Deblaze a Remote Method Enumeration Tool for Flex Servers

Architecture and Background

Deblaze - A Remote Method Enumeration Tool for Flex Servers Jon Rose Trustwave This talk will provide a basic overview of Flash remoting and cover some of the security issues found in real-world flash applications and demonstrate a new tool for testing flash applications. Flash applications can make request to a remote server to call server side functions, such as looking up accounts, retrieving additional data and graphics, and performing complex business operations.

Vulnerability Analysis

However, the ability to call remote methods also increases the attack surface exposed by these applications. Deblaze came about as a necessity during a few security assessments of flash based websites that made heavy use of flash remoting.

Exploitation and Demonstrations

I needed something to give me the ability to dig a little deeper into the technology and identify security holes. This tool will allow you to perform method enumeration and interrogation against flash remoting end points.

Remediation and Defensive Strategies

The latest version can be found at deblaze-tool.appspot.com Jon Rose has close to a decade of experience performing network and application security assessments, including network penetration testing, blackbox application testing, and code reviews across a wide range of programming languages and technologies. His security expertise also includes creating enterprise security programs, providing guidance in an enterprise security architect role, and building security into organizations existing software development lifecycle. Jon currently works in Trustwave's SpiderLabs Application Security team. For copies of the slides and additional materials please see the DEF CON 17 Archive here: