2014_EN_BrowserFuzzing_RosarioValotta

Recommendations

Info

The masterplan #2 Use Several namespaces Also ON elements on collections OP<strong>EN</strong> Parent window Jscript9.dll Create random elements Tweak elements attributes Collect element referenc e Perform random mutation s on DOM Trigger GC Crawl DOM referenc e Use Several namespaces Also ON elements on collections Child window Jscript.dll Create random elements Tweak elements attribute s Collect element reference Perform random mutations on DOM Trigger GC Crawl DOM reference Use mutation events and mutation observers Add listener Event handler Create xhr/WS object Open xhr/WS Send xhr/WS Nodejs app js Eval (JS)
SOME RESULTS #1 Registers: EAX = 0x45454545 - EBX = 0x0303FCC0 - RW- ECX = 0x68EB08B3 - R-X - jscript9!NativeCodeGenerator::CheckCodeGen EDX = 0x019AD684 - RW- ESI = 0x00000003 - EDI = 0x0AC2F89C - RW- EBP = 0x0AC2F720 - RW- ESP = 0x0AC2F6D4 - RW- EIP = 0x45454545 - IE 11 Type: D.E.P. Violation Exploitable: YES Call Stack: 0x68EAD364 - jscript9!Js::JavascriptFunction::CallRootFunction 0x68EAD2B6 - jscript9!ScriptSite::CallRootFunction 0x68EAD23D - jscript9!ScriptSite::Execute 0x68EAECC1 - jscript9!ScriptEngineBase::ExecuteInternal 0x68EAEBFD - jscript9!ScriptEngineBase::Execute 0x659DE34E - mshtml!CMutationObserver::PerformMicrotaskCheckpoint 0x659DE284 - mshtml!CObserverManager::InvokeObserversForCheckpoint 0x65AA45DE - mshtml!GlobalWndOnMethodCall 0x65487C5E - mshtml!GlobalWndProc 0x753CC4E7 - user32!InternalCallWinProc 0x753CC5E7 - user32!UserCallWinProcCheckWow 0x753CCC19 - user32!DispatchMessageWorker 0x753CCC70 - user32!DispatchMessageW 0x65DD8DDC - mshtml!ModelessThreadProc
Page 1 and 2: BROWSER FUZZING IN 2014: David vs G
Page 3 and 4: 你好 ! • Hi beijing! I am rosa
Page 5 and 6: Vulnerabilities market Providers Bu
Page 7 and 8: Memory corruption vulns: a primer
Page 9 and 10: Usual Targets for Browser fuzzing R
Page 11 and 12: DOM fuzzing • DOM has a complex d
Page 13 and 14: Stone #1 - Fuzzing/with/TIME
Page 15 and 16: • browsers are event-driven JS ti
Page 17 and 18: • Event objects are dispatched to
Page 19 and 20: Fuzzing with events setTimeout(fn,0
Page 21 and 22: FUZZing with XHR (2/2) Similar cons
Page 23 and 24: …the other side of the party •
Page 25 and 26: Stone #2 - Fuzzing/with/space
Page 27 and 28: Using legacy engines • By default
Page 29 and 30: Cross engines interactions • When
Page 31: Introducing fileja • A prototype
Page 35 and 36: SOME RESULTS #3 Registers: EAX = 0x
Page 37 and 38: Registers: EAX = 0x00454545 - EBX =
Page 39 and 40: SOME RESULTS #7 Caught a Write Acce
Page 41 and 42: SOME RESULTS #9 Caught a Read Acces
Page 43: Thankyou 谢谢

2014_EN_BrowserFuzzing_RosarioValotta

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?