Other nomination

UPnP Hacking via Flash

Adrian Pastor and pdp

pdp and Adrian Pastor drop the XSS requirement from UPnP router attacks. Flash's URLRequest can set POST content type application/xml and add a SOAPAction header, so a plain malicious SWF sends a UPnP SOAP control message straight to the LAN router, adding port forwards or changing the primary DNS server. No same-origin bypass needed, and most consumer routers of the day ship UPnP on.

Record

Researcher

Adrian Pastor and pdp

In the archive

• Nominated for the 2008 Top 10 Web Hacking Techniques

Tags

• csrf
• flash
• soap
• dns
• sop-bypass
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Adrian Pastor and pdp, first published at the original source. Preserved copies are kept so the citation survives its host.