Flashbang icon indicating copy to clipboard operation
Flashbang copied to clipboard

Published 20 hours ago • verified publisher icon cure53

Invisible Flashvars

Open cure53 opened this issue 9 years ago • 1 comments

Heya,

strangely, in this file, Flashbang cannot see the Flashvars. It needs to be noted, that other decompilers and tools have similar issues.

http://s3.amazonaws.com/avlidienbrunn/wheres_the_xss.swf

Can we specify what is happening here?

Cheers, .mario

cure53 avatar May 11 '15 08:05 cure53

The Shumway we use is giving this error. Seems like some error in parsing

Uncaught (in promise) TypeError: Cannot read property 'defaultValue' of undefined (Bindings.js:163)
Uncaught (in promise) TypeError: Cannot read property 'createAsSymbol' of undefined (Loader.js:293)

The latest shumway successfully plays this file successfully and I can see a JS call

!skipCallback?callback('undefined'):''

As the new shumway is able to play, I think it can detect the vars as well. The architecture of shumway has changed, so I will look back into the new version once I have enough time.

flabbergastedbd avatar May 18 '15 12:05 flabbergastedbd