Skip to content

Browser Exploitation

links: Further Topics - Index

JavaScript is implemented in C++ \(\rightarrow\) Remote-Code-Execution by default!

Browser Security

  • Similar size like an OS
  • Support a shitload of file formats (PDF, GIF/PNG/JPEG, SVG, ...)
  • Can "upload" your own code (JavaScript) to be executed!
  • Some "secure browsers" completely disable Same-origin-policy, ASLR, DEP, ...
  • Privacy is not security!
  • Browser Sandbox isolates "dangerous" code in a separate process, child code cannot access filesystem or create processes

links: Further Topics - Index