Главная
Study mode:
on
1
Intro
2
Background of ANGLE
3
ANGLE Architecture Overview
4
WebGL Implementation
5
Chrome texStorage3D Out of Bound Read
6
Safari MultiDrawArrays Heap overflow
7
Safari Transform Feedback Use After Free
8
Allocate Buffer Object
9
Exploitation Steps
10
JSC's Butterfly Overview
11
Step 1: Heap Spray
12
Trigger the Bug
13
Search Corrupted JSArray
14
Get JSCell and Structure ID
15
Get addrof/fakeobj primitives
Description:
Explore browser hacking techniques using ANGLE in this 49-minute conference talk from the Hack In The Box Security Conference. Gain foundational knowledge of the ANGLE project and its implementation in WebGL/WebGL2 for web browsers. Analyze vulnerability types, root causes, and exploitable flaws in ANGLE, including a demonstration of achieving remote code execution on macOS. Dive into specific vulnerabilities like CVE-2021-30626, crbug.com/1266437, and CVE-2022-26717. Learn about ANGLE architecture, WebGL implementation, and various exploitation techniques such as out-of-bound reads, heap overflows, and use-after-free vulnerabilities. Follow along as the presenter, Jeonghoon Shin, a KITRI BoB mentor, guides you through the intricacies of browser bug hunting and exploitation.

Browser Hacking With ANGLE

Hack In The Box Security Conference
Add to list
0:00 / 0:00