I read about cross site flashing in the OWASP testing guide. I know the difference between XSS and XSF. But what I am looking for is how attackers perform a XSF attack. How is it possible since there are no entry points for a flash file?
Cross-Site Flashing occurs when user controlled data is not validated and used in one of the following functions or variables:
loadVariables loadMovie getURL loadMovie loadMovieNum FScrollPane.loadScrollContent Sound.loadSound NetStream.play flash.external.ExternalInterface.call htmlText
In other words, this means that the Flash application must reference external URLs, and the locations of those URLs are set through user defined parameters (usually Flash Vars).
In order for this vulnerability to be successfully exploited the victim needs to click on a specially crafted link created by the attacker that will use the vulnerable Flash application in order to, for example, steal users' credentials.
Even if Flash scripts have restrictions due to the same-origin policy (for Flash you can read its details on here) Flash is a vector for XSS attacks.
For such vulnerabilities, you do not need necessarily entries for users as on this demo or as on this website that manages a huge database and entirely built in Flash Player.
You can find several real world examples of such XSF attacks on here.
I think the simplest and best tutorial about XSF attacks is this one.