Category:OWASP Flash Security Project - Revision history

Johanna Curiel at 22:12, 13 February 2016

2016-02-13T22:12:59Z

Johanna Curiel at 22:09, 13 February 2016

2016-02-13T22:09:26Z

Johanna Curiel at 22:09, 13 February 2016

2016-02-13T22:09:08Z

Raesene: /* Example Vulnerabilities */

2016-01-22T08:11:24Z

‎Example Vulnerabilities

Fran Brown: FlashDiggity - Stach & Liu re-branded as Bishop Fox. Updated website link accordingly and minor update to tool description.

2015-03-02T23:15:06Z

FlashDiggity - Stach & Liu re-branded as Bishop Fox. Updated website link accordingly and minor update to tool description.

Puhley at 00:19, 21 August 2014

2014-08-21T00:19:41Z

Puhley at 00:18, 21 August 2014

2014-08-21T00:18:43Z

Puhley at 00:18, 21 August 2014

2014-08-21T00:18:01Z

Puhley at 00:17, 21 August 2014

2014-08-21T00:17:27Z

Puhley at 00:17, 21 August 2014

2014-08-21T00:17:01Z

← Older revision		Revision as of 22:12, 13 February 2016
Line 387:		Line 387:
	<br> __NOTOC__ <headertabs />		<br> __NOTOC__ <headertabs />

−	[Category:Inactive_Projects]	+	[[Category:Inactive_Projects]]

← Older revision		Revision as of 22:09, 13 February 2016
Line 387:		Line 387:
	<br> __NOTOC__ <headertabs />		<br> __NOTOC__ <headertabs />

−	[[Category:Inactive_Projects]	+	[Category:Inactive_Projects]

← Older revision		Revision as of 22:09, 13 February 2016
Line 387:		Line 387:
	<br> __NOTOC__ <headertabs />		<br> __NOTOC__ <headertabs />

−	[[Category:~~OWASP_Project\|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]~~]	+	[[Category:Inactive_Projects]

← Older revision		Revision as of 08:11, 22 January 2016
Line 168:		Line 168:

	''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''		''The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.''
−
−	* [http://web.appsec.ws/FlashExploitDatabase.php Flash Exploit Database] This contains a list of popular, shared SWFs that have cross-site scripting vulnerabilities.

	* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.		* [http://blog.watchfire.com/wfblog/2010/03/cross-site-scripting-through-flash-in-gmail-based-services.html Cross-site Scripting through Flash in Gmail Based Services] - This is an example of a cross-site scripting vulnerability that was the result of passing tainted data to ExternalInterface.call.

@@ Line 247: / Line 247: @@
 * [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.
-* [http://www.stachliu.com/resources/tools/google-hacking-diggity-project/ FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Stach & Liu consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.
+* [http://www.bishopfox.com/resources/tools/google-hacking-diggity/attack-tools/#searchdiggity-v-3 FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Bishop Fox consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.  FlashDiggity automates Google/Bing searching/downloading/decompiling/analysis of SWF files to identify Flash vulnerabilities and information disclosures.
 * [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.

@@ Line 297: / Line 297: @@
 <br>
-== Obfuscators/De-obfuscators  ==
+== Obfuscators / De-obfuscators  ==
 It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.

@@ Line 42: / Line 42: @@
+|
+|
-| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators/De-obfuscators Obfuscators/De-obfuscators]
+| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators_.2F_De-obfuscators Obfuscators/De-obfuscators]
+|
 |-

@@ Line 42: / Line 42: @@
+|
+|
-| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]
+| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators/De-obfuscators]
+|
 |-
@@ Line 297: / Line 297: @@
 <br>
-== Obfuscators  ==
+== Obfuscators/De-oobfuscators  ==
 It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.
 It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.
 *[http://sourceforge.net/p/swf-reader/wiki/Home/ SWF Reader] SWF Reader can edit and deobfuscate SWFs. It has implemented a few deobfuscators for AS2 and AS3 Flash but mostly concentrates on AS3 SWFs