Questions tagged [flash]
Risks associated with the Adobe Flash animation file format and its use on the web, as well as Flash player applications. For flash drives, use the tag flash-memory.
103 questions
3
votes
2
answers
355
views
When receiving PDFs from unknown sources, is it sufficient to remove dynamic content to minimise attack surface?
My company allows customers to upload PDFs, JPEGs and PNGs to our servers, which are then viewed by clients. We want to minimise the potential for attack on the clients. While the image formats are ...
CommunityBot
- 1
3
votes
1
answer
393
views
Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?
The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE.
Is it possible for an attacker to steal the token, using javascript or flash, in ...
CommunityBot
- 1
0
votes
1
answer
523
views
Opening a SWF file in VLC Player?
I was browsing a really old site that had tutorial videos using Adobe Flash Player. I tried opening the site in way back machine, which runs Ruffle. That didn't seem to work.
So, I downloaded the swf ...
- 208k
0
votes
1
answer
168
views
USB flash drive password
Is it possible to add a password in a USB Flash drive as a security measure by end user so that the data is not visible or tampered by somebody else?
As soon as the USB flash drive is connected to the ...
0
votes
0
answers
356
views
Why is Secure Boot in an ECU required when there is Secure Flashing capabilities?
it seems state of the art that the autmotive electronical Control units (ECUs) contain security features as Secure Flashing and Secure Boot. For secure flashing, each new software to be programmed is ...
- 1
4
votes
2
answers
9k
views
Can a website know whether I'm streaming or downloading content?
I'm taking a paid online course in which the videos are streamed through Flash. After much trouble such as quality fluctuations, unexpected changes in playback speed and frozen screens (also ...
- 1
5
votes
1
answer
10k
views
Why is Google Chrome blocking raw SWF playback?
If you attempt to visit the URL of a raw SWF file, Chrome 57 refuses to display and instead asks if you want to download, with the warning "This type of file can harm your computer". However, if you ...
1
vote
2
answers
517
views
Are Internet speed tests an attack vector?
I've been performing lots of speed tests lately due to, among some other random things, an Internet programming class and getting Google Fiber hooked up.
Then I realized that SpeedTest.net uses a ...
- 132k
1
vote
2
answers
1k
views
Does the WP(Write Protect) pin of a USB flash memory controller prevent tampering with its firmware?
Does WP(Write Protect) pin of a USB flash memory controller prevent tampering with its firmware?
I want to have an USB stick that I can make it read-only and insert it in any untrusted PC without ...
- 21
0
votes
2
answers
1k
views
Is there any way to validate the firmware in a USB flash drive?
I bought a pair of USB flash drives made by Huawei and I want to know if there are any tools in existence for verifying that the firmware on these drives is secure. I bought them for researching this ...
- 21
0
votes
1
answer
460
views
Is flash less secure now that it is End of Life? [closed]
As of this month, the Flash player has been disabled from all mainstream browsers. However, several platforms are still offering ways to use Flash content, most notably the games hosted on said ...
CommunityBot
- 1
-4
votes
2
answers
457
views
Are there any ways to safely use Adobe Flash?
In this hot question on Gaming, the asker wants to know how to continue playing FarmVille. Answers and comments exlpain ways to do so, but no one currently has a solution that seems safe to me.
...
- 208k
1
vote
1
answer
215
views
Flash Vulnerabilities
What type of risks do I expose myself to by enabling flash in the browser?
Web developers or online game developers who can use those vulnerabilities to crash my computer or exploit it by downloading ...
- 31.7k
2
votes
0
answers
673
views
Flash Cross-Domain Proof of Concept
In the past, I have been able to successfully test insecure Flash cross-domain policies by using tools such as the followings:
https://thehackerblog.com/crossdomain/
https://github.com/nccgroup/...
CommunityBot
- 1
3
votes
1
answer
546
views
Deliberately vulnerable Flash applications?
I'm trying to find some deliberately vulnerable Flash applications that I can practice security testing on (in the same vein as applications like the Damn Vulnerable applications).
Ive noticed there ...
CommunityBot
- 1
0
votes
1
answer
255
views
Inconsistent behavior while attempting to exploit a misconfigured flash crossdomain.xml
victim.com - URL of the misconfigured application.
https://victim.com has an overly permissive crossdomain.xml at https://victim.com/crossdomain.xml.
<?xml version="1.0"?>
<!DOCTYPE cross-...
- 3,951
0
votes
0
answers
552
views
On The Use Of Unsanboxed Plugins In The Chrome Browser
The following questions relate to unsandboxed plugins under Settings > Advanced > Content settings > Unsandboxed plugins.
The first thing I'd like to know is whether this setting is basically for ...
0
votes
1
answer
179
views
Will browser isolation solution protect our enterprise from Flash and JavaScript exploits and fileless malware?
Since we didn't see any pentest done to bypass on such solution, we don't really know if it worth purchasing such type of solution. Will this really protect us from Flash and JavaScript exploits, ...
- 208k
0
votes
0
answers
683
views
JSON-CSRF using Flash SWF Doesn't make POST request
I was trying to recreate a POC where an endpoint didn't have CSRF protection and was exposing a form submission.
So, I have read these ( before asking here ):
Vimeo hackerone Report by avlidienbrunn
...
- 121
4
votes
1
answer
821
views
CSRF Bypass using ActionScript via weak CrossDomain.xml
I have a target which has weak CrossDomain.xml but it prevents CSRF attack looking at one of the custom HTTP headers. I found following actionscript on a couple of websites, which works perfectly ...
CommunityBot
- 1
0
votes
1
answer
386
views
Secure way to run Flash on Chrome?
I kinda addicted to Little Big Snake, an online game that requires Flash. I'm trying to find a secure way to play this game on Ubuntu using Chrome.
I tried Firejail but the game is very laggy with it....
CommunityBot
- 1
3
votes
2
answers
649
views
Is it possible to feed Firefox Flash plugin with controlled data for privacy reasons?
For privacy and security reasons, it would be strongly recommended to deactivate the Flash plugin in the browser. But I don't want to deactivate it, I want to fake privacy relevant information. ...
CommunityBot
- 1
4
votes
1
answer
183
views
Is filtering flash based on the mimetype enough to keep it out?
As flash is a real security mess I started blacklisting flash at our proxy by blocking any content with the mime type application/x-shockwave-flash which works pretty well as far as I can tell. The ...
- 14.7k
65
votes
6
answers
15k
views
Why should we care about Adobe Flash?
I was under the impression that Adobe Flash was dead, and that browsers were no longer natively supporting Flash? Why therefore, is there a large amount of hype online about a new remote code ...
- 897
1
vote
1
answer
1k
views
Crossdomain.xml - write access to domain
Is a permissive crossdomain.xml Flash policy analogous to a permissive CORS policy?
i.e. Is
<cross-domain-policy> <allow-access-from domain="*" /> </cross-domain-policy>
the ...
- 34.4k
2
votes
1
answer
615
views
How can javascript files represent a flash-based XSS vulnerability?
I am hosting a static website (no PHP etc., just HTML/JavaScript/CSS) with a security-conscious hoster that proactively removes vulnerable files. This is fine with me.
However, their last report ...
- 2,143
3
votes
1
answer
161
views
How to know 3rd party ads are safe?
It seems many sites use 3rd party flash ads, those ads could be design to attack user.
Do those site know which ads are safe or not? Or they just transfer any ads to user browser?
In general, how to ...
- 14.7k
3
votes
1
answer
513
views
Adobe Flash and Meltdown / Spectre
Many browsers have received updates to protect against the Meltdown and Spectre attacks. I presume these patches relate (solely) to JavaScript execution within the browser. Java in the browser is as ...
- 208k
2
votes
0
answers
663
views
How can I decrypt my iphones nand flash memory if I have the pin but phone won't turn on? [closed]
Is there some sort of device I can plug my nand flash chip into and then input my pin and get my old notes and things back?
6
votes
1
answer
2k
views
Detecting disabled Chrome plugins using JavaScript
My cable was on the fritz this weekend and I had to visit a friend to watch HBO online. Something weird happened that has been bothering me.
I have disabled the Flash plugin on Chrome, since all ...
- 65.8k
1
vote
3
answers
416
views
Are Flash .SWF apps (browser) a security threat? [closed]
Are Flash (.swf components on webpages) a security threat?
Flash banners (without any user interaction, not asking for any permission... just like static .swf add-slideshow)?
Flash apps, that require ...
- 2,737
0
votes
1
answer
532
views
Flash drive returning odd files, and self creating others, any ideas?
I was sanitising a USB drive and after wiping it I ran Recuva to check the results.
It finds a file called [000001].flv which is 113MB. The file starts with FLV and then the data looks random, ...
- 36
1
vote
0
answers
222
views
Testing Adobe Flash - SWF Stack Corruption
For didactic purposes I have a windows 7 VM with IE11 and Adobe Flash 18.0.0.203.
Also, I must test if CVE-2017-2988 can be executed on it.
I have downloaded the stackbad.swf, inserted it in an index....
- 113
0
votes
0
answers
125
views
Recent persistent popups on Chrome trying to get me to download "Flash" [duplicate]
EDIT: I don't think this is 100% a duplicate, so if you've recently (around May 9th 2017) been seeing popups telling you to download Flash, I'd read on before following the link.
It appears my Mac ...
- 109
8
votes
2
answers
4k
views
How to pentest Flash file on webapp with alowscriptaccess=samedomain?
In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through loadMovie. The HTML is this:
<embed width="388" height="350" src="http://www.domain.com/...
- 27.4k
1
vote
1
answer
1k
views
Secure crossdomain for rtmp/flash streaming/wowza
I've been a bit lost. I have the following situation:
Flash Player file is on https://sub.example.com/player.swf
crossdomain.xml is on https://sub2.example.com/crossdomain.xml
Streaming is done ...
CommunityBot
- 1
0
votes
2
answers
185
views
Are interactive Flash (SWF) ad banners a security threat?
Many times you have seen banners (Flash ads) on websites, where, when you move your mouse over the banner (without clicking it), you see how an animation in the banner starts moving toward your mouse ...
- 65.8k
3
votes
3
answers
1k
views
Are flash cookies still a threat and that persistent?
One year (or more) ago flash cookies were really a problem, because they could not be deleted from within a browser. They were not managed by the browser but by the flash player. Flash cookies were ...
- 977
1
vote
1
answer
133
views
Does the Flash installer use an encrypted download?
A lot of popular applications use customer downloaders rather than allow the user to download the installation binary directly from Adobe, or whoever the OEM might be. For example, here is the Flash ...
- 6,284
4
votes
3
answers
7k
views
How is it possible that a virus can infect the system if the browser is started with non-admin rights
If I open my web browser (for example firefox) in Windows 7 with activated UAC as normal user (non admin) a virus - which uses a security leak in my browser - will only gets privileges of the normal ...
CommunityBot
- 1
0
votes
1
answer
156
views
Repercussions of disabling sockets in Adobe Flash player? [closed]
I am bit of a newbie to Flash exploits but I have heard that they use sockets to connect to a C&C server. According to the administration guide, I can disable sockets like this:
DisableSockets = ...
- 132k
1
vote
0
answers
178
views
Load non-existent flash file through service worker
Using Service Workers it is possible to load non-existent files with the fetch event handler, however this does not seem to work when loading flash files.
Is there any way in any browser to do this ...
- 446
0
votes
1
answer
166
views
Repercussions of disabling file read and write in Adobe Flash player?
There are three settings in mms.cfg that I want to disable. It will disable file download and upload for Adobe Flash, but does it have any deeper issues?
LocalFileReadDisable = 1
FileDownloadDisable =...
- 65.8k
2
votes
1
answer
1k
views
How can Flash detect my IP address even when I am behind a proxy?
I'm new to cybersecurity, but I always knew some basic things, or at least I thought so, until I found out that the Flash app may actually get my real IP address even if I'm behind elite proxy. How ...
- 132k
19
votes
4
answers
10k
views
What tools are there to inspect Flash SWF files?
I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?
From the Area51 proposal.
CommunityBot
- 1
1
vote
1
answer
176
views
Can streaming services, movies, series, be used to infect my computer?
I have been thinking about starting to Watch Movies and series online using streaming (legal). I was wondering if there are any vulnerabilitys in these services which can affect me as a user. I have ...
- 1,629
0
votes
3
answers
1k
views
How exactly does this Flash malware function on Ubuntu?
In this video, an experienced Ubuntu user manages to infect his system with some sort of malware.
This is the first example I've ever seen of truly successful malware in the wild aside from privilege ...
- 2,417
1
vote
1
answer
3k
views
How to deal with possibility of viruses on Dropbox, Google Drive, external hard drive, etc?
For home use, what is the best way to deal with viruses that could be on external storage, which seems like a great way for hackers to persist on your system even after a reformat. Maybe the best ...
CommunityBot
- 1
1
vote
1
answer
289
views
Is it possible to encode a Flash exploit with msfencode?
I am using a Flash exploit from metasploit, exploit/multi/browser/adobe_flash_hacking_team_uaf.
The Cisco FirePOWER services notice these signatures and drop the packets.
I was wondering about the ...
- 21
2
votes
1
answer
708
views
What to do with an APK file containing Swf.Exploit.CVE_2015_0323-1 and ELF File?
I received an APK file from a source. Prior to installation, I ran a virus scan on it. The result had following main features:
The file contained Swf.Exploit.CVE_2015_0323-1
It required android....
CommunityBot
- 1