Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
awesome-electronjs-hacking
A curated list of awesome resources about Electron.js (in)security
https://github.com/doyensec/awesome-electronjs-hacking
Last synced: 3 days ago
JSON representation
-
Presentations
- "Electronegativity - A Study of Electron Security", Luca Carettoni, BlackHat USA 2017
- "MarkDoom: How I Hacked Every Major IDE in 2 Weeks", Matt Austin, APPSEC Cali 2018 - YnG3Mx-Tg)
- "Building a secure web browser in Electron", Yan @bcrypt, Electron Meetup 2/2018
- "Electron: Abusing the lack of context isolation", Masato Kinugawa, CureCon 2018
- "Preloading Insecurity In Your Electron", Luca Carettoni, BlackHat Asia 2019
- "app setAsDefaultRCE Client: Electron, scheme handlers and stealthy security patches", Juho Nurminen, ZeroNights 2019
- "Full Steam Ahead: Remotely Executing Code in Modern Desktop Application Architectures", Thomas Shadwell, INFILTRATE 2019
- "Democratizing Electron.js Security", Luca Carettoni, Covalence 2020 SF - Pkeg)
- "Remote Code Execution on Electron Applications", PwnFunction
- "Shifting left for Electron.js security", Ksenia Peguero, Midwinter Night's Con 2020
- "How to harden your Electron app", Mitchell Cohen, NorthSec 2021
- "Hacking ELECTRON: JavaScript Desktop Applications w/ 7aSecurity", John Hammond
- "ElectroVolt - Pwning Popular Desktop apps while uncovering new attack surface on Electron", Mohan Sri Rama Krishna Max Garrett Aaditya Purani William Bowling, BlackHat USA 2022 and Nullcon Goa 2022
- "How to harden your Electron app", Mitchell Cohen, NorthSec 2021
- "Only An Electron Away From Code Execution", Silvia Väli, Hack.lu 2018
- "How to harden your Electron app", Mitchell Cohen, NorthSec 2021
-
Open-Source & Commercial Tools
- Devtron
- ElectroNG
- 
- "Signature Validation Bypass Leading to RCE In Electron-Updater", Doyensec Blog
- "Electron Windows Protocol Handler MITM/RCE (bypass for CVE-2018-1000006 fix)", Doyensec Blog
- "Top 5 Day Two: Electron Boogaloo - A case for technodiversity", Vincent Lee
- "Exploiting Electron RCE in Exodus wallet", Tomas Lažauninkas
- "Chaining Three Bugs to Get RCE in Microsoft AttackSurfaceAnalyzer", Parsia Hakimian
- "Open Sesame: Escalating Open Redirect to RCE with Electron Code Review", Eugene Lim
- "From Markdown to RCE in Atom", Lukas Reschke
- "Visual Studio Code silently fixed a remote code execution vulnerability", CodeColorist
- "OVE-20210809-0001 Visual Studio Code .ipynb Jupyter Notebook XSS (Arbitrary File Read)", Justin Steven
- "Visual Studio Code Jupyter Notebook RCE ( CVE-2021-26437)", Doyensec Blog
- "Visual Studio Code - Remote Code Execution in Restricted Mode (CVE-2021-43908)", TheGrandPew and s1r1us
- "Remote Code Execution in Slack desktop apps + bonus", Oskars Vegeris
- "Cross-site scripting (XSS) in Microsoft Teams", Evan Grant
- "Dependency Confusion Vulnerability in Microsoft Teams", Matt Austin
- "RCE in Jitsi Meet Electron prior to 2.3.0 due to insecure use of shell.openExternal() (CVE-2020-25019)", Benjamin Altpeter
- "Insecure use of shell.openExternal() in Wire Desktop", Benjamin Altpeter
- "Brave Arbitrary IPC Messages via Prototype Pollution in Function.prototype.call", Masato Kinugawa
- "Websites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' Application", Parsia Hakimian
- "Discord Desktop App RCE", Masato Kinugawa
- "Discord Desktop - Remote Code Execution", s1r1us
- "Vulnerability in Electron-based Application: Unintentionally Giving Malicious Code Room to Run", CertiK
- "Joplin ElectronJS based Client: from XSS to RCE", Jaroslav Lobacevski
- "Facebook Messenger Desktop App Arbitrary File Read", Renwa
- "RCE in Mattermost Desktop earlier than 4.2.0", Nathan Lowe
- "GitHub Desktop RCE (OSX)", André Baptista
- "RCE in GitHub Desktop < 2.9.4", Vladimir Metnew
- "CVE-2020–16608", Sourov Ghosh
- "HEY Desktop RCE Chain", Doyensec Team
- "CVE-2018-1000136 - Electron nodeIntegration Bypass", Brendan Scarvell
- "Remote Code Execution on Element Desktop Application using Node Integration in Sub Frames Bypass", s1r1us and TheGrandPew
- "CVE-2022-29247 - Disable Electron Context Isolation or enable Node Integration in SubFrames", s1r1us
- "Important, Spoofing - zero-click, wormable, cross-platform remote code execution in Microsoft Teams", Oskars Vegeris
- "Prototype Pollution Vulnerabilities in Electron Apps", @s1r1u5
- "Security bug in Google Hangouts Chat desktop application – how to make Open Redirect great again", Michał Bentkowski
- "Jitsi Meet Electron – Arbitrary Client Remote Code Execution (CVE-2020-27162)", Robert Wessen - 2020-27161)", Robert Wessen](https://research.nccgroup.com/2020/10/23/technical-advisory-jitsi-meet-electron-limited-certificate-validation-bypass-cve-2020-27161/)
- "Weaponizing Chrome CVE-2023-2033 for RCE in Electron", Turb0
- "Evernote RCE: From PDF.js font-injection to All-platform Electron exposed ipcRenderer with listened BrokerBridge Remote-Code Execution", Patrick Peng
-
Blog Posts and Articles
- "Security, Native Capabilities, and Your Responsibility", Electron's Documentation
- "Instrumenting Electron Apps for Security Testing", Doyensec Blog
- "Reasonably Secure Electron", Joe DeMesy - -/reasonably-secure-electron)
- "As It Stands - Electron Security" - update-on-Electron-Security.html)
- "Exploiting Electron Applications using Debug Feature", Esecurity Lab
- "Why Electron apps can’t store your secrets confidentially: \` — inspect\`option", Vladimir Metnew
- "The App Sandbox", Charlie Hess
- "The dangers of Electron's shell.openExternal() — many paths to remote code execution", Benjamin Altpeter
- "1-click RCE in Electron Applications", Pavel Shabarkin
- "Exploiting Electron Applications using Debug Feature", Esecurity Lab
- "Abusing Electron apps to bypass macOS' security controls", Wojciech Reguła
- "How to patch apps with ElectronAsarIntegrity on macOS", Karol Mazurek
- "Using Discord Desktop for Backdoor Persistence", Turb0
-
Books
Programming Languages
Categories
Sub Categories