Testing for Cross site flashing (OTG-CLIENT-008) - Revision history

Andrew Muller at 13:39, 8 August 2014

2014-08-08T13:39:23Z

2014-08-05T12:13:21Z

2014-05-19T12:13:58Z

Final edit

2013-08-05T22:11:06Z

Added SWF Investigator tool, changed "cross site" to "cross-site"

2013-02-19T19:15:54Z

2012-10-09T15:12:02Z

2009-08-20T22:39:53Z

2009-06-22T22:28:00Z

‎References

2009-06-22T22:15:06Z

‎Decompilation

2009-06-22T22:11:15Z

‎Description of the Issue

@@ Line 1: / Line 1: @@
 {{Template:OWASP Testing Guide v4}}
-== Brief Summary ==
+== Summary ==
 ActionScript is the language, based on ECMAScript, used by Flash applications when dealing with interactive needs. There are three versions of the ActionScript language.  ActionScript 1.0 and ActionScript 2.0 are very similar with ActionScript 2.0 being an extension of ActionScript 1.0. ActionScript 3.0, introduced with Flash Player 9, is a rewrite of the language to support object orientated design.
@@ Line 8: / Line 8: @@
-== Description of the Issue ==
+== How to Test ==
 Since the first publication of "Testing Flash Applications" [1], new versions of Flash player
 were released in order to mitigate some of the attacks which will be described.
 Nevertheless, some issues still remain exploitable because they are the result of insecure
 programming practices.
 === Decompilation ===
@@ Line 315: / Line 312: @@
 Cross-Site Scripting and Cross-Site Flashing are the expected results on a flawed SWF file.
 == References ==
@@ Line 333: / Line 348: @@
 * The Flash Player 10.0 Security Whitepaper: http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html

@@ Line 7: / Line 7: @@
 ActionScript, like every other language, has some implementation patterns which could lead to security issues.
-In particular, since Flash applications are often embedded in browsers, vulnerabilities like DOM based Cross Site Scripting could be present in flawed Flash applications.
+In particular, since Flash applications are often embedded in browsers, vulnerabilities like DOM based Cross-Site Scripting (XSS) could be present in flawed Flash applications.
 == Description of the Issue ==
@@ Line 246: / Line 246: @@
 be accomplished.
-=== Cross Site Flashing ===
+=== Cross-Site Flashing ===
-Cross Site Flashing (XSF) is a vulnerability which has a similar impact as XSS.
+Cross-Site Flashing (XSF) is a vulnerability which has a similar impact as XSS.
 XSF Occurs when from different domains:
@@ Line 299: / Line 299: @@
 '''Result Expected:'''<br>
-Cross Site Scripting and Cross Site Flashing are the expected results on a flawed SWF file.
+Cross-Site Scripting and Cross-Site Flashing are the expected results on a flawed SWF file.
 == References ==
@@ Line 319: / Line 319: @@
 '''Tools'''<br>
 * SWFScan: http://h30499.www3.hp.com/t5/Following-the-Wh1t3-Rabbit/SWFScan-FREE-Flash-decompiler/ba-p/5440167

@@ Line 319: / Line 319: @@
 '''Tools'''<br>
-* SWFScan: https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf
+* SWFScan: http://h30499.www3.hp.com/t5/Following-the-Wh1t3-Rabbit/SWFScan-FREE-Flash-decompiler/ba-p/5440167
 * SWFIntruder: https://www.owasp.org/index.php/Category:SWFIntruder

← Older revision		Revision as of 15:12, 9 October 2012
Line 1:		Line 1:
−	{{Template:OWASP Testing Guide v3}}	+	{{Template:OWASP Testing Guide v4}}

	== Brief Summary ==		== Brief Summary ==

@@ Line 230: / Line 230: @@
 * Direct XSS: <a href='javascript:alert(123)' >
-* Call as function: <a href='asfunction:function,arg' >
+* Call a function: <a href='asfunction:function,arg' >
 * Call SWF public functions:
@@ Line 265: / Line 265: @@
 XSF could be used in the presence of Flash HTML Injection or external SWF files when loadMovie*
 methods are used.
 === Attacks and Flash Player Version ===

← Older revision	Revision as of 12:13, 5 August 2014
(No difference)

@@ Line 292: / Line 292: @@
 * Finding Vulnerabilities in Flash Applications: http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt
-* Adobe Security: http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html
+* Adobe security updates with Flash Player 9,0,124,0 to reduce cross-site attacks: http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html
 * Securing SWF Applications: http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps.html
@@ Line 298: / Line 298: @@
 * The Flash Player Development Center Security Section: http://www.adobe.com/devnet/flashplayer/security.html
-* The Flash Player 9.0 Security Whitepaper: http://www.adobe.com/devnet/flashplayer/articles/flash_player_9_security.pdf
+* The Flash Player 10.0 Security Whitepaper: http://www.adobe.com/devnet/flashplayer/articles/flash_player10_security_wp.html
 '''Tools'''<br>

@@ Line 28: / Line 28: @@
 it will result in a new file called hello.flr.
-Decompilation helps testers in the process of testing because it
+Decompilation helps testers because it allows for source code assisted, or white-box, testing of the Flash applications.
 HP's free SWFScan tool can decompile both ActionScript 2.0 and ActionScript 3.0 [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan]
 === Undefined Variables FlashVars ===