RIA Cross Domain Policy

Check List

Methodology

Overly Permissive Flash Cross-Domain Policy (crossdomain.xml / clientaccesspolicy.xml)

1

CrossDomain.xml & clientaccesspolicy.xml file

2

Check and identify the presence of crossdomain.xml & clientaccesspolicy.xml files on the target using Nmap command

3

If the files exist, we run them using the next command, which is a script related to BeEF

4

Vulnerability Conditions The crossdomain.xml file is overly permissive (<allow-access-from domain="*">) Sensitive data or actions are accessible on the target domain

5

Exploit Modify the ActionScript to fetch sensitive data from the target domain and send it to a malicious server Compile the ActionScript into an SWF file

6

Capture Data Use a script to capture stolen data from the victim when they load the malicious SWF Direct the victim to a page with the malicious SWF, ensuring they are logged into the target site Review the data captured on the malicious server for sensitive information

Cheat Sheet

Check Policy Files Weakness

Nmap

Check crossdomain.xml & clientaccesspolicy.xml

nmap -p 80,443 \
     -sS -sV --mtu 5000 \
     --script http-cross-domain-policy \
     --script-args http-cross-domain-policy.domain-lookup=true $WEBSITE

BeEF (SWF)

Create Script

Run Script

PreviousHTTP Strict Transport SecurityNextFile Permission

Last updated