pwn-learning/PwnCollege/V8Exploitation/Level4

Level 4

Problem

Given a vulnerability which can set an array's length by using Array.prototype.setLength().

Key Knowledge

• Heap Fengshui
• OOB Access other heap content by corrupting array's length