackHat 2010 video is a presentation by Chris Eng and Brandon Creighton from Veracode.<br><br />
[http://tv.adobe.com/watch/max-2010-develop/securing-coldfusion-applications/ Securing ColdFusion Applications] Jason Dean and Peleus Uhley present at Adobe Max 2010 on how to create secure ColdFusion applications.<br><br />
[http://cfmumbojumbo.com/cf/index.cfm/cfconferences/cfunited-2010/pete-freitag-secure-cfml/ Writing Secure CFML] Pete Freitag's presentation from CFUnited 2010.<br><br />
[http://experts.adobeconnect.com/p63949927/ Security: Hiding Information from Individuals Not Authorized to See It] Jim Harris present at the ColdFusion Meetup on March 17, 2011.<br><br />
[http://experts.adobeconnect.com/p25976495/ Security: Washing Your Incoming Data using ColdFusion] Jim Harris presents at the ColdFusion Meetup on March 10, 2011. <br><br />
[http://experts.adobeconnect.com/p22718297/ Security: Practical ColdFusion Security] Justin McLean presents at the ColdFusion Meetup on February 24, 2011. <br><br />
[http://experts.na3.acrobat.com/p87014288/ Application Security: Beyond SQL Injection] Jason Dean presents at the ColdFusion Meetup on January 22, 2009.<br><br />
[http://experts.na3.acrobat.com/p41776204/ Security Countermeasures for ColdFusion Programmers] Jim Harris presents at the ColdFusion Meeting on January 8, 2009<br><br />
[http://www.carehart.org/ugtv/list.cfm?search=security UGTV search] Many ColdFusion security topics can be found by searching UGTV for the word security.<br><br />
<br><br />
<br />
==White Papers/Presentations==<br />
[http://www.petefreitag.com/presentations/cfobjective/2011/maximum-security-cfml.pdf Maximum Security CFML] Pete Freitag's presentation from the CFObjective 2011 conference.<br><br />
[https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf Deconstructing ColdFusion] The slides from Chris Eng's and Brandon Creighton's presentation at BlackHat 2010.<br><br />
[http://foundeo.com/security/presentations/cfunited-writing-secure-cfml-2010.pdf Writing Secure CFML] Pete Freitag's slides from his CFUnited 2010 presentation.<br><br />
[http://foundeo.com/security/presentations/cfunited-coldfusion-lockdown-2010.pdf ColdFusion Lockdown] Pete Freitag's slides from his CFUnited 2010 presentation on locking down ColdFusion.<br><br />
[http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFusion.pdf Hack Proofing ColdFusion] Shlomy Gantz's presentation from CFUnited 2009.<br><br />
<br />
<br><br />
<br />
==Articles==<br />
[http://www.adobe.com/devnet/coldfusion/articles/security-improvements.html Security improvements in ColdFusion 10] This Adobe Developer Connection article highlights many of the new security features in ColdFusion 10 that can help with cross-site scripting, cross-site request forgery, session management and similar security issues.<br />
[http://www.adobe.com/devnet/coldfusion/articles/coldfusion-securing-apps.html Securing your applications using HttpOnly cookies with ColdFusion] An Adobe Developer Connection article by Pete Freitag detailing how to implement HttpOnly cookies in ColdFusion.<br><br />
[http://www.12robots.com/index.cfm/Security Jason Dean's blog] Jason Dean frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
[http://www.petefreitag.com/tag/security Pete Freitag's blog] Pete Freitag frequently blogs on ColdFusion application security topics. This is a collection of his blogs.<br><br />
<br />
<br><br />
<br />
==References==<br />
[http://www.adobe.com/devnet/coldfusion/security.html ColdFusion Security] The Adobe Developer Center's section on ColdFusion Security.<br><br />
[http://www.adobe.com/products/coldfusion/whitepapers/pdf/91025512_cf9_lockdownguide_wp_ue.pdf ColdFusion 9 Lockdown Guide] The Adobe server lockdown guide for ColdFusion 9.<br><br />
[http://www.adobe.com/support/security/#coldfusion ColdFusion Security Updates] The section of the Adobe Security page that lists current ColdFusion security patches.<br><br />
[http://help.adobe.com/en_US/ColdFusion/9.0/Developing/index.html ColdFusion 9 Developer Guide] Adobe's official documentation for ColdFusion 9 developers.<br><br />
<br />
<br><br />
<br />
==OWASP Resources==<br />
[http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=ColdFusion.2FCFML OWASP ESAPI - ColdFusion] The OWASP ESAPI project's ColdFusion distribution.<br><br />
[http://www.petefreitag.com/item/788.cfm Leveraging the ESAPI library in ColdFusion] Pete Freitag's blog on using the OWASP ESAPI library included in ColdFusion.<br><br />
[http://code.google.com/p/owasp-esapi-java/ OWASP ESAPI - Java] The OWASP ESAPI project's Java distribution.<br><br />
[http://www.owasp.org/index.php/Guide_Table_of_Contents OWASP Developer Guide] Many sections throughout the developer guide contain specific ColdFusion guidance.<br><br />
[http://www.petefreitag.com/item/760.cfm Using AntiSamy with ColdFusion] Pete Freitag's blog on using the OWASP Anti-Samy library with ColdFusion.<br><br />
<br />
<br><br />
<br />
==Tools==<br />
[https://www.veracode.com/press-releases/veracode-unveils-the-most-complete-cloud-based-application-security-testing-service-for-software-dev-3.html Veracode] Veracode is a commercial security testing company whose flagship product can test ColdFusion applications.<br><br />
[http://hackmycf.com/ Hack My CF] An online tool that specializes in hacking ColdFusion servers.<br><br />
[http://foundeo.com/security/ FuseGuard] A commercial web application firewall for ColdFusion servers.<br><br />
<br />
<br><br />
<br />
==Security Libraries==<br />
<br />
[http://www.oracle.com/technetwork/java/javase/downloads/index.html Java Cryptography Extension] It is possible to get stronger cryptography out of ColdFusion by updating the Java Policy files as described [http://www.danielgaspar.com/blog/2011/01/coldfusion-strong-encryption-256bit-and-higher/ here]. Ensure that you are adhering to your local government requirements.<br><br />
<br />
[http://tokenizer.riaforge.org/ Tokenizer] Tokenizer encapsulates all the heavy lifting of creating, expiring, checking and removing a unique token from Forms on your site to combat CSRF.<br />
<br />
[https://github.com/anthony-id/cfWSAuthenticator cfWSAuthenticator] A ColdFusion CFC to add WS-Security to SOAP requests.<br />
<br />
[https://github.com/anthony-id/cfSAML cfSAML] ColdFusion object to create SAML packets as an Identity Provider.<br />
<br />
<br><br />
<br />
==Project Contributors==<br />
<br />
The ColdFusion Security Resources section is run by [http://www.owasp.org/index.php/User:Puhley Peleus Uhley]<br></div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=128005Category:OWASP Flash Security Project2012-04-17T18:32:21Z<p>Puhley: /* AMF Tools */</p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], March 12, 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31 July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services. <br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Cross-Domain Tools ==<br />
<br />
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.<br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=126953Category:OWASP Flash Security Project2012-03-26T22:41:24Z<p>Puhley: /* AMF Tools */</p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], March 12, 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31 July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services. <br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=126952Category:OWASP Flash Security Project2012-03-26T22:40:19Z<p>Puhley: /* Local Shared Object Editors */</p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], March 12, 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31 July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services. <br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=125649Category:OWASP Flash Security Project2012-03-06T16:24:32Z<p>Puhley: /* Example Vulnerabilities */</p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], March 12, 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31 July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services. <br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhleyhttps://wiki.owasp.org/index.php?title=Category:OWASP_Flash_Security_Project&diff=125608Category:OWASP Flash Security Project2012-03-06T11:10:54Z<p>Puhley: /* AMF Tools */</p>
<hr />
<div>==== Main ====<br />
<br />
== Overview ==<br />
<br />
The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.<br />
<br />
== Goals ==<br />
<br />
The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.<br />
<br />
<br><br />
<br />
== Table of Contents ==<br />
<br />
{| cellspacing="1" cellpadding="1" border="0" style="width: 651px; height: 66px;"<br />
|-<br />
| '''Research'''<br />
| '''References'''<br />
| '''Tools'''<br />
| '''Libraries'''<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Videos Videos]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#References References]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#OWASP_Tools OWASP Tools]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Third-party_Security_Libraries 3rd Party Libs]<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]<br />
| <br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]<br />
|<br />
|-<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Local_Shared_Object_Editors LSO Editors]<br />
|<br />
|-<br />
|<br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]<br />
|<br />
|-<br />
| <br />
|<br />
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]<br />
|<br />
|}<br />
<br />
<br><br />
<br />
== Videos ==<br />
<br />
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.<br />
<br />
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.<br />
<br />
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long. <br />
<br />
* [http://h30431.www3.hp.com/index.jsp?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=bm Billy Wins A Cheeseburger] A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long. <br />
<br />
* [http://securitytube.net/Hacking-Flash-Applications-for-Fun-and-Profit-(Blackhat)-video.aspx Blinded by Flash: Widespread Security Risks Flash Developers Don't See] Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long. <br />
<br />
* [https://media.defcon.org/dc-17/video/DEFCON%2017%20Hacking%20Conference%20Presentation%20By%20Jon%20Rose%20-%20Deblaze%20A%20Remote%20Method%20Enumeration%20Tool%20for%20Flex%20Servers%20-%20Video%20and%20Slides.m4v Deblaze - A Remote Method Enumeration Tool for Flex Servers] This is an excellent 20 minute presentation from DefCon 17 by Jon Rose on how to test AMF services using the deBlaze tool that he authored. <br />
<br />
* [http://technet.microsoft.com/en-us/security/ee460903.aspx#ria RIA Security: Real-World Lessons from Flash and Silverlight] Jesse Collins from Microsoft's Silverlight team and Peleus Uhley from Adobe's Flash team discuss common threats to RIA applications. Approximately 1 hour long.<br />
<br />
<br><br />
<br />
== White Papers / Presentations ==<br />
<br />
'''Flash''' <br />
<br />
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA) <br />
<br />
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], March 12, 2008, Denmark <br />
<br />
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy). <br />
<br />
* '''Testing and Exploiting Flash Applications''' [http://events.ccc.de/camp/2007/Fahrplan/attachments/1320-FlashSec.pdf pdf], Fukami, Chaos Computer Camp, 2007 <br />
<br />
* '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose, CA (USA) <br />
<br />
* '''Neat, New, and Ridiculous Flash Hacks''' - whitepaper: [http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-wp.pdf pdf], presentation:[http://www.blackhat.com/presentations/bh-dc-10/Bailey_Mike/BlackHat-DC-2010-Bailey-Neat-New-Ridiculous-flash-hacks-slides.pdf pdf], Mike Bailey, Black Hat DC 2010, Washington, DC (USA)<br />
<br />
<br> '''AMF''' <br />
<br />
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)<br />
<br />
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31 July 2009, Las Vegas, NV (USA) <br />
<br />
<br> '''University Research''' <br />
<br />
* '''ActionScript bytecode verification with co-logic programming''' [http://portal.acm.org/citation.cfm?id=1554339.1554342 pdf], Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009. <br />
<br />
* '''Creating a more sophisticated security platform for Flash, AIR and others''' [http://www.utdallas.edu/~mxs072100/Adobe.ppt ppt] Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009 <br />
<br />
* '''ActionScript In-Lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl.pdf pdf], Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010. <br />
<br />
* '''ActionScript In-lined Reference Monitoring in Prolog''' [http://www.utdallas.edu/~mxs072100/padl10.pptx pptx] Presented at PADL 2010, Madrid, Spain by Meera Sridhar.<br />
<br />
<br><br />
<br />
== Articles ==<br />
<br />
'''Development'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html Creating more secure SWF web applications] This Adobe Developer Center article discusses secure ActionScript programming practices. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html Cross-domain policy file usage recommendations for Flash Player] This Adobe Developer Center article discusses some of the common security issues that you should consider when deciding how to use a cross-domain policy file on your server.<br />
<br />
* [http://www.insideria.com/2010/03/flash-player-10-security-model.html Flash Player 10 Security Model: Stakeholders and Sandboxes] This is an article that condenses the official Flash Player Security Model down to a one page article discussing the stakeholders and sandboxes.<br />
<br />
* [http://theflashblog.com/?p=419 AMFPHP Security Basics] This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.<br />
<br />
* [http://blogs.adobe.com/asset/2009/11/securely_deploying_cross-domai.html Securely Deploying Cross-Domain Policy files] This Adobe ASSET blog provides 5 tips for securely deploying cross-domain policy files.<br />
<br />
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.<br />
<br />
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.<br />
<br />
<br />
'''Penetration Testing'''<br />
* [http://www.ivizsecurity.com/blog/web-application-security/testing-flash-applications-pen-tester-guide/ A Lazy Pen Tester’s Guide to Testing Flash Applications] A short blog describing some of the basic steps of testing Flash applications by iViZ. <br />
<br />
* [http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/ Penetrating Intranets through Adobe Flex Applications] A short blog (03/17/2010) by Marcin Wielgoszewski of Gothan Digital Science introducing the [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] tool and how to take advantage of open BlazeDS proxies. <br />
<br />
* [http://www.gdssecurity.com/l/b/2009/11/11/pentesting-adobe-flex-applications-with-a-custom-amf-client/ Pentesting Adobe Flex Applications with a Custom AMF Client] A short blog (11/11/2009) by Marcin Wielgoszewski of Gothan Digital Science on how to write custom pyAMF-based clients for testing Flex services.<br />
<br />
* [http://erlend.oftedal.no/blog/?blogid=103 Client-side Remote File Inclusion in Flash] This blog discusses how to perform cross-site scripting attacks against applications that read in XML configuration files.<br />
<br />
* [http://code.google.com/p/doctype/wiki/ArticleFlashSecurity Flash Security] A Google code article on different types of cross-site scripting and crossdomain.xml attacks.<br />
<br />
<br />
'''Updates to the Flash Player Security Model'''<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.<br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html Understanding the security changes in Flash Player 10] - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10_uia_requirements.html User-initiated action requirements in Flash Player 10] - This Adobe Developer Center article describes the new user-initiated action requires in Flash Player 10. These requirements include chances to FileReference, Clipboard, full-screen mode and pop-up windows. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html Preparing for the Flash Player 9 April 2008 Security Update] - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html Security Changes in Flash Player 9] This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format. <br />
<br />
<br />
<br><br />
<br />
== Example Vulnerabilities ==<br />
<br />
''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''<br />
<br />
* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.<br />
<br />
* [http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw XSS Vulnerabilities in Common Flash Files] - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).<br />
<br />
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content. <br />
<br />
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.<br />
<br />
<br><br />
<br />
== References ==<br />
<br />
* [http://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OWASP-DV-004) OWASP Testing Guide: Testing for cross-site flashing] - Covers finding both cross-site scripting and cross-site flashing. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/security.html Adobe Flash Player Developer Center Security section] - Where Adobe posts articles and information related to Flash Player security. <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html Adobe Flash Player 10 Security Model] <br />
<br />
* [http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf Adobe Flash Player 9 Security Model] <br />
<br />
* [http://www.adobe.com/support/security/ Adobe Security Bulletins and Advisories] This is where Adobe posts all of their security advisories and bulletins. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7f9b.html Applying Flex Security] The security chapter from the Adobe Flex 4 manual. <br />
<br />
* [http://help.adobe.com/en_US/ActionScript/3.0_ProgrammingAS3/WS5b3ccc516d4fbf351e63e3d118a9b90204-7d23.html Flash Player Security] The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation. <br />
<br />
* [http://help.adobe.com/en_US/Flex/4.0/UsingSDK/WS2db454920e96a9e51e63e3d11c0bf69084-7d14.html Developing and Loading Sub-applications] This Flex SDK framework allows two or more untrusted SWFs to pass limited information between each other through the use of Shared Events.<br />
<br />
<br><br />
== Useful Specifications ==<br />
<br />
* [http://www.adobe.com/devnet/swf/ SWF File Format Specification] This documents the file format and structure of SWF files. <br />
<br />
* [http://www.adobe.com/devnet/actionscript/articles/avm2overview.pdf AVM2 Specification] Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf AMF3 Specification] The specification for version 3 of AMF used by Flash Player. <br />
<br />
* [http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf?version=1 AMF0 Specification] The specification for the first generation of AMF (AMF 0) used by Flash Player. <br />
<br />
* [http://www.adobe.com/devnet/rtmp/ RTMP Specification] This is the specification for the Real Time Messaging Protocol used by SWF content <br />
<br />
* [http://www.adobe.com/devnet/flv/ Video File Format Specification] The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software. <br />
<br />
* [http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html Cross-domain Policy File Specification] This document serves as a reference for the structure and use of cross-domain policy files.<br />
<br />
* [http://www.mozilla.org/projects/tamarin/ Tamarin Open Source Project] The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey. <br />
<br />
<br><br />
<br />
== Third-party Security Libraries ==<br />
<br />
* [http://crypto.hurlant.com/ AS3Crypto] - An ActionScript 3.0 cryptography library. <br />
<br />
* [http://code.google.com/p/as3corelib/ as3corelib] - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities. <br />
<br />
* [http://labs.adobe.com/wiki/index.php/Alchemy:Libraries Alchemy ActionScript 3 Crypto Wrapper] - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL. <br />
<br />
* [http://code.google.com/p/flash-validators/ flash-validators] - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries. <br />
<br />
* [http://bugs.adobe.com/jira/browse/BLZ-415 Protected Messaging Adaptor] - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this [http://www.jamesward.com/blog/2009/07/22/protected-messaging-in-flex-with-blazeds-and-lcds/ blog] by James Ward.<br />
<br />
* [http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/mx/validators/package-detail.html Flex validators] - Validation routines contained within the Adobe Flex SDK.<br />
<br />
<br><br />
<br />
== OWASP Tools ==<br />
<br />
* [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] OWASP Flash security testing tool <br />
<br />
<br><br />
== Static Analysis ==<br />
<br />
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.<br />
<br />
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.<br />
<br />
* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.<br />
<br />
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
<br><br />
<br />
== Disassemblers ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.<br />
<br />
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality. <br />
<br />
* [http://www.docsultant.com/nemo440/ Nemo440] Nemo440 is an AIR based ActionScript 3.0 disassembler. <br />
<br />
* [http://opensource.adobe.com/svn/opensource/flex/sdk/trunk/bin/ swfdump] The Adobe Flex SDK, when built with ant, creates the swfdump utility ([http://blogs.adobe.com/gosmith/2008/02/disassembling_a_swf_with_swfdu_1.html overview]). <br />
<br />
* [http://code.google.com/p/erlswf/ ErlSWF] A SWF disassembly tool based authored in Erlang <br />
<br />
* [http://www.masonchang.com/2008/06/building-abcdump.html abcdump] The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code. <br />
<br />
* [http://www.sweetscape.com/010editor/ 010Editor] This commercial tool has a [http://www.sweetscape.com/010editor/templates/files/SWFTemplate.bt template] for analyzing AS2 byte code.<br />
<br />
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.<br />
<br />
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm] RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.<br />
<br />
* [http://yogda.com/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.<br />
<br />
<br><br />
<br />
== Decompilers ==<br />
<br />
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.<br />
<br />
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X. <br />
<br />
* [http://www.buraks.com/asv/ Buraks ActionScript Viewer] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.sothink.com/product/flashdecompiler/ SoThink Flash Decompiler] '''($):''' An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping. <br />
<br />
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows. <br />
<br />
<br><br />
<br />
== Obfuscators ==<br />
<br />
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.<br />
<br />
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.<br />
<br />
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.<br />
<br />
<br><br />
<br />
== Local Shared Object Editors ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.<br />
<br />
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer. <br />
<br />
* [http://sourceforge.net/projects/soleditor/ .sol Editor] Windows based Local Shared Object editor <br />
<br />
<br><br />
<br />
== AMF Tools ==<br />
<br />
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.<br />
<br />
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks. <br />
<br />
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services. <br />
<br />
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing. <br />
<br />
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.<br />
<br />
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.<br />
<br />
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR. <br />
<br />
* [http://www.charlesproxy.com/ Charles Proxy] '''($):''' This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50. <br />
<br />
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values. <br />
<br />
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server. <br />
<br />
<br><br />
<br />
== Analysis ==<br />
<br />
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.<br />
<br />
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.<br />
<br />
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.<br />
<br />
* [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.<br />
<br />
<br><br />
<br />
== Project Contributors ==<br />
<br />
The Flash Security project is run by [[:User:Puhley|Peleus Uhley]]. <br />
<br />
== Project Sponsors ==<br />
<br />
The Flash Security project is sponsored by [http://www.mindedsecurity.com [[Image:|MindedLogo.PNG]]] <br />
<br />
==== Project Identification ====<br />
<br />
{{Template:Project Details/OWASP_Flash_Security_Project | OWASP Project Identification Tab}} <br />
<br />
__NOTOC__ <headertabs /> <br />
<br />
<br> __NOTOC__ <headertabs /> <br />
<br />
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>Puhley