---
id: 6439
title: "Breaking Javascript with Python Pickles (Solving brinebid in DEFCON CTF Qualifiers 2023)"
source_domain: blog.washi.dev
source_url: "https://blog.washi.dev/posts/defcon-brinebid/"
published_at: "2023-06-03T00:00:00Z"
tags: ["ctf", "exploit", "javascript", "defcon", "pickle", "virtual-machine"]
phying_url: "https://phying.com/item/6439"
lang: en
---

# Breaking Javascript with Python Pickles (Solving brinebid in DEFCON CTF Qualifiers 2023)

## Summary

A DEFCON CTF Quals 2023 write-up for 'brinebid': combining a Python pickle-based client, a JavaScript VM server and a VM vulnerability to achieve arbitrary code execution and capture the flag.

## Intelligence Metadata

- **Sources:** blog.washi.dev
- **Published:** 2023-06-03T00:00:00Z
- **Original:** https://blog.washi.dev/posts/defcon-brinebid/
- **Phying News:** https://phying.com/item/6439