Home page logo
/

pen-test logo Penetration Testing mailing list archives

Re: pen testing flash games.
From: Sir Mordred <sir.mordred.lists () gmail com>
Date: Mon, 25 Jun 2007 15:57:57 +0300

Dear all

I am doing a pentest on a gaming website which has mostly online
flash games. There are known vulnerabilities in flash but i dont
know how to execute them. In the website, there are also some
downloadable games which have to be purchased after downloading.
Theese games also send info such as high scores to the server. Can
somebody tell me how to exploit the vulnerabilities of flash? and is
there any intercepting proxy which can trap requests and responses
of applications such as games, media players, gtalk etc.

KineticFusion is a very good free de/re/compiler (swf->xml->swf).
You'll need to find it copied on the web though, as the official
vendor is currently not offering it for download (afaik).

Flash makes ordinary HTTP requests to backend scripts on the server,
try to find the usual webapp vulnerabilities on those. The flash HTTP
traffic goes through the proxy specified in your browser settings, so
using a local HTTP proxy is possible.

Mordred


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault