All Questions
Tagged with flash web-application
13 questions
13
votes
4
answers
4k
views
Preventing reverse-engineering of client application
I have a web service which is used by a Flash client. Both the service and the Flash client is produced by me (read: my company). The Flash client communicates with the server over HTTPS.
One of the ...
10
votes
3
answers
3k
views
How to perform penetration testing on a Flex application?
Possible Duplicate:
What tools are there to inspect Flash SWF files?
I have decompiled it, verified the source. All seems fine. Appscan also is not able to find anything in this case. But I just ...
- 1,141
9
votes
2
answers
16k
views
Is the service join.me actually a huge security risk?
In case you don't know, there is a website called join.me which lets you do screen sharing from a browser, using a flash program that is on the web page.
Until I encountered this service, I had no ...
- 101
8
votes
2
answers
4k
views
How to pentest Flash file on webapp with alowscriptaccess=samedomain?
In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through loadMovie. The HTML is this:
<embed width="388" height="350" src="http://www.domain.com/...
- 181
4
votes
5
answers
4k
views
Is it dangerous to serve user-uploaded Flash (SWF) files?
I'm working on a site that has CMS functionality. I'm considering allowing users to upload Flash (.swf) files and then displaying them on my site.
Is this a bad idea?
Is there a way to do this ...
- 141
4
votes
2
answers
9k
views
Can a website know whether I'm streaming or downloading content?
I'm taking a paid online course in which the videos are streamed through Flash. After much trouble such as quality fluctuations, unexpected changes in playback speed and frozen screens (also ...
- 43
4
votes
3
answers
2k
views
Flash ignores Content-Type header, allowing XSS?
I recently read that the Flash plugin ignores the Content-Type header in certain circumstances. In particular, you can give Flash a URL, and the Flash plugin will happily fetch the content at that ...
- 100k
4
votes
1
answer
1k
views
CSRF and Flash/Flex
Flash and Flex clients can make RPC calls to a server using the NetConnection and AMF protocols. It's not uncommon to have these RPC calls setup to authenticate based on a cookie.
I've heard ...
- 185
3
votes
4
answers
2k
views
Is it safer to design websites and servers with HTML5 rather than flash?
I run a small business, designing and building websites. Currently our websites we build use Adobe Flash.
We are thinking about migrating to HTML 5, are there any security advantages in doing such a ...
- 139
3
votes
2
answers
1k
views
Is crossdomain policy file required by EVERY web application?
1) If a web application does NOT use any Flash content, does it require crossdomain / clientacess policy file ?
2) If a web application does not host crossdomain / clientaccess policy file, is it ...
3
votes
1
answer
2k
views
How is Cross Site Flashing performed?
I read about cross site flashing in the OWASP testing guide. I know the difference between XSS and XSF. But what I am looking for is how attackers perform a XSF attack. How is it possible since there ...
- 2,097
2
votes
2
answers
1k
views
Why should crossdomain.xml be present if user-uploaded files exist?
In his book Michal Zalewski says:
To protect your users, include a top-level crossdomain.xml file with the permitted-cross-domain-policies parameter set to master-only or by-content-type, even if ...
- 5,467
2
votes
2
answers
327
views
For untrusted user upload sites: what should the contents of crossdomain.xml and clientaccesspolicy.xml be?
Flash has a long history of ignoring MIME types of files and reading the file directly for executable content or for cross domain execution permissions. That means a malicious user can take advantage ...
- 51.1k