MarkDoom: How I Hacked Every Major IDE in 2 Weeks

on YouTube ↗40m

" summary

Demonstrates arbitrary code execution across major IDEs by abusing markdown previews, Electron node integration and protocol handlers, producing 5 CVEs and bounty payouts. Shows concrete exploits: adding a script tag to Visual Studio Code, bypassing CSP via meta redirect, using SMB auto-mount to make remote HTML appear as local, and delivering payloads as dot.app execution or .terminal files to run commands. Covers JetBrains local-server key theft and TextMate system-call abuse; fixes and mitigations are tested and validated.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 22:47## Abusing "open in browser" Sublime Text
3. 23:37## Abusing Javascript Bridge: JetBrains
4. 27:41SOP / File Exfiltration: Edipse

" related talks

• 36mExploiting Vulnerabilities and Flaws to Attack Supply ChainYakir Kadkoda, Ilay Goldman · RSA Conference 2023
• 01h 06mHow hacking worksEspen Sande-Larsen · NDC TechTown 2023
• 55mHow hacking worksEspen Sande-Larsen · NDC Security 2023
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019
• 51mHow hacking works - Web editionEspen Sande-Larsen · NDC Sydney 2024
• 32mWriting Secure JavaScript CodeGuy Podjarny · View Source 2017
• 33mOffensive Javascript Techniques for Red TeamersDylan Ayrey, Christian Frichot · BSidesSF 2019
• 40mHow to hack a node app?Asim Hussain · GDG DevFest Ukraine 2017