القائمة
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-conf-08يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | wstg-conf-08 |
| description | Test RIA Cross Domain Policy |
| category | configuration |
| owasp_id | WSTG-CONF-08 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["misconfiguration","hardening","server","wstg","conf"] |
| tech_stack | [] |
| cwe_ids | ["CWE-16"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-CONF-08
Test RIA Cross Domain Policy
Note: This test case has been deprecated by OWASP as Flash and Silverlight technologies are no longer widely used. However, legacy applications may still use these technologies.
Rich Internet Application (RIA) cross-domain policy files control how Flash and Silverlight applications can access resources across different domains. Misconfigured policy files can allow unauthorized cross-domain access, leading to data theft and other security issues. While these technologies are largely obsolete, legacy applications may still require this testing.
/crossdomain.xml (Adobe Flash)/clientaccesspolicy.xml (Microsoft Silverlight)*)# Check for Flash crossdomain.xml
curl -s https://target.com/crossdomain.xml
# Check for Silverlight clientaccesspolicy.xml
curl -s https://target.com/clientaccesspolicy.xml
<!-- VULNERABLE - Allows any domain -->
<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>
<!-- VULNERABLE - Allows any domain -->
<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from http-request-headers="*">
<domain uri="*"/>
</allow-from>
<grant-to>
<resource path="/" include-subpaths="true"/>
</grant-to>
</policy>
</cross-domain-access>
</access-policy>
<!-- SECURE - Specific domains only -->
<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from http-request-headers="SOAPAction">
<domain uri="https://trusted.example.com"/>
</allow-from>
<grant-to>
<resource path="/api/" include-subpaths="true"/>
</grant-to>
</policy>
</cross-domain-access>
</access-policy>
# Check for wildcard in crossdomain.xml
curl -s https://target.com/crossdomain.xml | grep -E 'domain="\*"|domain="\*\.|secure="false"'
# Check for wildcard in clientaccesspolicy.xml
curl -s https://target.com/clientaccesspolicy.xml | grep -E 'uri="\*"|uri="http://'
| Tool | Description | Usage |
|---|---|---|
| curl | Retrieve policy files | curl -s url/crossdomain.xml |
| Nikto | Web scanner | Includes RIA policy checks |
| Burp Suite | Proxy | Analyze policy files |
If Flash/Silverlight are not used, remove policy files:
rm /var/www/html/crossdomain.xml
rm /var/www/html/clientaccesspolicy.xml
<!-- crossdomain.xml - Specific domains only -->
<?xml version="1.0"?>
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"/>
<allow-access-from domain="trusted.example.com" secure="true"/>
</cross-domain-policy>
Instead of RIA policies, implement proper CORS headers for modern applications:
Access-Control-Allow-Origin: https://trusted.example.com
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: Content-Type
Wildcard Cross-Domain Policy
| CWE ID | Title |
|---|---|
| CWE-942 | Overly Permissive Cross-domain Whitelist |
| CWE-346 | Origin Validation Error |
[ ] crossdomain.xml checked
[ ] clientaccesspolicy.xml checked
[ ] Wildcard permissions identified
[ ] Overly permissive configs documented
[ ] If RIA not used, recommend removal
[ ] For modern apps, test CORS instead