Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?

From the Area51 proposal.

share|improve this question

4 Answers 4

up vote 9 down vote accepted

From what I have been using: here http://www.swftools.org/ is a set of tools for work with SWF files, can be used for data structure analysis. Another one is a tool from HP specifically for scanning vulnerabilities in Flash: http://www.hp.com/go/swfscan (requires registration).

Tools that I have not used: Flare: http://www.nowrap.de/flare.html - there are also links to other tools, and Swfmill http://swfmill.org/ - tool to convert SWF to XML.

share|improve this answer
Neighbor has topic about Flash/SWF decompilers: questions.securitytube.net/questions/1687/… –  anonymous Nov 16 '10 at 16:05
  • SWFScan for any
  • Nemo 440 for AS3, Flex, AIR
  • Flare for AS2 (Flasm for disassmebly). These aren't as useful anymore
  • There is an IDA Pro plugin for Flash disassembly written by some guy from Microsoft

Also see osflash.org and flashsec.org

share|improve this answer

Another good tool that I have used successfully in the past is OWASP's SWF Intruder.

share|improve this answer

You can try SWF Decompiler to convert SWF to FLA for getting any information that might you wouldn't get from FLA Movies for penetration testing


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.