The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

assemble the object into human-readable bytecode, and use Flare to

decompile the object into ActionScript source.

■

As with decompiled Java applets, review the bytecode and source to

identify any attack points that will enable you to reengineer the Flash

object and bypass any controls implemented within it.

Handling Client-Side Data Securely

As you have seen, the core security problem with web applications arises

because client-side components and user input are outside of the server’s

direct control. The client, and all of the data received from it, is inherently

untrustworthy.