SWFIntruder Help

Description

SWFIntruder is a runtime analyser for SWF external movies. It helps to find flaws in Flash using the methodology described in Testing Flash Applications[1] and in Finding Vulnerabilities in Flash Applications[2].

Quick and Dirty:

  1. Download the SWF File you want to test to a subdirectory of SWFIntruder.
  2. Set the (Full) path to the SWF.
  3. Click Load.
  4. Select some of the undefined variables (Multiple select are allowed).
  5. Go to Menu -> View -> Show Xss Tool.
  6. Click play.

Recommended Configuration

  1. Firefox 2.x [Needed]
  2. FireBug Addon
  3. Flash Player Plugin Ver >= 9 [Needed]
  4. Any Web Server [Needed]

Persistent Configuration and Layout

By using Firefox globalStorage, SWF Intruder saves user's main configuration and layout in order to be retrived everytime the browser is launched. Specifically, users will have persistance on:
  1. User defined attack patterns
  2. Selection of attack patterns
  3. User added undefined parameters
  4. Custom parameters appended to request
  5. Address value of site hosting evil.swf
  6. Some other configuration amenities
  7. Latest 4 urls tested (History helper)
  8. Xss box and Debug box show/hide layout

Known Issues/Bugs

1. Sometime Firefox crashes. This is due to some problem in Firefox and not in SWF Intruder itself.

2. If you use SWF Intruder under linux, the flash plugin eats a lot of memory.

3.There's a pattern for which __resolve does not work:

frame 1 {
  static.main(this)
}
where 'this' is _root but not explicitly set.

Warning

Letting browser run untrusted Flash movies, could result in an attack to internal network and other malicious activities against the tester.
Set the test environment as strict as possible.

References

[1] Testing Flash Applications, Stefano Di Paola, Owasp Appsec 2007, 17th May 2007, Milan (Italy)
[2] Finding Vulnerabilities in Flash Applications, Stefano Di Paola, Owasp Appsec 2007, 15th November 2007, San Jose CA (USA)

Close