Course 38 - Web Security Known Web Attacks | Episode 5: SOP Fundamentals and SOME Attack Exploitation via Flash Callbacks

In this lesson, you’ll learn about: Same Origin Policy (SOP), its controlled exceptions, and how attackers exploit it using SOME via Flash callbacks1. What is the Same Origin Policy (SOP)🔹 Definition:A core browser security rule that restricts how documents interact🔹 Enforced in:Web Browsers🔹 Rule:Two URLs can interact only if all match:Protocol (HTTP / HTTPS)Host (domain)Port👉 Key InsightSOP prevents unauthorized access between different websites2. Why SOP Exists🔹 Purpose:Protect user data (cookies, sessions, DOM)🔹 Without SOP:Any site could read or modify another site👉 Key InsightSOP is the foundation of web security isolation3. Soft Exclusions to SOP🔹 Allowed interactions: embeddingpostMessage API🔹 Why they exist:Enable cross-origin communication safely👉 Key InsightSOP is strict—but not absolute4. Introducing SOME (Same Origin Method Execution)🔹 Definition:A technique to execute methods across windows using references🔹 Related concept:Reverse clickjacking👉 Key InsightSOME doesn’t break SOP—it works around it5. Role of Flash in SOME Attacks🔹 Technology involved:Adobe Flash Player🔹 Bridge:ActionScript ↔ JavaScript🔹 Key function:ExternalInterface.call()👉 Key InsightFlash acts as a bridge to execute JS indirectly6. How Flash Callbacks Become Vulnerable🔹 Weakness:Accept user-controlled input🔹 Restrictions:Often limited to:Letters (a–z, A–Z)Numbers (0–9)Dot (.)🔹 Still dangerous because:Can call existing JS functions👉 Key InsightLimited input ≠ safe input7. SOME Attack Lifecycle🔹 Step-by-step:Victim visits attacker pageMalicious page opens new tabUses window.opener referenceParent tab redirected to target sitePayload executes via callback👉 Key InsightAttack uses tab relationships + timing8. DOM Manipulation via SOME🔹 Target:Document Object Model (DOM)🔹 What attacker can do:Trigger clicksSubmit formsChange UI state👉 Key InsightUser actions are simulated without consent9. Real-World Example: WordPress Exploit🔹 Platform:WordPress🔹 Vulnerability:Flash file (video-js.swf) with weak callback🔹 Attack outcome:Plugin activated automatically👉 Key InsightEven mature platforms can have legacy weak points10. Bypassing Filters🔹 Challenge:Only alphanumeric + dot allowed🔹 Solution:Call existing functions like:window.opener.someFunction👉 Key InsightAttackers reuse existing trusted functions11. Chaining Actions🔹 Advanced technique:Open multiple tabs🔹 Result:Simulate complex workflows:Activate pluginDelete filesChange settings👉 Key InsightSimple actions can be chained into full compromise12. Why SOME is Powerful🔹 Works when:XSS is blockedCSRF is mitigated🔹 Because:Uses legitimate browser behavior👉 Key InsightSecurity controls can be bypassed via unexpected paths13. How to Prevent SOME Attacks🔹 Remove legacy risks:Disable Flash completely🔹 Secure callbacks:Validate inputs strictlyAvoid dynamic execution🔹 Protect windows:Use rel="noopener noreferrer"👉 Key InsightModern security = eliminate legacy + validate everything14. Big PictureYou are learning:👉 How SOP protects—but also limits👉 How attackers abuse allowed behaviors👉 Why legacy tech (Flash) is dangerousMental ModelSOP restriction → allowed exceptions → weak callback → window reference → method execution → silent attackYou can listen and download our episodes for free on more than 10 different platforms:https://linktr.ee/cybercode_academy