Nmap 127.0.0.1: Flash style

By on Aug 13, 2007 · Leave a Comment 

A design flaw found in ActionScript (Flash) has been allowed the scanning hosts via trial and error. Whenever a port is queried by Flash that isn’t open, it responds with a “SecurityErrotEvent” instantly. But, when a port is open, it doesn’t get that response for an extended period of time, while it waits for a reply to

“policy-file-request”. PoC can be viewed at the below address. Now the question is: What ELSE can you do with this information once you have this ability. I’ll leave that up to the color of your hat.scan.flashsec.org/

Frank's the editor in chief of tech.nocr.at. He can be found surfing the internet and playing with gadgets. Follow him on twitter @franklinhares

Filed under Hacking And Security · Tagged with , , , , , , , , , , , , , ,