This is a collection of curated resources I use for research. I found myself pinning tabs - this is to prevent that. My goal is not to repeat information in other repositories, unless I visit them quite often.
./cve contains all my written N-day exploits. Exploits from other authors are explicity credited in the respective README.
- Turbolizer (Only works with Chrome)
- OmahaProxy
- JSC Issues
- B3 docs
- Rust FFI bindings to JSC
- Contemporary JavaScriptCore Exploitation by
qwertyoruiopof kjc research
- Gigacage
- Isoheaps
- isoheap management (bmalloc)
- PACCage schema
- ArrayBuffer CagedPtr
- GigaUnCager PoC
- WebCore sandbox profile pulled from macOS 10.15.6 (19G2021)
- SpiderMonkey docs
- SpiderMonkey hg source (mercurial)
- SpiderMoney git source (github)
- IonMonkey hg source (mercurial)
- IonMonkey git source (github)
- Gecko Core Security Issues
- IonMonkey Issues
- jandem blog
- browser-pwn
- awesome-browser-exploit
- JS-Vuln-DB
- saelo blog
- pwn.js
- js-test-suite (ChakraCore, SpiderMonkey, V8, JavaScriptCore)
Grammar:
LSP: