== Instrumentation and reverse code engineering technology:
- general tools and attack surface:
Clang-Type-conf.
possibly-instrument-mem-curp-with.
snowman.
Re-jpeg.
bugid-automated-bug-analysis.
testcase-reduction.
Smashing_The_Browser.
RTFfuzzer.
fuzzingImageMagick.
urlfuzzer.
build skia.
build skia(2).
asan+skia.
asan-win32.
dbg-ios.
swf-flash.
flash.
domato.
adobe reader.
old fuzzer.
ioctlbf.
krnlfuzz.
kfuzz.
bochspwn.
DdiMon.
build upon ddimon.
xenpwn.
icesword.
Bareflank.
proto-fuzz.
vtrace.
Rootkitsmm/Win32k-Fuzzer.
shellphish/fuzzer.
- misc:
- source code:
webgl.
firefox-src.
Mozilla pdf Src.
Mozilla Src.
chromium-src.
quic docs.
chromium quic.
- env-nix*:
libfuzzer at llvm.
oss-fuzz.
kgdb.
dharma/a>.
webGl/a>.
spiderMonkey.
GDB+py.
afl-qemu/testsuite.
WebAssembly/testsuite.
afl-setup.
afl.
revskills/fzbrowsers#/38.
fuzzing-ff.
gknik.
setup(asan&afl).
afl.
build skia.
build skia(2).
synthesizers.
skia-src.
dumb-input.
llvm.
Clang.
- ida:
ncc win_driver_plugin.
fireeye string extractor.
dev-new.
usefull.
joxeankoret/diaphora.
- IOS || MacOs
arm registers.
lldb.
a-fun-xnu-infoleak-great writeup!.
ctl_ctloutput-leak.
locating crash logs via itunes.
download webkit compiled.
developer.apple.crashlogs.
poc2018-IOUserClient.
poc2018-IMac internals- s Grob.
analyze runtime apps w/o jb.
p2o-mwr-safari.
fuzzing-p2o-mwr-safari.
sigoza_zeroc0n2018.
ian beer.
passcode bypass re.
getting panic logs.
xcode simbolize memorydump.
developer . apple . com/docu.
resiymbolize.
download kernel debug kit.
kernel dbg docu.
put.as.
gdb.
ian beer - build your own ios debugger.
ian beer deja-xnu.
ian beer ios 11 slides.
ian beer async_awake.
IOKitUser package.
frida.
debugging .
core dumps.
ret2systems fuzzing mobile safari.
gdb+.
vm pages...
darwin headers.
setup theos.
webkit expl tuto.
hooking with logos...
== Exploits, bugs and technical information:
- javacript:
ifratric - IE infoleak exploit - heap manipulation..
safari reg-exp krzywix.
goog-v8 opt prototypes.
S0rryMyBad-chakra rce.
FUZZING JS INTERPETERS singi-ZEROCON17.
p2o 18 mwr safari exp.
from safari to kernel ZCON2018.
bhusa-ZDI from browser to system compromise.
Acg-bypass ifratric.
Array bugs...
js-ll-overview.
saelo/v9.
firefox-ctf.
saelo->phrack.
p0-jscript.dll.
Ian Beer-(Safari-Browser-exploitation).
(v8-oob)->exp.
phoenhex.re.
Make LoadLibrary Great again.
heapLayOutOpt-for exp.
tc.codereview.
dv.
- v8
Chrome exploits-(S0rryMybad).
v8-escape-analysis.
v8-opt.
beautiful v8 bug.
^^ much alike.
secmob-private-prop-v8.
secmob-oob.
v8-bytecode.
youtube-v8.
v8os.
v8.ppt.
v8mips.
v8.
- Chakra:
p2o-2016.
expsky.
MxatoneMitagationCodeExecInEdge.
yuki-chen.
natashenka-Your_Chakra_Is_Not_Aligned.
oom.
Microsoft-Edge-Windows-10-RCE-EXPLOIT.
- edgehtml:
- Wasm:
Interacting-with-code.
emscripten.
compile-mdn.
tuto.
vuln-1.
vuln-2.
- SandBox:
IndexedDB sbx - chromium 2018.
gpo chrome mojom::directory interface ...
chrome IPC.
google/sandbox-attacksurface-analysis-tools.
lokihardt-chromium escape.
lokihardt-SmartScreen-sbx cr.
secmob-play.google.com rce -> uxss -> chrome sanbox escape! (last pages of the pdf).
mj0011sec safari escape with kernel bug.
(phoenhex) pwn2own-17-safari-sandbox-escape.
SandboxEscaper edge blogpost.
SandboxEscaper/edge.
(forshaw) MSIE.
Chromium sb good overview page 36..
chrome-sb bug-0.
chrome-sb bug-1.
chrome-sb bug-2.
- Other(browser):
JSoverrides.
flash zday.
webkit-zdi.
webkit exploit writeup.
webkit-oob-exploit.
chrome-pwnfest2016.
edgeangle.
logicBugsCh-mwr.
S0rryMybad(safariPwn2Own).
jscript9-typedarray-cfg.
chrome.
webkit.
uaf-exp.
zdi-jit.
tencents-chakra.
expsky-mit.
primitives.
js.
CVE-2017-0037.
4B5F5F4B.
ie win7 tc p0.
about the edge sandbox.
pwn-with-red.
34c3-bypass aslr side-channel.
pdfium-bug-0.
- DOM bugs and UXSS
dom spec.
chrome-uxss.
a lot of uxss bugs.
mcafee-UXSS.
subverting ajax.
bo0om.ru.
lokihardt.
--chrome dom src--.
--webkit dom src--.
chrome uxss 0.
chrome uxss 1.
chrome uxss 2.
chrome uxss 3.
chrome uxss 4.
chrome uxss 5.
chrome uxss 6.
chrome uxss 8.
chrome uxss 9.
chrome uxss 10.
chrome uxss 11.
chrome uxss 12.
safari uxss 1.
safari uxss 2.
safari uxss 3.
safari uxss 4.
safari uxss 5.
safari uxss 6.
safari uxss 7.
safari uxss 8.
- Server side & WEBSEC:
fb-django-rce.
SSRF.
known problems.
Orange ama.
from ssrf-to-rce.
^^same.
phrack ruby on rails vul.
- kernel & desktop client side
ensilo mitigations - windows internals 2018 RS3 || RS4.
msmpengine rar vuln gp0.
intel igdkmd64 vul (talos).
RE:windows defender.
telegram zday.
macOs-exp.
winKernelPrimitivesPython(pal).
xairy/linux-kernel-exploitation.
xairy/kernel-exploits.
lgandx/PoC.
awesome-windows-exploitation.
linux-kernel-exploits.
windows-kernel-exploits.
OldKExp.
K0day+rce(win).
MortenSchenk.
winDnsClientRCE.
androidKernelPocs.
kSmbRceLinux.
_SEP_TOKEN_P.. arw.
sensepost ms16-098.
duplicate^.
same same but diff.
progmboy/cansecwest2017.
abatchy17.
pal.
dlpacketstorm.
x41.
pcap.
docs.
hitcoin.
flash as.
br.
safari.
Q overwrite.
tencent.
bypass-cfg.
- ios
- Android:
libstagefright.so.
QCOM pixel RE Tencent.
QLab bluetooth vuln's.
patch stagefright for fuzzing pdf.
patch stagefright to decode only one frame with ^^ (p35).
fix oom when building source..
enable binder & ashmem on lin the easy way ...
kgdb.
/ele7enxxh/poc-exp pocs and exploits ..
fuzzing libStagefright on linux Qihoo.
@natashenka - android apk.
Attack surface and vul patterns.
fuzzing libStagefright.
more fuzzing.
android ASAN.
POC-2017-fuzzing android.
KernelDebugOnNexus6P.
broadpwn.
reversing firmware-andr.
UAF-kernel-and-keen-lab.
luaqemu_bcm_wifi.
android_vuln_poc-exp.
broadcoms-wi-fi_4-P0.
P0-baseband-exp.
TEES-P0.
wifi-cr.
Android Open Source Project.
source-andr.
andr-AFL.
fuzzing android syscalls.
bits-please.blogspot.
azeria.
/ge0n0sis.
ScottyBauer.
keen-lab.
mwr-labs.
arm-emu-vis.
SeLinuxExpPrivEsc.
gpo-0.
gpo-1.
gpo-2.
gpo-3.
gpo-4.
gpo-5.
gpo-6.
samsung guanggong cansecwest.
- Other:
integers ovf.
artkond/cisco-rce.
SmbRce.
ApacheTomcatRce.
fishstiqz/poolinfo.
SomeAflTrivia.
windows-mitigations.
scrt@dns-hijack.
- Com:
COM in 60 seconds.
sandboxescaper-flash-com-server.
iid-clsid-progid.
ExploitDotNetDCOMSerializer.
interop.
cli-vs.
.net-com.
doc-IUnkown.
p0-com-blog.
wincombug.
intelcombug.
SandboxEscaper-flash.
ie11-sbx.
ole-view-dotnet.
bhusa=2014 ie sbx forshaw.
idl decompiler.
- flash:
0x0 configure jre for flex.
0x1 configure jre for flex.
action script api.
flash projector.
adobe flex.
@natashenka recon.
- Speciel:
ff-exp.
ImageMagickDecoderInfoLeak.
Crypto.
vmware_escape.
JailBreak.
full-exp-chain-chromium-os.
android-wifi-rce.
Hyper-v-short.
Intel-Me-Code-exec.
Qihoo-vmware-escape.
browser@jit-gen.
MsMp.NET.
scan-msmp-console.
MsMp-API-cpp.
- fuzzing//dictionary
^^ example bug.
^^ example dict.
SMIL.
IndexDB.
wasm.
- pdf:
pdfium p0.
ke liu blackhat.
pdfium bugs ...
jaanus kaap fuzzing pdf's.
api's//formats.
insertscript-foxit.
angea.
Html2pdf.
dumbf.
tomcarver/pdf-tools.
- Office:
office-JsApi-II.
office-JsApi-Vul.
office-word@mr_me.
some interesting api's...
embedi RCE.
Office fuzzer ...
- ShellCode:
peter calc.
skylined.
ssherei.
Apc.
Apc.
msf.
arch.
winapi.
Iat.
asnair.
RKX1209.
Salwan.
nixmix.
crypto.
- vm:
virtual-box escape.
keenlab vmware escapes!.
@_niklasb insomaninhack virtualbox (video).
virtual box escapes.
50-shades-of-fuzzing vmware.
Qihoo-vmware-escape.
vmware_escape.
hyper-v bug.
hyper-v bug (gpo).
Xen-qlab.
xen-gpo-1.
xen-gpo-2.
xen-gpo-3.
vmware attack surface.
zdi bug vmware.
zdi bug vmware2.
zdi-zero nights vmware.
vmware-rpc-request-sniffing-zdi.
virtual box escape.
- SysCalls:
j00ru.
- Misc:
Chromium-ext.
CVE-2017-11767.
- con:
recon.
a big thread.
PoC||GTFO mirror.
pacsecJp.
post
== misc++
ARM-Qemu.
pykd.
TWindbg.
g-compute.
== Tech Low Level:
vm.
https://paypal.me/theakayn