Examples: Break Same Origin - Flash

Note: The response comes from the domain unsecure.ajaxref.com which would normally break the same origin policy.

Front End
Back End

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>Chapter 10 - Breaking SOP with Flash</title>

<script type="text/javascript">

 
    
    function createSWF()
    {
        var swfNode = "";
        if (navigator.plugins && navigator.mimeTypes && navigator.mimeTypes.length) 
            swfNode = '<embed type="application/x-shockwave-flash" src="http://ajaxref.com/ch10/ajaxtcrflash.swf" width="1" height="1"  id="helloexternal" name="helloexternal" />';
        else { // PC IE
            swfNode = '<object id="helloexternal" classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="1" height="1" >';
            swfNode += '<param name="movie" value="http://ajaxref.com/ch10/ajaxtcrflash.swf" />';
            swfNode += "</object>";
        }
        
        document.getElementById("flashHolder").innerHTML = swfNode;
    }
    
    function getSWF(movieName) 
    {
       if (navigator.appName.indexOf("Microsoft")!= -1) 
         return window[movieName];
       else 
         return document[movieName];
      
    }
    
    function printMessage(str) 
    {
      document.getElementById("responseOutput").innerHTML = str;
    }
    
    window.onload = function()
    {
        createSWF();
        
        document.getElementById("helloButton").onclick = function(){
        var flashBridge = getSWF("helloexternal");
        flashBridge.connect("http://unsecure.ajaxref.com/ch1/sayhello.php", "printMessage");
        } 
    }

</script>

 
</head>
<body>
<form action="#">
 <input type="button" value="Say Hello" id="helloButton" />
</form>
 
<br /><br />
<div id="flashHolder"></div>
<div id="responseOutput">&nbsp;</div>
 
</body>
</html>