2014_EN_BrowserFuzzing_RosarioValotta

Recommendations

Info

SOME RESULTS #4 Registers: EAX = 0x00004444 - EBX = 0x0086EAB8 - RW- ECX = 0x009320BC - RW- EDX = 0x032D1A01 - RW- ESI = 0x00000001 - EDI = 0x0020003A - EBP = 0x02EBC3F8 - RW- ESP = 0x02EBC3E8 - RW- EIP = 0x6A362B1F - R-X - mshtml!CScriptData::AsyncFireOnError IE 11 Type: r.A. Violation Exploitable: YES Code: 0x6A362B1F - call dword ptr [eax] 0x6A362B21 - mov esi, eax 0x6A362B23 - lea ecx, [ebp-8] 0x6A362B26 - push 0 0x6A362B28 - push esi 0x6A362B29 - call mshtml!CElement::CLock::CLock 0x6A362B2E - push -1 0x6A362B30 - mov ecx, esi Call Stack: 0x69EF1A3C - mshtml!GlobalWndOnMethodCall 0x69ED9A52 - mshtml!GlobalWndProc
Registers: EAX = 0x00454545 - EBX = 0x00000000 - ECX = 0x00410000 - R-- EDX = 0x00000008 - ESI = 0x0020F000 - EDI = 0x0020F000 - EBP = 0x0015E494 - RW- ESP = 0x0015E47C - RW- EIP = 0x00454545 - SOME RESULTS #5 Chrome 35 Type: D.E.P. Violation Exploitable: YES Call Stack: 0x668907A2 - chrome_child!WTF::DefaultAllocator::backingMalloc 0x66CE6896 - chrome_child!WebCore::MutationObserver::enqueueMutationRecord 0x66CEE2B6 - chrome_child!WebCore::MutationObserverInterestGroup::enqueueMutationRecord 0x66AF3188 - chrome_child!WebCore::Element::willModifyAttribute 0x66B8B668 - chrome_child!WebCore::Element::setAttribute 0x66B8B29A - chrome_child!WebCore::ElementV8Internal::setAttributeMethod 0x66B8AFFE - chrome_child!WebCore::ElementV8Internal::setAttributeMethodCallback
Page 1 and 2: BROWSER FUZZING IN 2014: David vs G
Page 3 and 4: 你好 ! • Hi beijing! I am rosa
Page 5 and 6: Vulnerabilities market Providers Bu
Page 7 and 8: Memory corruption vulns: a primer
Page 9 and 10: Usual Targets for Browser fuzzing R
Page 11 and 12: DOM fuzzing • DOM has a complex d
Page 13 and 14: Stone #1 - Fuzzing/with/TIME
Page 15 and 16: • browsers are event-driven JS ti
Page 17 and 18: • Event objects are dispatched to
Page 19 and 20: Fuzzing with events setTimeout(fn,0
Page 21 and 22: FUZZing with XHR (2/2) Similar cons
Page 23 and 24: …the other side of the party •
Page 25 and 26: Stone #2 - Fuzzing/with/space
Page 27 and 28: Using legacy engines • By default
Page 29 and 30: Cross engines interactions • When
Page 31 and 32: Introducing fileja • A prototype
Page 33 and 34: SOME RESULTS #1 Registers: EAX = 0x
Page 35: SOME RESULTS #3 Registers: EAX = 0x
Page 39 and 40: SOME RESULTS #7 Caught a Write Acce
Page 41 and 42: SOME RESULTS #9 Caught a Read Acces
Page 43: Thankyou 谢谢

2014_EN_BrowserFuzzing_RosarioValotta

Create successful ePaper yourself

Delete template?

Save as template?