I am performing a penetration test against a website that uses Flash.
I found this piece of code:
url = ExternalInterface.call("window.document.location.href.toString") as String;
How it can be exploited?
I tried to exploit it as XSS via submitting a payload after the #:
but nothing. Since I am not really good with Actionscript can anybody help?