I’ve known about this technique for years but everyone might not be aware that Flash can be used for XSS, so I’ve decide to do a quick post to explain. Using getURL in Flash allows you to call javascript using the javascript protocol and using the parameter allowScriptAccess enables you to perform cross domain execution. [...]
Inspiration
- Arshan
- Ascetik
- beford
- Billy Rios
- Chris Weber
- David Ross
- Eric Lawrence
- hackademix
- Hackvertor
- Halvar Flake
- Jesse Ruderman
- Joe Walker
- John Resig
- Kuza55
- maliciousmarkup
- Manuel Caballero
- Matt Presson
- Miscoded
- nihilogic
- PHPIDS
- pro.grammatic
- Reiners
- rgaucher
- rvdh
- Sirdarckcat
- sla.ckers
- Stefan Esser
- Stefano Di Paola
- Thornmaker
- tssci-security
- ush.it
- Web Reflection
- xorl
- Yosuke HASEGAWA