What tools are there to inspect Flash SWF files?

Question

I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?

---

From the Area51 proposal.

Answer 1

From what I have been using: here http://www.swftools.org/ is a set of tools for work with SWF files, can be used for data structure analysis. Another one is a tool from HP specifically for scanning vulnerabilities in Flash: http://www.hp.com/go/swfscan (requires registration).

Tools that I have not used: Flare: http://www.nowrap.de/flare.html - there are also links to other tools, and Swfmill http://swfmill.org/ - tool to convert SWF to XML.

Answer 2

• SWFScan for any
• Nemo 440 for AS3, Flex, AIR
• Flare for AS2 (Flasm for disassmebly). These aren't as useful anymore
• There is an IDA Pro plugin for Flash disassembly written by some guy from Microsoft

Also see osflash.org and flashsec.org

Answer 3

Another good tool that I have used successfully in the past is OWASP's SWF Intruder.

Answer 4

You can try SWF Decompiler to convert SWF to FLA for getting any information that might you wouldn't get from FLA Movies for penetration testing

http://www.sothink.com/product/flashdecompiler/