Automated Crawling & Security Testing of Flash/Flex Web Applications

Ronen Bachar, from our own IBM Rational AppScan team, gave a presentation on the (*hot*) subject of automated Flash/Flex application security testing, at the recent OWASP IL conference that was held last week (I have a strange feeling of a Deja-Vu).

The presentation gives a high level overview of Flash, Flex and the AMF protocol, and dives into some gory details (although some gore is missing from the online presentation) regarding the challenges and possible approaches for performing automated crawling and security testing of web applications that were built using these technologies.

 

And while we're on the subject of Adobe Flash & Flex web applications - if you happen to be in New York next week for the OWASP AppSec conference, be sure to attend another presentation by our team (Adi Sharabani & Ayal Yogev), on the subject of Flash Parameter Injection.

Comments

[guya]

HI, I've enjoyed your presentation at the OWASP IL.

Just wanted to mention that setting allowScriptAccess to sameDomain (slide 19) is the default and wouldn't be enough to prevent many of the attacks.
http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/

Indeed setting also allowNetworking="internal" will prevent most of the flaws opened by the aforementioned.

[fukami]

Err, the default of allowScriptAccess is "" (empty) as of player version 9,0,124,0, which has basically the same impact as "none" when directly calling SWFs.

With allowNetworking set to "internal" the Flash internal functions still work (Loader, Sockets etc.)

[guya]

fukami, I'm afraid you are wrong, the default is "sameDomain".

Look for yourself, make sure you have 9,0,124,0 or above and go here:
http://blog.guya.net/wp-content/uploads/2008/09/screenclean_demo.swf

The swf will be scripting you.

[fukami]

Gotcha! Especially ExternalInterface functions shouldn't work in the first place without embedding

Thanks for the example :)