PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Attacking and defending JavaScript sandboxes

portswigger.net | research | #web-security | #sandbox-escape | #proxy | #defense | #code-execution | #javascript-sandbox
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Attacking and defending JavaScript sandboxes: with-statement breakouts, prototype tampering and generator constructors defeat naive proxy sandboxes; checkSyntax and a hardened design are proposed.
Published
Collected

Related coverage

research · portswigger.net
Hiding payloads in Java source code strings
Java processes unicode escapes in string literals before parsing, so \u0022 can close a string and run code — Bambdas from untrusted sources can achieve RCE and must be validated first.
research · portswigger.net
Making HTTP header injection critical via response queue poisoning
How a path-based header injection was upgraded into critical response queue poisoning: injecting Connection: keep-alive and a smuggled request poisons other users' responses, earning a $12,500 bounty.
research · portswigger.net
JSON hijacking for the modern web
Gareth Heyes revives cross-domain JSON hijacking with JS proxies that capture undefined variables, plus an Edge bypass via Object.setPrototypeOf. A UTF-16BE charset trick makes JSON arrays stealable.
research · blog.quarkslab.com
ProxyBlobing into your network
Quarkslab built a SOCKS5 proxy that tunnels traffic through Azure Blob Storage, abusing a wildcard firewall allowance to reach the internet from a restricted VDI during an assumed-breach test.
research · projectblack.io
Disable WPAD via GPO
Most public guides to disabling WPAD, including Microsoft's, are incorrect; after the author reported this to MSRC, Microsoft updated its documentation. Covers the two registry keys and GPOs needed.
research · slcyber.io
Out of Bounds, Out of Sandbox: RCE in Go JavaScript Engine
# Out of Bounds, Out of Sandbox: RCE in Go JavaScript Engine Get research alerts Share on social 20 min read ### Table of Contents TOC Element # Introduction Lately it feels like we've been...
Back