Top 10 winner

Rosetta Flash

Michele Spagnuolo · miki.it

Rosetta Flash converts any SWF into one built only from alphanumeric characters, using ad-hoc Huffman encoders and Adler-32 checksum bruteforcing, so the file can be passed as a JSONP callback and reflected by the vulnerable site. The victim's browser then runs that Flash from the target origin, making cookie-carrying requests and exfiltrating the responses to the attacker.

Record

Researcher

Michele Spagnuolo

Published by

miki.it

In the archive

• Ranked #4 in the 2014 Top 10 Web Hacking Techniques

Related sources

• Research paper
• Comprehensive slides
• Proof-of-concept source
• Earlier compression technique

Tags

• sop-bypass
• flash
• csrf
• filter-bypass
• encoding
• same-origin-policy
• cve
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Michele Spagnuolo, first published at the original source. Preserved copies are kept so the citation survives its host.