Re: [WEB SECURITY] Query:Vulnerability assessment of Flash web application

[fukami <fukami@xxxxxxxxxxxxxx>]

Hi!

On 25.03.2008, at 01:05, Surendra Upadhyay wrote:
> Anybody guide me, How to do vulnerability assessment of  Flash web
> application manually and suggest free tools to do VAPT.

Depends on several things, for example of the ActionScript version used
or if the Flash files are obfuscated/scrambled.

In general you should access the Flash files using a HTTP proxy and
look how the communication looks like. Look how the files are embedded
into HTML and search for the variables used to call the SWF (called
FlashVars most of the time).

As already mentioned, for ActionScript 2 based Flash there are a lot
of free and open tools available, such as SWFIntruder for runtime
analysis or flare/flasm for disassembly/decompiling. There is also
a nifty tool called erlswf which can be used for decompiling and
static analysis, but most people find it a bit to difficult to use :)

For ActionScript 3 based Flash you should build your own decompiler
using Tamarin. erlswf can also handle AS3 based stuff, but it uses
Tamarin for decompiling as well.

For starters I recommend the slides from Stefanos OWASP talks:
http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt
http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt

There are 2 projects dedicated to Adobe Flash security:
# The OWASP Flash Security Project
  http://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project
# FlashSec
  https://www.flashsec.org/wiki/Main_Page

The second one contains a lot of links to software, articles, specs,
docs and advisories which may be useful to you.


Cheers,
  fukami




----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]