Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?

From the Area51 proposal.

share|improve this question
up vote 9 down vote accepted

From what I have been using: here is a set of tools for work with SWF files, can be used for data structure analysis. Another one is a tool from HP specifically for scanning vulnerabilities in Flash: (requires registration).

Tools that I have not used: Flare: - there are also links to other tools, and Swfmill - tool to convert SWF to XML.

share|improve this answer
Neighbor has topic about Flash/SWF decompilers:… – anonymous Nov 16 '10 at 16:05
  • SWFScan for any
  • Nemo 440 for AS3, Flex, AIR
  • Flare for AS2 (Flasm for disassmebly). These aren't as useful anymore
  • There is an IDA Pro plugin for Flash disassembly written by some guy from Microsoft

Also see and

share|improve this answer

Another good tool that I have used successfully in the past is OWASP's SWF Intruder.

share|improve this answer

You can try SWF Decompiler to convert SWF to FLA for getting any information that might you wouldn't get from FLA Movies for penetration testing

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.