How are sites like xanga.com able to enable HTML and flash?

[Tae-Hwan]

...without having their site hacked?

[KuraFire]

they filter out all potentially harmful HTML and flash via intricate filtering. These sort of filters are usually custommade by some company or so for them, and cost a good penny.

[Steve Machol]

Originally Posted by Tae-Hwan

...without having their site hacked?

And just because you have not seen them hacked doesn't mean they haven't been - or won't be in the future.

[Tae-Hwan]

ok, i know xanga has been hacked but i was just wondering how safe velocd's custompage hack is. i'm ok with disabling javascript, but how exactly can you hack a site through flash? does anyone know of any resources i can read on this?

thanks!

it would also be nice to read some stuff on how javascript can hack a vbulletin (if html is enabled) but i'm not too optimistic about the possibility of leaving that on, hehe. it would just be nice to know, for curiosity's sake.

btw i'm ok at php/mysql so you can use programmer-geek language to explain it to me

[KuraFire]

See, I don't think it's really good for anyone to tell you how to hack a vBulletin. Such information can easily be abused, perhaps not by you but by others. Moreover, we have no way of making sure you won't abuse that knowledge yourself.

Same with hacking through Flash.

[Tae-Hwan]

ok, i assure you, all i want to do.. is install velocd's custompage hack while maintaining the peace of mind that no one's going to destroy my site through it. in its current form, it does allow you to embed flash into the html code of a member's page, which is exactly why i want to know how much i can limit this to keep my server secure. deterrence through obscurity never works, which is why open-source products are more secure than microsoft products. i think it would be beneficial to the entire vbulletin.org community, if we knew the vulnerabilites in our software,.. so if anyone would be kind enough to tell me exactly how flash can be used to hack the server, i'd really appreciate it.

[KuraFire]

trust me, allowing users to embed flash on your site from whatever given source is a major security leak. There is no way you can make it safe, the only safe way is to not allow flash, simple as that. Or to let them choose from a few examples that you both store and have made, all by yourself. But that's probably not what you want...

[Tae-Hwan]

yes, i trust you in that it is a security leak, but as a programmer, i have a proclivity to understand why things work the way they do.

some forums use the following method to embed flash:

Originally Posted by scsa20

$hit (sorry for my language), this is easy to do, just go to your admin cp and go to:
Custom vB Codes>Add

and put in the following:

vB Code tag: flash
vB Code replacement: < embed src={param } type=application/x-shockwave-flash>< /embed>
vB Code example: [flash ]Your URL to your flash movie just for an ex.[ /flash]
vB Code explanation: Your own explanation
Use {option } ?: No

remember, to remove spaces from [ and flash] and [ and /flash] and anything that's < and > and also anything between { and }

good luck

are you telling me that all these forums (assuming that they are publicly accessible) are insecure as well?

with all due respect, i find your unwillingness to relinquish any information on this matter rather unnerving.. i have never, and will never, hack someone else's vbulletin. i just have a desire to know why it's possible, to better my understanding of the security threats to my website, and to better my understanding of website security in general. i was under the impression that this is a trait common to all programmers, is it not?

from the way you're talking, it seems like you're pretty knowledgeable about this stuff, so i'm sorry if we misunderstood each other along the way, but i'd really appreciate it if you would help me out here, or at least guide me towards some information on the nature of malevolent flash scripts.

[KuraFire]

well, I'm just hesitant in sharing information about security leaks / loopholes etc.
other people read this site, too. they might have real bad intentions....


Basically, embedding any flash file from a source that is not your own server, poses a direct thread. There is no way of telling what the flash file will do upon execution, and flash files are capable of a lot more than people think.... So yes, the vB Code above is a risk, a security problem...

[Tae-Hwan]

ah i see, so the only thing i need to do is filter it so that the flash file must come from my own server? so i can have them upload the .swf file to my server, and link to it in the embed tag?