« Why crawling doesn't matter | Main | Cross-build injection attacks »

Tools: SWFIntruder released

Stefano writes

"The first release of SWFIntruder has been released today by Stefano Di Paola, CTO of Minded Security. SWFIntruder (pronounced Swiff Intruder) is the first tool specifically developed for analyzing and testing security of Flash applications at runtime. It helps to find flaws in Flash applications using the methodology originally described in Testing Flash Applications [1] and in Finding Vulnerabilities in Flash Applications [2]. SWFIntruder uses a combination of Flash, Html and JavaScript technologies in order to get runtime information about the SWF and test it in a semi-automated fashion.

Some neat feature:
* Basic predefined attack patterns.
* Highly customizable attacks.
* Highly customizable undefined variables.
* Semi automated Xss check.
* User configurable internal parameters.
* Log Window for debugging and tracking.
* History of latest 5 tested SWF files.
* ActionScript Objects runtime explorer in tree view.
* Persistent Configuration and Layout.
SWFIntruder is hosted @ OWASP:
and is sponsored by Minded Security (http://www.mindedsecurity.com)

[1] http://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt
[2] http://www.owasp.org/images/d/d8/OWASP-WASCAppSec2007SanJose_FindingVulnsinFlashApps.ppt"

Tool Link: https://www.owasp.org/index.php/Category:SWFIntruder


Feed You can follow this conversation by subscribing to the comment feed for this post.

All Comments are Moderated and will be delayed!

Post a comment

Remember personal info?