The flash tag has no wiki summary.
-5
votes
0answers
53 views
Can you tell the date files where deleted from a flash drive? [closed]
Is it possible to know WHEN the files were deleted?
0
votes
0answers
25 views
No apparent effect after editing some JSON in the memory of a Flash process [migrated]
I was trying to change the values of a Flash game which loads the SWF and some JSON over a HTTPS site. So changing the values of JSON was not possible using browser cache.
I changed the values of ...
1
vote
3answers
231 views
Is it safer to design websites and servers with HTML5 rather than flash?
I run a small business, designing and building websites. Currently our websites we build use Adobe Flash.
We are thinking about migrating to HTML 5, are there any security advantages in doing such a ...
1
vote
2answers
218 views
How is it possible that a virus can infect the system if the browser is started with non-admin rights
If I open my web browser (for example firefox) in Windows 7 with activated UAC as normal user (non admin) a virus - which uses a security leak in my browser - will only gets privileges of the normal ...
0
votes
2answers
146 views
Is a browser with disabled scripts and disabled java enough against malware
Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled java enough to be protected against dryve-by-malware from the internet.
Of course this does not ...
2
votes
2answers
214 views
Where do I get started in terms of learning how to exploit Java and Flash vulnerabilities? or browser exploitation in general
Another Java 0day was discovered today which got me thinking how browser exploitation (remote execution on clients browser) works.
I am unable to find any books or resources online about browser ...
1
vote
1answer
128 views
Need an explanation of Cross-Site Flashing?
I found this : http://demo.testfire.net/vulnerable.swf
Can anyone provide me examples of how these issues are exploited.
Thanks
3
votes
2answers
505 views
How to pentest Flash file on webapp with alowscriptaccess=samedomain?
In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through loadMovie. The HTML is this:
<embed width="388" height="350" ...
3
votes
1answer
718 views
XSS in SWF file
I have the following code in an SWF file that a vulnerability scanner marks as XSS:
// Action0
{
var __callResult_6 = getURL(_root.thankYou, "_self");
var __callResult_7 = stop();
...
7
votes
4answers
1k views
Can Javascript/Flash verify the SSL connection to prevent “SSL Inspection”?
I'd like to determine if an SSL webpage is being debugged through Fiddler, or if it's going through an SSL Proxy.
So some people may ask
What is the point of re-validating SSL using javascript?
...
2
votes
2answers
561 views
Why should crossdomain.xml be present if user-uploaded files exist?
In his book Michal Zalewski says:
To protect your users, include a top-level crossdomain.xml file with the permitted-cross-domain-policies parameter set to master-only or by-content-type, even if ...
1
vote
2answers
454 views
Are flash cookies still a threat and that persistent?
One year (or more) ago flash cookies were really a problem, because they could not be deleted from within a browser. They were not managed by the browser but by the flash player. Flash cookies were ...
2
votes
2answers
116 views
For untrusted user upload sites: what should the contents of crossdomain.xml and clientaccesspolicy.xml be?
Flash has a long history of ignoring MIME types of files and reading the file directly for executable content or for cross domain execution permissions. That means a malicious user can take advantage ...
4
votes
4answers
416 views
Is silverlight and Java running on the web browser capable of saving “state” into the user's local machines?
I am aware that even after we have cleared our cache and cookies, websites can still save files/information into our computer using Flash (Flash ever cookies),
I was wondering does other plugins like ...
4
votes
1answer
3k views
Is the service join.me actually a huge security risk?
In case you don't know, there is a website called join.me which lets you do screen sharing from a browser, using a flash program that is on the web page.
Until I encountered this service, I had no ...
5
votes
2answers
297 views
What is a Flash drive by download?
I've seen many people saying how some sites can infect your computer without actually clicking anything. They said that it was a "Flash Drive By" and it would use flash to download a file of any kind. ...
8
votes
1answer
732 views
How to perform penetration testing on a Flex application?
Possible Duplicate:
What tools are there to inspect Flash SWF files?
I have decompiled it, verified the source. All seems fine. Appscan also is not able to find anything in this case. But I ...
17
votes
4answers
2k views
What tools are there to inspect Flash SWF files?
I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?
From the Area51 proposal.
6
votes
4answers
284 views
Is flash or javascript a bigger security concern?
Many flash website whitelisting extensions for chrome (such as flashblock and flashcontrol) use javascript in order to selectively block Adobe Flash from functioning. Thus, In order to get this ...
