This question already has an answer here:

I want to know the basic differences between XSS and XSF

marked as duplicate by TildalWave, Mark, Xander, Adi, Gilles Sep 23 '14 at 12:27

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


XSF is, essentially, XSS in a Flash applet. Where in XSS you find vectors (e.g. URL parameters or form fields) for injecting content into the DOM that is parsed as script, in XSF you look for cases where you can get untrusted data to be placed into Flash variables, which may then be used in an unescaped context inside the Flash applet, resulting in script execution, open redirect, or other impacts.

Not the answer you're looking for? Browse other questions tagged or ask your own question.