browser pwn, main work now.

• browser_pwn_basic_knowledge

  description: some basic knowledge and scripts of browser pwn.

  related link: None

  finished date: 2019

• starctf2019-oob

  description: d8 basic pwn game, with oob vuln.

  writeup: None

  related link: None

• 数字经济-final-browser

  description: callback of Object::ToNumber to form uaf and oob write.

  writeup: None

  related link: None

  finished date: 2019

• plaidctf2018-roll_a_d8

  description: oob vuln in array.form

  writeup: None

  related link: chromium commit

  finished date: 2019

• array_prototype_map_oob_write

  description: a oob write vuln in array.prototype.map function, with abusing use of Symbol.species

  writeup: None

  official link: chromium commit

  finished date: 2019

• cve-2018-17463

  description: ObjectCreate's side effect annotation

  writeup: None

  official link: chromium commit

  finished date: 2020

• 34c3ctf-v9

  description: exp for v9 in 34c3ctf, bug in redundancy-elimination

  writeup: None

  official link: v9

  finished date: 2020

• 35c3ctf-krautflare

  description: exp for krautflare in 34c3ctf, bug in type optimization

  writeup: None

  official link: Issue 1710: Chrome: V8: incorrect type information on Math.expm1

  finished date: 2020

• google-ctf2018-final-just-in-time

  description: exp for just in time game in google ctf 2018 final, bug in type optimization, with the characteristic of Number.MAX_SAFE_INTEGER.

  writeup: None

  official link: pwn-just-in-time

  finished date: 2020

• qwb2019-final-groupupjs

  description: exp for qwb 2019 final groupupjs, oob bug in kUint32LessThan.

  writeup: None

  official link: None

  finished date: 2020

• cve-2016-5168

  description: invalidate stable map assumption for globals on creankshaft, exploit with null String object

  writeup: None

  official link: Fix

  finished date: 2020

• cve-2017-5070

  description: invalid side effection judge for global value.

  writeup: None

  official link: issue

  finished date: 2020

• cve-2020-6418

  description: JSCreate can have side effects, bug in receiver maps inference.

  writeup: browser-pwn cve-2020-6418漏洞分析

  official link: commit

  finished date: 2020