I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?

From the Area51 proposal.

4 Answers 4


From what I have been using: here http://www.swftools.org/ is a set of tools for work with SWF files, can be used for data structure analysis. Another one is a tool from HP specifically for scanning vulnerabilities in Flash: http://www.hp.com/go/swfscan (requires registration).

Tools that I have not used: Flare: http://www.nowrap.de/flare.html - there are also links to other tools, and Swfmill http://swfmill.org/ - tool to convert SWF to XML.

  • SWFScan for any
  • Nemo 440 for AS3, Flex, AIR
  • Flare for AS2 (Flasm for disassmebly). These aren't as useful anymore
  • There is an IDA Pro plugin for Flash disassembly written by some guy from Microsoft

Also see osflash.org and flashsec.org


Another good tool that I have used successfully in the past is OWASP's SWF Intruder.


You can try SWF Decompiler to convert SWF to FLA for getting any information that might you wouldn't get from FLA Movies for penetration testing


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .