Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I found this : http://demo.testfire.net/vulnerable.swf Can anyone provide me examples of how these issues are exploited. Thanks

share|improve this question

1 Answer

up vote 2 down vote accepted

Flash is jailed by the some-origin policy and can only act upon a site that loads the flash applet with scripting access enabled.

However, flash can become a vector for XSS. The demo above lists various XSS vectors. So for example in the extremely unlikely condition where you are loading a flash applet where the attacker can control the loadMovieNumVar variable then an attacker could execute JavaScript in the context of the site by setting this variable to javascript:alert('gotcha!').

XSS is extremely common and there are many ways that this attack can manifest. Flash based XSS is one way, and its also extremely uncommon.

share|improve this answer
So if attacker finds url like this : demo.testfire.net/vulnerable.swf?loadMovieNumVar=XSS he can try to exploit xss issue? – user1203028 Dec 6 '12 at 18:43
@user1203028 No... flash doesn't usually accept GET parameters like that, that is usually used by server-side code. Flash accepts these parameters defined in the <object> tag. – Rook Dec 6 '12 at 18:45
So if user input is reflected anywhere inside these dangerous parameters , than XSS can be exploited.Since GET is not an option. – user1203028 Dec 6 '12 at 19:07
@user1203028 yep – Rook Dec 6 '12 at 19:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.