This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Category:OWASP Flash Security Project"

From OWASP
Jump to: navigation, search
 
(48 intermediate revisions by 4 users not shown)
Line 27: Line 27:
 
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]
 
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#White_Papers_.2F_Presentations White Papers/Presentations]
 
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]
 
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Useful_Specifications Specifications]
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]
+
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Static_Analysis Static Analysis]
 
|
 
|
 
|-
 
|-
 
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]
 
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Articles Articles]
 
|  
 
|  
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]
+
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Disassemblers Disassemblers]
 
|
 
|
 
|-
 
|-
 
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]
 
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Example_Vulnerabilities Example Vulnerabilities]
 
|
 
|
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators Obfuscators]
+
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Decompilers Decompilers]
 
|
 
|
 
|-
 
|-
|
 
 
|
 
|
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]
+
|
 +
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Obfuscators_.2F_De-obfuscators Obfuscators/De-obfuscators]
 
|
 
|
 
|-
 
|-
Line 53: Line 53:
 
|
 
|
 
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]
 
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#AMF_Tools AMF Tools]
 +
|
 +
|-
 +
|
 +
|
 +
| [http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project#Analysis Analysis/Defense]
 
|
 
|
 
|}
 
|}
Line 59: Line 64:
  
 
== Videos  ==
 
== Videos  ==
 +
 +
* [http://tv.adobe.com/show/how-to-develop-secure-flash-platform-apps/ How to Develop Secure Flash Platform Apps] An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.
 +
 +
* [http://tv.adobe.com/watch/max-2010-develop/creating-secure-actionscript-applications/ Creating Secure ActionScript Applications] An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.
 +
 +
* [http://vimeo.com/15506137 Assessing, Testing & Validating Flash Content] A 45 minute talk from OWASP AppSec USA 2010 on how to assess and test Flash applications. The talk is by Peleus Uhley.
  
 
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long.  
 
* [http://tv.adobe.com/#vi+f15384v1102 Understanding the Flash Player Security Model] Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long.  
Line 78: Line 89:
 
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA)  
 
* '''Flash Parameter Injection''' [http://blog.watchfire.com/FPI.pdf pdf], IBM Rational Application Security Team, [http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference OWASP AppSec 2008], 24th September 2008, NYC, NY (USA)  
  
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], March 12, 2008, Denmark  
+
* '''Testing Flash Applications using WebScarab''' [https://www.owasp.org/images/5/58/Testing_Flash_Applications.pdf pdf], Martin Clausen - Deloitte [http://www.owasp.org/index.php/Denmark Denmark Chapter Meeting], 12th March 2008, Denmark  
  
 
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy).  
 
* '''Testing Flash Applications''' [http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt ppt], Stefano Di Paola, [http://www.owasp.org/index.php/6th_OWASP_AppSec_Conference_-_Italy_2007/Agenda Owasp Appsec 2007], 17th May 2007, Milan (Italy).  
Line 89: Line 100:
  
 
<br> '''AMF'''  
 
<br> '''AMF'''  
 +
 +
* '''AMF Testing Made Easy''' - whitepaper: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_WP.pdf pdf], presentation: [https://media.blackhat.com/bh-us-12/Briefings/Carettoni/BH_US_12_Carettoni_AMF_Testing_Slides.pdf pdf], Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the [http://code.google.com/p/blazer/ Blazer] tool with Burp to conduct AMF testing.
  
 
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)
 
* '''Pentesting Adobe Flex Applications''' - [http://www.gdssecurity.com/l/OWASP_NYNJMetro_Pentesting_Flex.pdf pdf], Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)
  
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31 July 2009, Las Vegas, NV (USA)  
+
* '''DeBlaze: A remote enumeration tool for Flex servers''' [http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-jon_rose-deblaze.pdf pdf], Jon Rose, [http://www.defcon.org/html/links/dc-archives/dc-17-archive.html#Rose DefCon 17], 31st July 2009, Las Vegas, NV (USA)  
  
 
<br> '''University Research'''  
 
<br> '''University Research'''  
Line 120: Line 133:
  
 
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.
 
* [http://askmeflash.com/article/16/securing-your-flash-application Securing your Flash Application] A quick ten item checklist of high level things to look for in your SWF before shipping.
 +
 +
* [http://www.senocular.com/flash/tutorials/contentdomains/ Security Domains, Application Domains, and More in ActionScript 3.0] A fairly in depth article by Senocular.com explaining security domains, application domains, cross-domain policy files, allowDomain() and more.
  
  
Line 135: Line 150:
  
 
'''Updates to the Flash Player Security Model'''
 
'''Updates to the Flash Player Security Model'''
 +
* [http://www.adobe.com/devnet/security/articles/flash-player-sandbox-bridge.html The Flash Player sandbox bridge] - This Adobe Developer Center article describes how the new LoaderInfo sandbox bridge APIs can be used as a safer alternative to Security.allowDomain(*).
 +
 
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR.  This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.
 
* [http://www.adobe.com/devnet/flashplayer/articles/fplayer10.1_air2_security_changes.html Understanding the security changes in Flash Player 10.1 and AIR 2] - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR.  This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.
  
Line 157: Line 174:
  
 
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content.  
 
* [http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004514.html clickTAG Cross-site scripting] - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content.  
 +
 +
* [http://jeremiahgrossman.blogspot.com/2008/09/i-used-to-know-what-you-watched-on.html I used to know what you watched on YouTube] - Jeremiah Grossman's blog post regarding his attack on youTube.com's "*.google.com" cross-domain permission.
  
 
<br>
 
<br>
Line 220: Line 239:
  
 
<br>
 
<br>
 +
== Static Analysis ==
 +
 +
* [http://opensource.adobe.com/wiki/display/flexpmd/FlexPMD FlexPMD] Performs general code analysis with a few security checks.
 +
 +
* [https://www.fortify.com/products/hpfssc/source-code-analyzer.html Fortify Static Code Analyzer] '''($)''' Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.
 +
 +
* [http://www.bishopfox.com/resources/tools/google-hacking-diggity/attack-tools/#searchdiggity-v-3 FlashDiggity] FlashDiggity is part of the SearchDiggity tool created by the Bishop Fox consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related.  FlashDiggity automates Google/Bing searching/downloading/decompiling/analysis of SWF files to identify Flash vulnerabilities and information disclosures.
 +
 +
* [http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/SWFScan-FREE-Flash-decompiler/ba-p/5440167 SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.
 +
 +
<br>
 +
 
== Disassemblers  ==
 
== Disassemblers  ==
 +
 +
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.
  
 
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality.  
 
* [http://flasm.sourceforge.net/ Flasm] Flasm provides both disassembly and assembly functionality.  
Line 235: Line 268:
  
 
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.
 
* [http://segfaultlabs.com/swfutils swfutils] An ActionScript 3 library for disassembling SWF files.
 +
 +
* [https://github.com/CyberShadow/RABCDAsm#readme RABCDAsm]  RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.
 +
 +
* [http://yogda.2ka.org/ Yogda AVM2 Workbench] Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.
  
 
<br>
 
<br>
Line 242: Line 279:
 
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping.  
 
* [http://www.flash-decompiler.com/ Flash Decompiler Trillix] '''($):''' Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping.  
  
* [http://www.communities.hp.com/securitysoftware/blogs/spilabs/archive/2009/03/20/exposing-flash-application-vulnerabilities-with-swfscan.aspx SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content. Available for download from here: [ftp://swfscanr:[email protected]/ FTP]
+
* [http://www.swfwire.com/inspector SWFWire Inspector] An open source AIR application for viewing images, shapes, and even syntax-highlighted ActionScript 3 within SWF files.
 +
 
 +
* [https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf SWFScan] This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.
  
 
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X.  
 
* [http://www.nowrap.de/flare.html Flare] Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X.  
Line 251: Line 290:
  
 
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows.  
 
* [http://www.dcomsoft.com/download/dfdinstall.exe Dump Flash Decompiler] Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows.  
 +
 +
* [http://www.free-decompiler.com/flash/ JPEXS Free Flash Decompiler (FFDec)] JPEXS Free Flash Decompiler (FFDec) is free opensource Flash SWF Decompiler. Program can view source code of ActionScript 1/2 or 3 parts, export it or edit (p-code editor for AS3). Texts or images can be edited or replaced. The SWF decompiler can also export shapes, images, sounds or movies. SWF to FLA format conversion is also available.
  
 
<br>
 
<br>
  
== Obfuscators  ==
+
== Obfuscators / De-obfuscators ==
  
 
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.
 
It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.
Line 260: Line 301:
 
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.
 
It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.
  
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.
+
*[https://github.com/F-Secure/Sulo Sulo] Sulo is an open-source project from F-Secure. It can log decrypted strings from SecureSWF-protected files and it can dynamically save swf objects loaded with Loader.loadBytes() to disk.
 
 
<br>
 
 
 
== Analysis  ==
 
  
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement.  This project is currently targeted at AVM2 code.
+
*[http://sourceforge.net/p/swf-reader/wiki/Home/ SWF Reader] SWF Reader can edit and deobfuscate SWFs. It has implemented a few deobfuscators for AS2 and AS3 Flash but mostly concentrates on AS3 SWFs
  
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement.  This project currently handles AVM1 code.
+
*[http://www.buraks.com/swfrul/ SWF Revealer] There are two versions of Buraks SWF Revealer. This link points to one version. There is another version is which is an add-on to Buraks ActionScript Viewer.
  
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.
+
*[http://swfid.zz.mu/ SWF ID] Detect common SWF protectors, SWF obfuscators, SWF cryptors and SWF compilers.
  
 +
*[http://www.dcomsoft.com/ DComSoft SWF Protector] '''($):''' ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.
  
 
<br>
 
<br>
  
 
== Local Shared Object Editors  ==
 
== Local Shared Object Editors  ==
 +
 +
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Cross-platform tool for viewing and editing LSOs.
 +
 +
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin.
  
 
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer.  
 
* [http://solve.sourceforge.net/ SolVE] Cross-platform Local Shared Object editor and viewer.  
Line 282: Line 324:
  
 
<br>
 
<br>
 +
 
== AMF Tools  ==
 
== AMF Tools  ==
 +
 +
* [http://labs.adobe.com/technologies/swfinvestigator/ Adobe SWF Investigator] Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.
 +
 +
* [http://blog.coursevector.com/flashbug Flashbug] An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.
  
 
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks.  
 
* [http://deblaze-tool.appspot.com/ DeBlaze] A free tool that attempts to identify AMF services through brute force, dictionary attacks.  
  
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.  
+
* [http://www.gdssecurity.com/l/t/d.php?k=Blazentoo Blazentoo] Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.
 +
 
 +
* [http://code.google.com/p/blazer/ Blazer] Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.
  
 
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing.  
 
* [http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project WebScarab] Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing.  
  
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.  
+
* [http://code.google.com/p/webscarab-amf-plugin/ WebScarab AMF Plugin] This is a google code project to add AMF support as a plugin to WebScarab.
 +
 
 +
* [http://amfparser.codeplex.com/ AMF Parser] AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.
  
 
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR.  
 
* [http://code.google.com/p/pinta/ pinta] Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR.  
Line 297: Line 348:
  
 
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values.  
 
* [http://releases.portswigger.net/2009/08/v1214.html Burp Suite Professional] '''($):''' The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values.  
 +
 +
* [http://george.hedfors.com/content/action-message-format-amf-shell AMF Shell] AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server.
 +
 +
<br>
 +
 +
== Cross-Domain Tools ==
 +
 +
* [http://web.appsec.ws/Tools/Crossdomain.swf Cross-domain Policy Analyzer] A tool to test your cross-domain policy file by Jason Calvert of WhiteHat Security.
 +
 +
<br>
 +
 +
== Analysis  ==
 +
 +
* [http://www.utdallas.edu/~mxs072100/ASIRM_project.html Certifying IRM for ActionScript Bytecode] This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement.  This project is currently targeted at AVM2 code.
 +
 +
* [http://blitzableiter.recurity.com/ Blitzablieter] Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement.  This project currently handles AVM1 code.
 +
 +
* [http://wepawet.iseclab.org/ Wepawet] Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.
 +
 +
*  [https://github.com/sporst/SWFREtools/ SWFRETools] The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.
  
 
<br>
 
<br>
 +
 
== Project Contributors  ==
 
== Project Contributors  ==
  
Line 315: Line 387:
 
<br> __NOTOC__ <headertabs />  
 
<br> __NOTOC__ <headertabs />  
  
[[Category:OWASP_Project|Flash Security Project]] [[Category:OWASP_Download]] [[Category:OWASP_Tool]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]
+
[[Category:Inactive_Projects]]

Latest revision as of 22:12, 13 February 2016

Main

Overview

The OWASP Flash Security Project is an open project for sharing knowledge in order to raise awareness of Flash application security.

Goals

The OWASP Flash Security Project aims to share guidelines, tools and resources for securing Flash applications.


Table of Contents

Research References Tools Libraries
Videos References OWASP Tools 3rd Party Libs
White Papers/Presentations Specifications Static Analysis
Articles Disassemblers
Example Vulnerabilities Decompilers
Obfuscators/De-obfuscators
LSO Editors
AMF Tools
Analysis/Defense


Videos

  • How to Develop Secure Flash Platform Apps An Adobe TV series discussing how to author and test secure Flash applications. The presentations cover common vulnerabilities in SWF content and how to avoid them. Each video is about 5-10 minutes long and is by Peleus Uhley.
  • Creating Secure ActionScript Applications An hour long video targeted at developers and QEs on creating secure Flash applications from Adobe MAX 2010. Adobe MAX is Adobe's developer conference. The talk is by Peleus Uhley.
  • Understanding the Flash Player Security Model Deneb Meketa of Adobe gives a one hour presentation at the Adobe MAX 2008 conference in San Francisco entitled, "Flash Security: Why and how." This presentation provides a good overview of several aspects of Flash Player's security model. Approximately 1 hour long.
  • Billy Wins A Cheeseburger A video by HP that explains a basic Flash vulnerability that can be found by decompilers. Approximately 3 minutes long.
  • Blinded by Flash: Widespread Security Risks Flash Developers Don't See Prajakta Jagdale describes the attack surface flash applications have based on various things developers overlook. In this presentation she talks about the basic cross domain security model between flash applets, Cross Site Scripting attacks on Flash applications, Data injection attacks, Flash malware, decompilation of Flash swf files, code and binary obfuscation and many other attack vectors which a malicious attacker could use to hack Flash applications. Approximately 1 hour long.


White Papers / Presentations

Flash

  • Flash Parameter Injection pdf, IBM Rational Application Security Team, OWASP AppSec 2008, 24th September 2008, NYC, NY (USA)
  • Testing Flash Applications ppt, Stefano Di Paola, Owasp Appsec 2007, 17th May 2007, Milan (Italy).
  • Testing and Exploiting Flash Applications pdf, Fukami, Chaos Computer Camp, 2007
  • Finding Vulnerabilities in Flash Applications ppt, Stefano Di Paola, Owasp Appsec 2007, 15th November 2007, San Jose, CA (USA)
  • Neat, New, and Ridiculous Flash Hacks - whitepaper: pdf, presentation:pdf, Mike Bailey, Black Hat DC 2010, Washington, DC (USA)


AMF

  • AMF Testing Made Easy - whitepaper: pdf, presentation: pdf, Luca Carettoni, Black Hat USA 2012, Las Vegas, NV (USA). This presentation discusses how to use the Blazer tool with Burp to conduct AMF testing.
  • Pentesting Adobe Flex Applications - pdf, Marcin Wielgoszewski, April 2010 OWASP NYC Chapter Meeting, NYC, NY (USA)
  • DeBlaze: A remote enumeration tool for Flex servers pdf, Jon Rose, DefCon 17, 31st July 2009, Las Vegas, NV (USA)


University Research

  • ActionScript bytecode verification with co-logic programming pdf, Brian W. DeVries, Gopal Gupta, Kevin W. Hamlen, Scott Moore, and Meera Sridhar of The University of Texas at Dallas, Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security 2009.
  • Creating a more sophisticated security platform for Flash, AIR and others ppt Presented at Adobe Systems, Inc. by Meera Sridhar, November, 2009
  • ActionScript In-Lined Reference Monitoring in Prolog pdf, Meera Sridhar and Kevin W. Hamlen of The University of Texas at Dallas, Proceedings of the Twelfth Symposium on Practical Aspects of Declarative Languages (PADL), Jan 2010.
  • ActionScript In-lined Reference Monitoring in Prolog pptx Presented at PADL 2010, Madrid, Spain by Meera Sridhar.


Articles

Development

  • AMFPHP Security Basics This a blog covering how to secure AMFPHP version 1.9 and higher. AMFPHP is server-side code that receives AMF requests from Flash clients.


Penetration Testing

  • Flash Security A Google code article on different types of cross-site scripting and crossdomain.xml attacks.


Updates to the Flash Player Security Model

  • The Flash Player sandbox bridge - This Adobe Developer Center article describes how the new LoaderInfo sandbox bridge APIs can be used as a safer alternative to Security.allowDomain(*).
  • Understanding the security changes in Flash Player 10.1 and AIR 2 - This Adobe Developer Center article describes the new changes that affect security in Flash Player 10.1 and AIR. This article discusses a new feature, LoaderContext.allowCodeImport, which can help in safely loading remote content via loadBytes(). It also discusses minor changes in behavior that may require action by the developer.
  • Understanding the security changes in Flash Player 10 - This Adobe Developer Center article describes the new changes that affect security in the Flash Player 10. This includes information on changes to socket timing, policy file strictness, upload and download, RTMFP and full screen mode.
  • Preparing for the Flash Player 9 April 2008 Security Update - This Adobe Developer Center article describes the new mitigations for DNS Rebinding (socket policy files), cross-site flashing and the introduction of cross-domain header meta-policies to help address attacks such as the UPnP attack.
  • Security Changes in Flash Player 9 This Adobe Developer Center article describes the important changes that need to be made to existing crossdomain.xml and socket policy files. All websites that use cross-domain or socket policy files will need to implement these changes in order to be compatible with Adobe's new format. After the implementation of Phase II, Adobe will no longer support the old format.



Example Vulnerabilities

The intent of this section is to provide real-world examples of exploitation. This can be useful for consultants to help demonstrate to clients that these techniques have been used in the wild. In some instances, these examples include individual SWFs that were copied to hundreds of web sites. Therefore, a consultant should look for these specific SWFs on a website when performing an assessment to ensure that they have a current version.

  • XSS Vulnerabilities in Common Flash Files - This paper by Rich Cannings shows sample attack URLs for individual SWFs that are hosted across hundreds of websites. The techniques demonstrated in this paper for achieving cross-site scripting including using javascript: URLs, asfunction: URLs, and loading malicious child SWFs (aka cross-site Flashing).
  • clickTAG Cross-site scripting - It is very common for Flash-based advertisements to accept a FlashVar called, clickTAG. If the clickTAG FlashVar is passed directly to a browser navigation API, such as getURL, then the attacker can achieve cross-site scripting by changing the clickTAG URL to a javascript: URL. Cross-site scripting as the result of a manipulated clickTAG FlashVar is the most common manifestation of cross-site scripting in Flash content.


References

  • Flash Player Security The security chapter from the Programming ActionScript 3.0 section the Flash CS4 Documentation.


Useful Specifications

  • AVM2 Specification Describes the Flash ActionScript Virtual Machine used for ActionScript 3.0 code.
  • AMF0 Specification The specification for the first generation of AMF (AMF 0) used by Flash Player.
  • RTMP Specification This is the specification for the Real Time Messaging Protocol used by SWF content
  • Video File Format Specification The FLV/F4V open specification documents the file formats for storing media content used to deliver streaming audio and video for playback in Adobe® Flash® Player and Adobe AIR™ software.
  • Tamarin Open Source Project The Tamarin virtual machine is used within the Adobe Flash Player and is also being adopted for use by projects outside Adobe. The Tamarin just-in-time compiler (the "NanoJIT") is a collaboratively developed component used by both Tamarin and Mozilla TraceMonkey.


Third-party Security Libraries

  • AS3Crypto - An ActionScript 3.0 cryptography library.
  • as3corelib - An Adobe sponsored Google Code project that contains ActionScript 3.0 implementations of WS-Security, SHA, MD5 and other utilities.
  • Alchemy ActionScript 3 Crypto Wrapper - An Adobe labs project to port OpenSSL to ActionScript using Alchemy (previously known as Flacc). Includes the SHA1, SHA2, MD5, PKCS12 and AES from OpenSSL.
  • flash-validators - An Adobe sponsored Google Code project that contains ActionScript 2.0 and ActionScript 3.0 data validation libraries.
  • Protected Messaging Adaptor - This addition to the latest version of BlazeDS protects against an attack that allows an untrusted individual to subscribe to wildcard sub-topics. This threat is described within this blog by James Ward.
  • Flex validators - Validation routines contained within the Adobe Flex SDK.


OWASP Tools


Static Analysis

  • FlexPMD Performs general code analysis with a few security checks.
  • Fortify Static Code Analyzer ($) Fortify's SCA supports searching for vulnerabilities within ActionScript 3.0, Flex 3 and Flex 4 applications.
  • FlashDiggity FlashDiggity is part of the SearchDiggity tool created by the Bishop Fox consulting firm. It will decompile the SWF and use regular expressions to search for strings that are security related. FlashDiggity automates Google/Bing searching/downloading/decompiling/analysis of SWF files to identify Flash vulnerabilities and information disclosures.
  • SWFScan This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.


Disassemblers

  • Adobe SWF Investigator An Adobe Labs project that performs disassembly of ActionScript 2 and ActionScript 3. Also shows SWF Tag information.
  • Flasm Flasm provides both disassembly and assembly functionality.
  • Nemo440 Nemo440 is an AIR based ActionScript 3.0 disassembler.
  • swfdump The Adobe Flex SDK, when built with ant, creates the swfdump utility (overview).
  • ErlSWF A SWF disassembly tool based authored in Erlang
  • abcdump The abcdump tool can be built from the tamarin source tree to disassemble AS3 byte code.
  • swfutils An ActionScript 3 library for disassembling SWF files.
  • RABCDAsm RABCDAsm is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.
  • Yogda AVM2 Workbench Yogda® is a development tool for intermediate/advanced actionscript programmers. It includes an AVM2 disassembler.


Decompilers

  • Flash Decompiler Trillix ($): Windows and Mac versions. Supports ActionScript 2.0 and ActionScript 3.0, Flash 5, 6, 7, 8, 9, 10, Flash CS5 and Flex. Able to extract resources,edit SWF elements and provide a source FLA file. Costs @ $80 plus tax/shipping.
  • SWFWire Inspector An open source AIR application for viewing images, shapes, and even syntax-highlighted ActionScript 3 within SWF files.
  • SWFScan This Windows tool decompiles a SWF and performs static analysis to identify common vulnerabilities for both ActionScript 2.0 and ActionScript 3.0 content.
  • Flare Flare ActionScript 2.0 decompiler for Windows, Linux and Mac OS X.
  • Buraks ActionScript Viewer ($): An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping.
  • SoThink Flash Decompiler ($): An ActionScript 2.0 and ActionScript 3.0 decompiler that is able to extract resources and provide a rough FLA file. Costs @ $80 plus tax/shipping.
  • Dump Flash Decompiler Freeware program that treats compressed and decompressed SWF-files and shows the detailed structure in the tree form. Windows.
  • JPEXS Free Flash Decompiler (FFDec) JPEXS Free Flash Decompiler (FFDec) is free opensource Flash SWF Decompiler. Program can view source code of ActionScript 1/2 or 3 parts, export it or edit (p-code editor for AS3). Texts or images can be edited or replaced. The SWF decompiler can also export shapes, images, sounds or movies. SWF to FLA format conversion is also available.


Obfuscators / De-obfuscators

It should be noted that no obfuscator can protect a SWF from being reverse engineered. An attacker will always be able to extract data from SWFs if they believe it is worth the effort. Obfuscators are only serve as a deterrent for preventing casual inspection of the SWF.

It should also be noted that some obfuscators generate SWFs that do not conform to the Adobe SWF file format specification. Flash Player may still be able to play them but they do not conform to the spec. This could lead to some security tools such as Blitzablieter rejecting them as potentially malicious.

  • Sulo Sulo is an open-source project from F-Secure. It can log decrypted strings from SecureSWF-protected files and it can dynamically save swf objects loaded with Loader.loadBytes() to disk.
  • SWF Reader SWF Reader can edit and deobfuscate SWFs. It has implemented a few deobfuscators for AS2 and AS3 Flash but mostly concentrates on AS3 SWFs
  • SWF Revealer There are two versions of Buraks SWF Revealer. This link points to one version. There is another version is which is an add-on to Buraks ActionScript Viewer.
  • SWF ID Detect common SWF protectors, SWF obfuscators, SWF cryptors and SWF compilers.
  • DComSoft SWF Protector ($): ActionScript 2.0/3.0 obfuscator for protecting your SWF files from Flash Decompilers. Available for Windows, Mac OS, Linux. Costs approximately $40.


Local Shared Object Editors

  • Flashbug An extension for the Firefox Firebug plugin.
  • SolVE Cross-platform Local Shared Object editor and viewer.


AMF Tools

  • Adobe SWF Investigator Allows sending of custom messages, simple fuzzing and service identification of AMF endpoints.
  • Flashbug An extension for the Firefox Firebug plugin that allows you to view AMF data sent to and from the page to the server.
  • DeBlaze A free tool that attempts to identify AMF services through brute force, dictionary attacks.
  • Blazentoo Blazentoo is an Adobe AIR application that can be used to exploit insecure Adobe BlazeDS and LiveCycle Data Services ES servers. Blazentoo provides the ability to seamlessly browse web content, abusing insecurely configured Proxy Services.
  • Blazer Blazer is a custom AMF messages generator with fuzzing capabilities, developed as Burp Suite plugin. It is designed and implemented to make AMF testing easy, and yet allows researchers to control fully the entire security testing process.
  • WebScarab Full AMF support is currently checked into the main branch of the WebScarab project. It has not been rolled into the SourceForge or Java Web Start versions of the WebScarab project at the time of this writing.
  • AMF Parser AMFParser plugin for Fiddler2 web debugger. It can be used for parsing and displaying AMF data inside HTTP's POST requests and responses.
  • pinta Pinta is a utility that allows a developer to test services by making custom AMF service calls, and viewing detailed output. This Google Code project is based on Adobe AIR.
  • Charles Proxy ($): This is a basic HTTP proxy but it provides support for interpreting AMF communications. Costs approximately $50.
  • Burp Suite Professional ($): The 1.2.124 version of Burp Suite Pro adds AMF support to all tools except for Burp Intruder and Burp Scanner is updated to automatically place attack payloads within string-based AMF values.
  • AMF Shell AMF Shell is a command line utility based on Python that enumerates services and allows the user to send customized AMF messages to a server.


Cross-Domain Tools


Analysis

  • Certifying IRM for ActionScript Bytecode This page contains the binaries for Meera Sridhar's research into using In-lined Reference Monitors to rewrite ActionScript bytecode for the purposes of policy enforcement. This project is currently targeted at AVM2 code.
  • Blitzablieter Blitzablieter is a project currently run by Recurity Labs and the German government. The goal is to prevent malicious SWFs from entering a network through normalization and policy enforcement. This project currently handles AVM1 code.
  • Wepawet Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files. It is currently run by University of California, Santa Barbara.
  • SWFRETools The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.


Project Contributors

The Flash Security project is run by Peleus Uhley.

Project Sponsors

The Flash Security project is sponsored by [[Image:|MindedLogo.PNG]]

Project Identification

PROJECT INFO
What does this OWASP project offer you?
RELEASE(S) INFO
What does this OWASP project release offer you?
what is this project?
OWASP Flash Security Project

Purpose: OWASP Flash Security Project is an open project for sharing a knowledge base in order to raise awareness around the subject of Flash applications security.

License: N/A

who is working on this project?
Project Leader: Peleus Uhley

Project Maintainer:

Project Contributor(s): N/A

how can you learn more?
Project Pamphlet: N/A

3x slide Project Presentation: N/A

Mailing list: Subscribe or read the archives

Project Roadmap: N/A

Main links: N/A

Project Health: Yellow button.JPG Not Reviewed (Provisional)
To be reviewed under Assessment Criteria v2.0

Key Contacts
  • Contact Peleus Uhley to contribute, review or sponsor this project
  • Contact the GPC to report a problem or concern about this project or to update information.
current release
First Release - Unknown Date - (no download available)

Release Leader: N/A

Release details: N/A :

Rating: Yellow button.JPG Not Reviewed
To be reviewed under Assessment Criteria v2.0



This category currently contains no pages or media.