I was asked to crawl a flash website, which appears to be utilizing some kind of server-side call through the AMF protocol. I am completely unfamiliar with this protocol, but found this library (http://www.pyamf.org/index.html).
I can view the payload that is sent to the server, as well as the response. I can make out certain key elements, but overall do not understand the request or the response.
I assume the library would help somehow, but am unsure where to start. Does anybody know of resources or techniques for reverse-engineering an AMF call or can somebody explain why it’s not likely?
As someone who has built a library that can parse AMF (RocketAMF), I would advise that you use one of the existing libraries rather than write your own. Below is a list of some libraries for AMF parsing by language, with many more a simple search away:
As for understanding how AMF generally works, it’s an object serialization format with a remote procedure call (RPC) layer. All RPC calls are composed of a service name and a method to call on that service, as well as a list of parameters. If they are using Flex, there are some additional layers to the RPC process that aren’t documented anywhere besides Adobe’s open source AMF implementation, BlazeDS, but are supported by all the above libraries.
You might also want to check out Charles, which is capable of deserializing AMF requests that are proxied through it, making reverse engineering a bit easier.