19

I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?


From the Area51 proposal.

9

From what I have been using: here http://www.swftools.org/ is a set of tools for work with SWF files, can be used for data structure analysis. Another one is a tool from HP specifically for scanning vulnerabilities in Flash: http://www.hp.com/go/swfscan (requires registration).

Tools that I have not used: Flare: http://www.nowrap.de/flare.html - there are also links to other tools, and Swfmill http://swfmill.org/ - tool to convert SWF to XML.

1
8
  • SWFScan for any
  • Nemo 440 for AS3, Flex, AIR
  • Flare for AS2 (Flasm for disassmebly). These aren't as useful anymore
  • There is an IDA Pro plugin for Flash disassembly written by some guy from Microsoft

Also see osflash.org and flashsec.org

5

Another good tool that I have used successfully in the past is OWASP's SWF Intruder.

4

You can try SWF Decompiler to convert SWF to FLA for getting any information that might you wouldn't get from FLA Movies for penetration testing

http://www.sothink.com/product/flashdecompiler/

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .