Ok, so some of you guys will probably have seen some of my posts... basically I am a newbie Pen Tester and have predominantly starting performing web app assessments.

Unfortunately I don’t have a development background, mainly sys admin and therefore am not up to speed with scripting languages.  Now I have decided to learn perl eventually but need a quick understanding of javascript and actionscript as I am not entirely sure what to look for when looking for XSS when the standard alert functions do not work.   Don’t get me wrong I have noticed that the standard <script>alert(“xss”)</script> does still get executed a lot on sites but need to get a better understanding  of Javascript and how to look for the more discreet vulnerabilities?

When decompiling flash files I generally look for Look for encryption algorithms and salts, directories you can access and enumerate, crossdomain.xml file for * as the domains it can use any more?
Any help would be appreciated?

Cheers

This does not have much to do with learning javascript or actionscript (but the aforementioned site:w3schools is very good) but have you read The Web Application Hacker's Handbook? It's really good and in depth, and you said that you are starting new with webapp testing. Very robust and if you read a chapter at a time and apply what you learned on a vuln site, it really sticks in your head. In your case, maybe you can make mock-up web apps using javascript/actionscript and try and apply what you learned from that chapter in the book. 2 birds, 1 stone lol.

Have you looked at the WebGoat Project?

Another one is : http://google-gruyere.appspot.com/#0__jarlsberg
they renamed jarlsberg to gruyere though, but same thing, just with revisements.