New answers tagged

2

It is not possible to encode the exploit as you would encode a payload. The reason is that the data that is part of an exploit is directly processed by the vulnerable application (in this case Flash). The function inside the Flash binary which process the exploit data won't decode it first. In case of payloads we can encode it because when the payload gets ...


0

A properly locked down policy would look like this in your situation: <cross-domain-policy> <allow-access-from domain="sub.example.com" secure="true"/> <site-control permitted-cross-domain-policies="all"/> </cross-domain-policy> Allowing * wildcard for all domains means that user sessions on sub2.example.com could be ...



Top 50 recent answers are included