I saw this a time ago... Not sure if it helps, but easy to understand.

http://www.securitytube.net/video/221

z.

I was wrong, sorry 

HP SWFScan can decompile ASv3 but not the one I need to test. Might be because of the obfuscation (?), I don't know.

I tried to obfuscate the ASv3 SWF that was OK with SWFScan before, but now the error showed up "Decompile operation failed".

When I'm trying to decompile the needed file, no error shows up. It just finds "nothing" in the file, except urls and AS version. No source code is found.

z.

Hi guys!

Are there any requirements to take the GPEN exam? I haven't found any but want to be sure.

Thanks,
z.

Sothink worked even in trial version, but you can't export the code (due the trial).

Actually I wasn't able to decompile any ASv3 with HP SWFScan, flare or SWFIntruder, even sample SWF files from web - not obfuscated.

If any of you was successful in it, please let me know.

Thanks,
z.

Thanks for the idea with obfuscation - it is definitely obfuscated! But Sothink Decompiler can do the job, while HP SWFScan can't

Thanks for the link with alternatives. Still, every tool there, that can possibly do the job can't be used in commercial matter

z.

tturner,

thank you very much for your reply. Unfortunately neither flare or SWFintruter can't decompile SWF with ActionSript v3.

For now it seems that the only option to decompile ASv3 is to buy some commercial product.

zelda

Hi guys!

Do you have any experiences with decompiling ActionScript v3 for free?

I have tried to do that with HP SWFScan (they are saying that it supports AS v3), but wasn’t successful. Commercial Sothink SWF Decompiler was able to do that, but not for free 

Thanks for suggestions!

Regards,
zelda 

Hi everybody!

1. I wonder if anyone here lives (work) in central Europe and if you can post your experiences with finding EH job or maybe salary comparing between Europe and USA. I know that salary comparison can be found easily by google, but I'm interested in your opinion.

2. And finally... Is anybody here doing only external pentesting? You know, like having contracts with companies and working for them like an external worker? Make some money, take a break and so on? Is this way of working in this field possible?

This is my very first post here, so I could introduce myself. I'm Zelda, working as a security architect in IS developing company in Czech Republic. I hold Security+ certification and I'm in preparing process for C|EH (thanks to this forum). Now I' looking for pentesting or security consulting related jobs. Well, and as you can see my english is NOT really great  so be gently 


Thanks for advise,

Zelda