/browser_pwn

browser pwn, main work now

Primary LanguageC++

browser_pwn

browser pwn, main work now.

  • browser_pwn_basic_knowledge

    description: some basic knowledge and scripts of browser pwn.

    related link: None

    finished date: 2019

  • starctf2019-oob

    description: d8 basic pwn game, with oob vuln.

    writeup: None

    related link: None

  • 数字经济-final-browser

    description: callback of Object::ToNumber to form uaf and oob write.

    writeup: None

    related link: None

    finished date: 2019

  • plaidctf2018-roll_a_d8

    description: oob vuln in array.form

    writeup: None

    related link: chromium commit

    finished date: 2019

  • array_prototype_map_oob_write

    description: a oob write vuln in array.prototype.map function, with abusing use of Symbol.species

    writeup: None

    official link: chromium commit

    finished date: 2019

  • cve-2018-17463

    description: ObjectCreate's side effect annotation

    writeup: None

    official link: chromium commit

    finished date: 2020

  • 34c3ctf-v9

    description: exp for v9 in 34c3ctf, bug in redundancy-elimination

    writeup: None

    official link: v9

    finished date: 2020

  • 35c3ctf-krautflare

    description: exp for krautflare in 34c3ctf, bug in type optimization

    writeup: None

    official link: Issue 1710: Chrome: V8: incorrect type information on Math.expm1

    finished date: 2020

  • google-ctf2018-final-just-in-time

    description: exp for just in time game in google ctf 2018 final, bug in type optimization, with the characteristic of Number.MAX_SAFE_INTEGER.

    writeup: None

    official link: pwn-just-in-time

    finished date: 2020

  • qwb2019-final-groupupjs

    description: exp for qwb 2019 final groupupjs, oob bug in kUint32LessThan.

    writeup: None

    official link: None

    finished date: 2020

  • cve-2016-5168

    description: invalidate stable map assumption for globals on creankshaft, exploit with null String object

    writeup: None

    official link: Fix

    finished date: 2020

  • cve-2017-5070

    description: invalid side effection judge for global value.

    writeup: None

    official link: issue

    finished date: 2020

  • cve-2020-6418

    description: JSCreate can have side effects, bug in receiver maps inference.

    writeup: browser-pwn cve-2020-6418漏洞分析

    official link: commit

    finished date: 2020

  • Issue 762874

    description: The Typer put the wrong type on String.indexOf and String.lastIndexOf builtins, with an off by one on the upper bound. exploit it on version 6.3 and 7.4

    writeup: None

    official link: commit-762874

    commit-7bb6dc0e06fa158df508bc8997f0fce4e33512a5

    finished date: 2020

  • Issue 913296

    description: wrong typing of SpeculativeSafeIntegerSubtract, just a poc, failed to build exploit.

    writeup: None

    official link: commit-913296

    finished date: 2020

  • cve-2019-5782

    description: wrong typing of ArgumentsLength, easy to exploit.

    writeup: None

    official link: commit-8e4588915ba7a9d9d744075781cea114d49f0c7b

    finished date: 2020

  • issue-944062

    description: missing map checks in the reducer of array.indexOf and array.includes.

    writeup: None

    official link: commit-e80082bf549aa26d6e30f114a23a05df9c510849

    finished date: 2020

  • issue-746946

    description: error generate elements kind transitions from stable maps..

    writeup: None

    official link: commit-ea55b873f2ed8336604540a532cbd460eeb66430

    finished date: 2020

  • rwctf2019-Accessible

    description: deleting the FieldTypeDependency of property access cuases the vuln

    writeup: None

    official link: None

    finished date: 2020

  • wctf2019-Independence_Day

    description: patch compilation dependancy and no expose wasm problem

    writeup: None

    official link: Independence Day (win)

    finished date: 2020

  • issue-941743

    description: Array.prototype.map wrong ElementsKind for output array.

    writeup: None

    official link: commit

    finished date: 2020

  • issue-799263

    description: missing Kill transition-kind source map in load elimination.

    writeup: None

    official link: commit

    finished date: 2020