wstg-clnt-08

name	wstg-clnt-08
description	Testing for Cross-Site Flashing
category	client-side
owasp_id	WSTG-CLNT-08
version	1.0.0
author	cyberstrike-official
tags	["client-side","javascript","dom","cors","wstg","clnt"]
tech_stack	["html","javascript"]
cwe_ids	["CWE-1021"]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-clnt-08

Test ID

WSTG-CLNT-08

Test Name

Testing for Cross-Site Flashing

High-Level Description

Cross-Site Flashing (XSF) vulnerabilities occur in Flash/SWF applications when user input is improperly handled. Although Flash is deprecated, legacy applications may still use it. Similar vulnerabilities can exist in other rich media technologies.

---

What to Check

• Flash files on target site
• crossdomain.xml configuration
• External data loading in SWF
• User input in Flash parameters
• Legacy rich media content

---

How to Test

Step 1: Find Flash Content

#!/bin/bash
TARGET="target.com"

# Find SWF files
curl -s "https://$TARGET" | grep -oP '[^"]+\.swf'

# Check crossdomain.xml
curl -s "https://$TARGET/crossdomain.xml"

# Common paths
paths=("/crossdomain.xml" "/clientaccesspolicy.xml" "/flash/crossdomain.xml")
for path in "${paths[@]}"; do
    curl -s "https://$TARGET$path"
done

Step 2: Analyze crossdomain.xml

<!-- Vulnerable configuration -->
<?xml version="1.0"?>
<cross-domain-policy>
    <allow-access-from domain="*"/>