Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Pen-Test
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: pen testing flash games.

from [Sir Mordred] Network Security [Permanent Link]
Subject: Re: pen testing flash games.
Date: Mon, 25 Jun 2007 15:57:57 +0300 
Dear all



I am doing a pentest on a gaming website which has mostly online
flash games. There are known vulnerabilities in flash but i dont
know how to execute them. In the website, there are also some
downloadable games which have to be purchased after downloading.
Theese games also send info such as high scores to the server. Can
somebody tell me how to exploit the vulnerabilities of flash? and is
there any intercepting proxy which can trap requests and responses
of applications such as games, media players, gtalk etc.


KineticFusion is a very good free de/re/compiler (swf->xml->swf).
You'll need to find it copied on the web though, as the official
vendor is currently not offering it for download (afaik).

Flash makes ordinary HTTP requests to backend scripts on the server,
try to find the usual webapp vulnerabilities on those. The flash HTTP
traffic goes through the proxy specified in your browser settings, so
using a local HTTP proxy is possible.

Mordred


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: listening to people/offices when on-hold on the phone, David Gutierrez
Next by Date:  Port Scanning Issues, crumdub12
Previous by Thread:  Re: pen testing flash games., Gasior
Next by Thread:  Re: pen testing flash games., Jay
Indexes:  [Date] [Thread] [Top] [All Lists]