Abusing JSONP With Rosetta Flash
summary
Rosetta Flash converts arbitrary SWF to an alphanumeric SWF converter that fits into JSONP callbacks, uses an object tag to force application/x-shockwave‑flash, and exploits Flash’s permissive parser to perform cross‑origin authenticated requests and exfiltrate cookies. It builds custom deflate/Huffman tables and uses an Adler‑32 checksum padding trick (overflow + null bytes) so the file validates; a Go tool generates payloads and can be configured for UTF‑8 callback sets. Adobe adds header/content checks and sites mitigate by prefixing responses or forcing download.
AI-written summary · about
chapters (14)
- 0:00Start
- 4:31The attack scenario
- 10:24SWF header
- 12:52zlib DEFLATE
- 13:16zib header hacking
- 14:41DEFLATE block
- 15:44Back to Rosetta Flash
- 16:40ADLER32 manipulation
- 21:13Dissecting the stream
- 22:22Wrapping up
- 22:55Mitigations by Adobe
- 30:01Mitigations by website owners
- 31:51Conclusions
- 33:18Questions?
related talks
28mXSS, CSRF, CSP, JWT, Wtf? Idk
36m"Playing in the Sandbox: Adobe Flash Exploitation Tales"
31mXSS, CSRF, CSP, JWT, Wtf? Idk ¯\_(ツ)_/¯
50mDynamic Flash Instrumentation for Fun and Profit
45mSame Origin Method Execution (SOME) - Exploiting a Callback for Same Origin Policy Bypass
29mHack Me if You Can
33mHacking The Front-End
37mAbusing Adobe Reader’s JavaScript APIs