From: Noah (focushacks@gmail.com)
Date: Mon Jun 25 2007 - 16:18:29 EDT
I've found http sniffing to be the most beneficial for flash app
pen-testing, especially for games. I was able to successfully replay
the final scoring of "matches" against the computer on some games to
rack up a very high rating, or adjust values that get posted back to
the server to gain points, money, lives, weapons, or rank.
Fuzzing, trying to post data to an unauthenticated account, trying to
alter data in transit, etc are all easily tested exploit vectors.
I've found that decompiling the flash code isn't usually as useful as
it sounds. Check for proper server-side verification of the data
being recieved. You may also see if the server-side scripts accept
GET requests in lieu of POST. If that's the case, exploitation from
the location bar (or wget) is trivial.
For "intercepting" I usually just use a sniffer such as Wireshark,
then a TCP replayer package. wget can also do form posts but you have
to play with it to get it right.
On 6/23/07, Jerome Athias <jerome.athias@free.fr> wrote:
> Hi,
>
> you can easily download the binaries (.swf) and decompile them (.fla)
> it would give a nice overview of our they work ;-)
>
> if you sniff HTTP traffic you should be also easily able to see what
> data they exchange with the server and then for example be able to use a
> fuzzer to send malformed, overly long requests
>
> Good luck
> /JA
> https://www.securinfos.info
>
> zimblyzuper@gmail.com a écrit :
> > Dear all
> >
> > I am doing a pentest on a gaming website which has mostly online flash games. There are known vulnerabilities in flash but i dont know how to execute them. In the website, there are also some downloadable games which have to be purchased after downloading. Theese games also send info such as high scores to the server. Can somebody tell me how to exploit the vulnerabilities of flash? and is there any intercepting proxy which can trap requests and responses of applications such as games, media players, gtalk etc.
> >
> >
> > Please advice.
>
>
-- http://www.focushacks.com/focushacks-gpg.txt - My GPG encryption key ------------------------------------------------------------------------ This List Sponsored by: Cenzic Are you using SPI, Watchfire or WhiteHat? Consider getting clear vision with Cenzic See HOW Now with our 20/20 program! http://www.cenzic.com/c/2020 ------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:54 EDT