WebKit RegExp Exploit addrof() walk-through

Part 4: We finally look at the actual exploit code. We start by understanding the addrof() primitive used to leak the address of a JavaScript object in memory.

-=[ 🕴️Advertisement ]=-

-=[ ❤️ Support ]=-

-=[ 🔴 Stuff I use ]=-

-=[ 🐕 Social ]=-

-=[ 📄 P.S. ]=-

All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

#browserexploitation

[christian]

It's awesome that you not just show the exploit but also show the real issue of the compiler and optimize the exploit.

[bennesp]

That "well known" killed me 😂

[onkz]

Really great video. I love your way of making these scripts even more efficient.

[kevinjohansson]

Well-known Symbols: In addition to user-defined symbols, JavaScript has some built-in symbols. These represent internal language behaviors which were not exposed to developers in <ES5>.

[tsoer]

Missed a golden opportunity to make the video 6 seconds longer...

[bigmistqke]

This channel s so informative. You are really a great teacher.

[thatanimeweirdo]

I'm learning so much more about JS through these videos. (I'm kinda scared of languages with pointers)

[AxelMontini]

How can someone even think of that? Did he take a look at the slow and fast functions by mistake and noticed the lack of checks?
It's fascinating how random discoveries can be.

[victornpb]

Its amazing how they managed to make JavaScript fast.

[pereJobs]

2:06 You don't have to leave your JavaScript interpreter to convert from float to hex. You can do it in one line of js:

new Uint32Array(new

[EinTypOhneHandle]

That's awesome! Thanks for looking into it. Really interesting stuff there. I wonder how many other bugs are hidden in those optimizations. One can't think of every edge-case, right?

[pereJobs]

It doesn't mean "well known by programmers" 😅

[BALAGE]

Being able to pass arbitrary objects into internal execution engine code is simply not acceptable, but you're telling me that this huge vulnerability can be patched with a simple type check? If only we had a language feature that would help us find these mistakes. Wait. It actually exists (but not in js lol) and it's called strong typing.

[MrTare]

The video should have been 6 seconds longer...

[Asdayasman]

Huh, so... Why does the regex implementation not bail when `.lastIndex` isn't a number? Seems like a stupid use of oven gloves...

[japrogramer]

Neat, so they didn't really fix it.

[gabiold]

Dynamically typed languages are so annoying...

[bandie]

JS. the. world's. leading. prg. language.

[sontapaajokulainen]

The technical details of exploit

/ \
___/ Me

[capkenway]

So, even after it is patched if you are able to take the faster router you can still perform the exploit. Fascinating.