19

I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?

From the Area51 proposal.

Scott Pack
  • 15,167
  • 5
  • 61
  • 91
AviD
  • 72,138
  • 22
  • 136
  • 218

4 Answers4

9

From what I have been using: here http://www.swftools.org/ is a set of tools for work with SWF files, can be used for data structure analysis. Another one is a tool from HP specifically for scanning vulnerabilities in Flash: http://www.hp.com/go/swfscan (requires registration).

Tools that I have not used: Flare: http://www.nowrap.de/flare.html - there are also links to other tools, and Swfmill http://swfmill.org/ - tool to convert SWF to XML.

  • Neighbor has topic about Flash/SWF decompilers: http://questions.securitytube.net/questions/1687/best-flash-swf-decompiler –  Nov 16 '10 at 16:05
8
  • SWFScan for any
  • Nemo 440 for AS3, Flex, AIR
  • Flare for AS2 (Flasm for disassmebly). These aren't as useful anymore
  • There is an IDA Pro plugin for Flash disassembly written by some guy from Microsoft

Also see osflash.org and flashsec.org

atdre
  • 18,885
  • 6
  • 58
  • 107
5

Another good tool that I have used successfully in the past is OWASP's SWF Intruder.

AviD
  • 72,138
  • 22
  • 136
  • 218
4

You can try SWF Decompiler to convert SWF to FLA for getting any information that might you wouldn't get from FLA Movies for penetration testing

http://www.sothink.com/product/flashdecompiler/

Vishwanath Dalvi
  • 618
  • 3
  • 9