Browser-Exploit-Dojo is a curated archive of browser and JavaScript engine exploitation CTF challenges, organized by bug class, exploitation primitive, final technique, difficulty, and solve count. The goal is to document practical browser exploitation techniques through hands-on CTF challenges, with an initial focus on V8 and JavaScript engine exploitation.
The archive covers techniques such as type confusion, out-of-bounds access, JIT compiler bugs, WebAssembly exploitation, memory corruption, and exploit primitives leading to arbitrary read/write and code execution.
“Dojo” means a training place; this repository is intended as a practice-oriented archive for learning browser exploitation through CTF challenges.
Each challenge directory contains the original distribution files when available, exploit code, and a technical writeup.
Challenges are organized by year, and the top-level Challenge List serves as an index to each challenge directory.
For technique-based navigation, see Techniques Index.
Note: Year folders are based on the year in which the event was held, not necessarily the year shown in the CTF name.
Browser-Exploit-Dojo（道場）は、Browser / JavaScript Engine Exploit の CTF 問題を、Bug・Primitive・Final Technique・Difficulty・Solve 数ごとに整理する技術アーカイブです。まずは V8 を中心に、実践的なブラウザエンジンの exploit 技術を体系的にまとめることを目指します。
Type Confusion、Out-of-Bounds Access、JIT Compiler の脆弱性、WebAssembly Exploitation、Memory Corruption、Arbitrary Read/Write、Code Execution など、ブラウザエンジンの exploit に関する技術を扱います。
「道場」は練習・鍛錬の場という意味です。本リポジトリは、CTF 問題を通じて Browser Exploit を学び、技術を比較・復習するための実践的なアーカイブです。
各問題のディレクトリには、入手可能な配布ファイル、exploit code、技術解説をまとめます。
各問題は開催年別に整理し、トップページの Challenge List から各問題へ移動できる構成にします。
技術別に探したい場合は Techniques Index を参照してください。
Note: 年度別フォルダは、CTF 名に含まれる年ではなく、実際の開催年を基準にします。
This repository is intended for CTF learning, security research, and isolated local testing environments only. Do not run exploits against browsers, systems, or services without proper authorization.
Browser exploits may cause crashes, memory corruption, or arbitrary code execution. Use isolated environments and the exact challenge versions whenever possible.
本リポジトリは、CTF 学習、セキュリティ研究、および隔離されたローカル検証環境向けです。適切な許可なく、ブラウザ、システム、サービスに対して exploit を実行しないでください。
Browser exploit は、クラッシュ、メモリ破壊、任意コード実行などを引き起こす可能性があります。可能な限り、対象の challenge と同一のバージョンを隔離環境で使用してください。
Difficulty is based on exploit complexity, required engine knowledge, exploitation primitives, and solve count. Ratings are subjective and intended as practical learning references.
Difficulty は exploit の複雑さ、必要なエンジン内部の知識、利用する Primitive、Solve 数をもとに主観的に分類しています。学習や技術比較のための目安です。
| CTF | Challenge | Status | Difficulty (Solves) | Bug | Primitive | Final Technique |
|---|---|---|---|---|---|---|
| M*CTF 2025 Quals | Baby Browser | solved | Easy (7) | array length increment | addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| RSTCON 2025 CTF | Optimization | solved | Easy (?) | array length decrement | addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| PatriotCTF 2024 | babyxss | solved / writeup | Easy (?) | unchecked array length modification | addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| SAS CTF 2024 Quals | Ubercaged | solved / writeup | Easy (?) | unchecked OOB access in Array.prototype.readAt / writeAt | addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| picoCTF 2021 | Kit Engine | solved / writeup | Easy (?) | custom native-code execution API with RWX memory | JavaScript-controlled native code execution | x86-64 shellcode execution and flag disclosure |
| picoCTF 2021 | Download Horsepower | solved / writeup | Easy (?) | direct JSArray.length mutation | addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| DownUnderCTF 2020 | Is this pwn or web? | solved / writeup | Easy (10) | incorrect JSArray.length update in Array.prototype.slice | addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| Null CTF 2025 | reloc8 | solved / writeup | Easy-Medium (10) | inconsistent ToNumber() coercion enables bounds-check bypass | addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| Infobahn CTF 2025 | The Butterfly effect | solved / writeup | Easy-Medium (14) | custom ArrayMagic builtin OOB access | addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| Securinets CTF Quals 2025 | Sukunahikona | solved / writeup | Easy-Medium (14) | reentrant ToNumber() array length corruption | addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| UTCTF 2025 | E-Corp Part 2 | solved / writeup | Easy-Medium (31) | invalid ElementsKind transition | addrof / fakeobj / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| KalmarCTF 2023 | mjs | solved / writeup | Easy-Medium (52) | mJS raw function pointer arithmetic | OOB read / write / call | GOT Overwrite |
| DownUnderCTF 2022 | optimal vee ate | solved / writeup | Easy-Medium (10) | incorrect array length update in Array.prototype.concat() fast path | out-of-bounds access, addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| *CTF 2019 | OOB | solved / writeup | Easy-Medium (9) | custom OOB array access | addrof / fakeobj / AAR / AAW | WebAssembly RWX shellcode execution |
| NexHunt CTF | VowBreaker | writeup | Medium (10) | AsyncIterator promise species type confusion | type confusion => AAR / AAW | WASM code overwrite => shellcode execution |
| TFC CTF 2025 | SPECUL8 | writeup | Medium (4) | TurboFan type inference bug in StringMultiply | addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| DeadSec CTF 2025 | DeadV8 Sandbox | solved / writeup | Medium (32) | missing upper-32-bit clearing in liftoff i32 returns | dispatch handle substitution => stack corruption via argument count mismatch | sandbox violation trigger => crashFilter() flag disclosure or d8.file.read('/flag') |
| UMDCTF 2025 | literally-1985 | solved / writeup | Medium (10) | TurboFan JIT miscompilation (out-of-bounds access) | addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| Google Capture The Flag 2024 | HEAT | writeup | Medium (16) | WasmTableObject type corruption | AAR / AAW + pointer leak via wasm type confusion | wasm JIT code overwrite + shellcode execution |
| HITCON CTF 2022 | ⛓️ Fourchain - Hole | writeup | Medium (25) | heHole key handling in Map.prototype.delete | OrderedHashMap size corruption + addrof / AAR / AAW | ROP-based code execution |
| RITSEC CTF 2021 | Baby WASM | solved / writeup | Medium (5) | integer underflow in WebAssembly.Memory.shrink() | libc leak and arbitrary write via tcache poisoning | __free_hook overwrite with system() |
| RITSEC CTF 2021 | Teen WASM | solved | Medium (0) | WebAssembly memory shrink size validation | libc leak and arbitrary write via tcache poisoning | __free_hook overwrite with system() |
| LINE CTF 2021 | babychrome | solved / writeup | Medium (8) | TurboFan -0 handling bug in signed 32-bit overflow analysis | OOB array access => addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| 0CTF/TCTF 2020 Quals | Chromium RCE | solved / writeup | Medium (29) | missing detached-ArrayBuffer validation in TypedArray.prototype.set() | out-of-bounds memory read/write and address leaks | libc leak and system() invocation |
| CrewCTF 2025 | Wherechall | writeup | Medium-High (9) | wasm GC array.fill bounds check bypass | addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| DownUnderCTF 2025 | entangled revenge | writeup | Medium-High (11) | V8 entangled object handling | out-of-bounds access | flag object corruption |
| HITCON CTF 2024 Quals | V8 SBX Revenge | writeup | Medium-High (13) | exposed sandbox testing API | TPT entry overwrite via Sandbox.modifyTrustedPointerTable | ROP via stack pivot |
| FCSC 2024 | Holy Cow | writeup | Medium-High (?) | map corruption via exposed the_hole value | addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| bi0sCTF 2024 | ezv8 revenge | writeup | Medium-High (10) | TurboFan map inference bug in Reflect.construct | OOB Read/Write, addrof / AAR / AAW | WebAssembly code pointer overwrite + shellcode execution |
| ASIS CTF Quals 2023 | night.js | writeup | Medium-High (11) | LibJS (SerenityOS) ArrayBuffer copy length mismatch (heap buffer overflow) | heap overflow => arbitrary read/write | stack ROP / GOT overwrite |
| DownUnderCTF 2023 | return to monke | writeup | Medium-High (12) | SpiderMonkey Object.monke() type confusion | TypedArray OOB read/write | JIT code execution via fake class/ops |
| Google Capture The Flag 2023 | V8BOX | writeup | Medium-High (?) | ignition bytecode register-index bounds-check failure | sandbox memory read/write and native-stack manipulation | stack pivot and ROP-based sandbox escape |
| DiceCTF 2022 | memory hole | writeup | Medium-High (3) | Array.prototype.setLength OOB | sandbox R/W + out-of-sandbox arbitrary write | WebAssembly RWX shellcode execution |
| ASIS CTF Quals 2021 | V8 for dummies I | writeup | Medium-High (8) | TurboFan indexOf type inference bug + missing bounds check | out-of-bounds array access leading to arbitrary read/write | WebAssembly-assisted shellcode execution |
| ASIS CTF Finals 2025 | Singleton | writeup | High (2) | incorrect wasm type canonicalization | hash collision => wasm GC type confusion => addrof / fakeobj => AAR / AAW | wasm RWX shellcode execution |
| WannaGame Championship 2025 | Confusius | under analysis / TBD | High (3) | wasm GC subtyping check bypass | potential wasm GC type confusion | Unknown |
| RCTF 2025 | no_check_WASM | writeup | High (1) | wasm stack arity and type validation bypass | type confusion, AAR / AAW | wasm JIT code hijacking => shellcode execution |
| BackdoorCTF 2024 | V8box | writeup | High (1) | exposed memory corruption API | AAR / AAW => bytecode corruption => stack pivot | trusted pointer table hijacking => ROP => shell |
| GPN CTF 2024 | Date v2 | under analysis / TBD | High (1) | exposed V8 sandbox memory corruption API | out-of-sandbox memory access | sandbox violation => CrashFilter() => shell |
| CrewCTF 2023 | Typer | under analysis / TBD | High (1) | incorrect type inference in TurboFan | potential out-of-bounds access (unverified) | unknown or direct file read via d8.file.read() (challenge misconfiguration) |
| KITCTFCTF 2022 | Date | author writeup | High (0) | exposed V8 sandbox memory corruption API | sandbox arbitrary read/write | code_entry_point hijacking + stack pivot + ROP for sandbox escape/RCE |
| Google Capture The Flag 2022 | D8 | author writeup | High (5) | code cache deserialization: missing bounds checks and object validation | OOB read/write, object faking | WASM RWX shellcode execution |
| idekCTF 2021 | VeeAte | author writeup | High (3) | TurboFan deoptimization suppression | OOB read/write, addrof / AAR / AAW | wasm RWX memory shellcode execution |
| SekaiCTF 2024 | Context Reducer | author writeup | Very-High (1) | incorrect context depth in TurboFan optimization | OOB access => addrof / AAR / AAW | WebAssembly RWX code execution |
- JavaScript engine internals
- V8 reverse engineering
- JavaScript type coercion and reentrancy
- Type confusion
- Object layout and memory representation
- Map corruption and ElementsKind transitions
- Out-of-bounds read/write
- Heap corruption
- JIT compiler misoptimization
- TurboFan optimization and type inference bugs
- Speculative optimization
- Arbitrary read/write primitives
- Object address disclosure and fake object creation (addrof / fakeobj)
- Pointer and object reference manipulation
- Garbage collector interactions
- WebAssembly exploitation
- WebAssembly GC and type confusion
- WebAssembly table and jump table hijacking
- WebAssembly JIT code corruption and executable memory
- JIT code generation and shellcode execution
- Trusted Pointer Table (TPT) manipulation
- V8 sandbox memory corruption and escape
- Stack pivoting and Return-Oriented Programming (ROP)
- Sandboxed execution and security boundaries
- Browser sandbox escape, where applicable
- Exploit reliability and mitigation bypasses
Challenges may require a specific browser or JavaScript engine build, compilation options, runtime flags, or a custom execution environment.
For V8 challenges, the d8 shell is commonly used when provided or built from the corresponding source version. The required runtime flags and build instructions should be documented in each challenge directory.
Example:
./d8 exp01.js
For WebAssembly-related challenges, the exact engine version and required Wasm features may be essential for reproducing the behavior.
Always refer to the individual challenge README for the appropriate build and execution instructions.
Exploit code in this repository is primarily intended for local CTF environments and controlled testing.
Unless explicitly stated otherwise, exploit code included in this repository is tested against the available local challenge environment. Their behavior is not guaranteed on other engine versions, build configurations, operating systems, or browser environments.
JavaScript engine internals, JIT optimization behavior, object layouts, pointer representations, and available runtime features can change between versions. Some exploits may require specific flags, compilation settings, memory layouts, or environmental conditions.
本リポジトリの exploit code は、主にローカルの CTF 環境および管理された検証環境での動作確認を目的としています。
特に明記していない限り、exploit コードは、入手可能なローカル challenge 環境を中心に検証しています。異なるエンジンバージョン、ビルド設定、OS、ブラウザ環境での動作は保証していません。
JavaScript Engine の内部実装、JIT 最適化、オブジェクトのメモリ配置、ポインタ表現、利用可能なランタイム機能はバージョンによって変化します。特定のフラグ、ビルド設定、メモリ配置、実行環境が必要な場合があります。
Large distribution files, such as browser binaries, debug builds, source archives, and VM images, may be omitted from this repository when they are too large or impractical to maintain directly.
In such cases, only the minimum files required for analysis are included. External download links, source revisions, build instructions, or notes about the original distribution are provided when available.
サイズが大きい、またはリポジトリでの管理が困難なブラウザバイナリ、デバッグビルド、ソースアーカイブ、VM イメージなどは、直接含めない場合があります。
その場合は、解析に必要な最小限のファイルを配置し、可能であれば外部ダウンロードリンク、ソースのリビジョン、ビルド手順、元配布ファイルに関するメモを記載します。
-
README.md— metadata, challenge summary, bug analysis, and exploitation overview -
distribution/— original challenge files, binaries, and relevant resources -
exploit/— exploit source code and helper scripts, if available -
writeup/— technical analysis, reproduction notes, and external references
Original challenge files are preserved for archival and analysis purposes whenever possible. Some files may contain intentionally vulnerable software and should only be executed in isolated environments.
-
README.md— メタデータ、問題概要、脆弱性の分析、exploit の概要 -
distribution/— 元の配布ファイル、バイナリ、関連リソース -
exploit/— exploit のソースコードや補助スクリプト -
writeup/— 技術解析、再現手順、外部参考資料
可能な限り、元の challenge ファイルをアーカイブおよび解析目的で保存します。意図的に脆弱性を含むソフトウェアもあるため、必ず隔離された環境で実行してください。
Browser and JavaScript engine exploitation resources will be added as the archive grows.
本リポジトリの成長に合わせて、Browser / JavaScript Engine Exploit に関する参考資料を追加します。
I would like to express my sincere gratitude to all CTF organizers and challenge authors who created these excellent browser exploitation challenges.
Many of the techniques, exploit strategies, and implementation details in this repository are learned from public writeups, author writeups, source code, and shared research. I deeply appreciate everyone who documents their findings and makes technical knowledge available to the community.
This repository is intended as a personal learning archive and technical index. All credit for the original challenges belongs to the respective CTF organizers and challenge authors. All credit for referenced writeups and research belongs to their original authors.
素晴らしい Browser Exploit 問題を作成してくださった CTF 運営・問題作者の皆様に深く感謝します。
本リポジトリに含まれる技術、exploit 方針、実装上の知見は、公開 writeup、author writeup、ソースコード、各種研究資料から多くを学んだものです。技術的な知見を記録し、コミュニティに共有してくださった皆様にも心より感謝します。
本リポジトリは、個人の学習記録および技術索引として整理するものです。各 CTF 問題の権利と著作権は、それぞれの CTF 運営・問題作者に帰属します。参照した writeup や研究資料の著作権は、それぞれの原著者に帰属します。