3

I read about cross site flashing in the OWASP testing guide. I know the difference between XSS and XSF. But what I am looking for is how attackers perform a XSF attack. How is it possible since there are no entry points for a flash file?

2

EDIT:

Cross-Site Flashing occurs when user controlled data is not validated and used in one of the following functions or variables:

loadVariables
loadMovie
getURL
loadMovie
loadMovieNum
FScrollPane.loadScrollContent
Sound.loadSound
NetStream.play
flash.external.ExternalInterface.call
htmlText

In other words, this means that the Flash application must reference external URLs, and the locations of those URLs are set through user defined parameters (usually Flash Vars).

In order for this vulnerability to be successfully exploited the victim needs to click on a specially crafted link created by the attacker that will use the vulnerable Flash application in order to, for example, steal users' credentials.

Even if Flash scripts have restrictions due to the same-origin policy (for Flash you can read its details on here) Flash is a vector for XSS attacks.

For such vulnerabilities, you do not need necessarily entries for users as on this demo or as on this website that manages a huge database and entirely built in Flash Player.

You can find several real world examples of such XSF attacks on here.

I think the simplest and best tutorial about XSF attacks is this one.

  • Thanks for the reply.I understand such things can be done with flash. But if a web application is using flash how can an attacker exploit it? That's what I am specifically searching for. – Anandu M Das Oct 7 '14 at 11:55
  • @AnanduMDas Do you mean classic attacks on Flash Player applications or just XSF ones ? – user45139 Oct 7 '14 at 12:00
  • I know about the classical XSS attacks. I want to know about the flashing attacks only. – Anandu M Das Oct 8 '14 at 7:35
  • @AnanduMDas I reedited my answer. If you need something more just be precise :) Thanks – user45139 Oct 8 '14 at 7:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.