Questions tagged [flash]
Risks associated with the Adobe Flash animation file format and its use on the web, as well as Flash player applications. For flash drives, use the tag flash-memory.
15
questions
15
votes
6
answers
7k
views
Can Javascript/Flash verify the SSL connection to prevent "SSL Inspection"?
I'd like to determine if an SSL webpage is being debugged through Fiddler, or if it's going through an SSL Proxy.
So some people may ask
What is the point of re-validating SSL using javascript?
...
4
votes
3
answers
2k
views
Flash ignores Content-Type header, allowing XSS?
I recently read that the Flash plugin ignores the Content-Type header in certain circumstances. In particular, you can give Flash a URL, and the Flash plugin will happily fetch the content at that ...
8
votes
2
answers
1k
views
What is a Flash drive by download?
I've seen many people saying how some sites can infect your computer without actually clicking anything. They said that it was a "Flash Drive By" and it would use flash to download a file of any kind. ...
14
votes
2
answers
4k
views
Why are Adobe Flash exploits found so often? [closed]
Over the last couple of years Adobe Flash published bug fixes for (zero-day) exploits so often, that the installation is already annoying. But why are exploits so often found in this particular ...
13
votes
4
answers
4k
views
Preventing reverse-engineering of client application
I have a web service which is used by a Flash client. Both the service and the Flash client is produced by me (read: my company). The Flash client communicates with the server over HTTPS.
One of the ...
3
votes
3
answers
1k
views
Are flash cookies still a threat and that persistent?
One year (or more) ago flash cookies were really a problem, because they could not be deleted from within a browser. They were not managed by the browser but by the flash player. Flash cookies were ...
3
votes
1
answer
13k
views
How to detect, inspect and delete a super cookie of a specific website? [closed]
Definition of supercookie from the paper I am reading:
"Supercookies settle in parts of the system that are
harder to erase, and include the usage of Flash Local Shared Objects
and IE Local ...
1
vote
1
answer
605
views
Need an explanation of Cross-Site Flashing?
I found this - can anyone provide me examples of how these issues are exploited?
46
votes
3
answers
6k
views
For an end-user, is HTML5/JavaScript more secure than Flash?
I’m not talking about server-side security or even necessarily XSS vulnerabilities, as these are attacks on vulnerable services and do not use any pre-existing vulnerabilities on the client side to ...
20
votes
2
answers
1k
views
What was behind the surge of Adobe Flash Player vulnerabilities/patches in 2015?
It's no secret that 2015 was a rough year, security-wise, for Adobe's Flash Player. Aside from Adobe itself beginning to essentially deprecate Flash development largely due to Flash Player's ...
19
votes
4
answers
10k
views
What tools are there to inspect Flash SWF files?
I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?
From the Area51 proposal.
9
votes
2
answers
16k
views
Is the service join.me actually a huge security risk?
In case you don't know, there is a website called join.me which lets you do screen sharing from a browser, using a flash program that is on the web page.
Until I encountered this service, I had no ...
2
votes
3
answers
515
views
Is Firefox on Ubuntu less secured (does it not confine Flash)?
Ubuntu Linux makes it easy to install Flash as soon as you encounter it. Just like Firefox on Windows really! Using Ubuntu's package it even provides security updates through the standard OS method[...
1
vote
1
answer
122
views
Does the Flash installer use an encrypted download?
A lot of popular applications use customer downloaders rather than allow the user to download the installation binary directly from Adobe, or whoever the OEM might be. For example, here is the Flash ...
-2
votes
2
answers
882
views
Does Microsoft EMET protect against latest Hacking Team Adobe Flash 0-day exploit?
If I were to not update Adobe Flash and instead used the old version (from before the Hacking Team 0-day exploit was published in the internet), in that case, would Microsoft EMET protect me from the ...