the-web-application-hackers-handbook

Chapter 13 n Attacking Users: Other Techniques 553
Flash Local Shared Objects
The Flash browser extension implements its own local storage mechanism called
Local Shared Objects (LSOs), also called Flash cookies. In contrast to most other
mechanisms, data persisted in LSOs is shared between different browser types,
provided that they have the Flash extension installed.
HACK STEPS
1. Several plug-ins are available for Firefox, such as BetterPrivacy, which can
be used to browse the LSO data created by individual applications.
2. You can review the contents of the raw LSO data directly on disk. The
location of this data depends on the browser and operating system. For
example, on recent versions of Internet Explorer, the LSO data resides
within the following folder structure:
C:\Users\{username}\AppData\Roaming\Macromedia\Flash Player\
#SharedObjects\{random}\{domain name}\{store name}\{name of
SWF file}
TRY IT!
http://mdsec.net/auth/245/
Silverlight Isolated Storage
The Silverlight browser extension implements its own local storage mechanism
called Silverlight Isolated Storage.
HACK STEPS
You can review the contents of the raw Silverlight Isolated Storage data
directly on disk. For recent versions of Internet Explorer, this data resides
within a series of deeply nested, randomly named folders at the following
location:
C:\Users\{username}\AppData\LocalLow\Microsoft\Silverlight\
TRY IT!
http://mdsec.net/auth/239/