This 4 day course is designed to provide students with both an overview of the current state of the browser attack surface and an in-depth understanding of advanced vulnerability and exploitation topics. Attendees will be immersed in hands-on exercises that impart valuable skills including static and dynamic reverse engineering, zero-day vulnerability discovery, and advanced exploitation of widely deployed browsers such as Google Chrome.

Taught by Senior members of the Exodus Intelligence Browser Research Team, this course provides students with direct access to our renowned professionals in a setting conducive to individual interactions.

Emphasis

Hands on with privilege escalation techniques within the JavaScript implementations, JIT optimizers and rendering components.

Prerequisites

• Computer with the ability to run a VirtualBox image (x64, recommended 8GB+ memory)
• Prior experience in vulnerability research, but not necessarily with browsers.

Course Information

Attendance will be limited to 18 students per course.

Cost: $5000 USD per attendee

Dates:  July 15 – 18, 2024

Location:  Washington, D.C.

Syllabus

• JavaScript Crash Course
• Browsers Overview
  • Architecture
  • Renderer
  • Sandbox
• Deep Dive into JavaScript Engines and JIT Compilation
  • Detailed understanding of JavaScript engines and JIT compilation
  • Differences between major JavaScript engines (V8, SpiderMonkey, JavaScriptCore)
• Introduction to Browser Exploitation
  • Technical aspects and techniques of browser exploitation
  • Focus on JavaScript engine and JIT vulnerabilities
• Chrome ArrayShift case study
• JIT Compilers in depth
  • Chrome/V8 Turbofan
  • Firefox/SpiderMonkey Ion
  • Safari/JavaScriptCore DFG/FTL
• Types of Arrays
• v8 case study
  • Object in-memory layout
  • Garbage collection
• Running shellcode
  • Common avenues
  • Mitigations
• Browser Fuzzing and Bug Hunting
  • Introduction to fuzzing
  • Pros and cons of fuzzing
  • Fuzzing techniques for browsers
  • “Smarter” fuzzing
• Current landscape
• Hands-on exercises throughout the course
  • Understanding the environment and getting up to speed
  • Analysis and exploitation of a vulnerability