General-purpose security research repository covering browser exploit chain development, post-exploitation techniques, and security assessment tooling. Contains CVE reproduction work across Chrome (V8, Blink, ANGLE, Skia) and Firefox (SpiderMonkey, IPC, WebAssembly), along with fuzzing infrastructure, reverse engineering notes, and a Databricks Apps security assessment delivered as an interactive Streamlit dashboard.

All materials in this repository are for educational purposes and authorized security testing only. Exploit code is provided to support defensive research, vulnerability reproduction, and security assessment under responsible disclosure. Do not use any code or technique against systems you do not own or have explicit written authorization to test.

Level key: ACE = arbitrary code execution, ARW = arbitrary read/write, UAF = use-after-free demonstrated, OOB = out-of-bounds access, Trigger = bug trigger only.

exploits/
├── cves/                        # CVE reproductions, organized by target/year/CVE-ID
│   ├── chrome/
│   └── firefox/
├── tools/                       # Standalone security tooling
│   ├── idol/                    # IDOL — infection detection overlay
│   ├── win-remote/              # Windows remote testing agent
│   └── fuzzing/                 # Fuzzing harnesses and generators
├── docs/                        # Research notes, analysis, methodology
│   ├── advisories/
│   ├── analysis/
│   └── methodology/
├── reports/                     # Security assessment reports
│   └── databricks-apps-assessment/   # Streamlit dashboard (src/ → build.py → app.py)
└── infra/                       # Docker images, build scripts
    ├── docker/
    └── scripts/

• IDOL (tools/idol/) — Infection Detection Overlay for visualizing compromise indicators.
• win-remote (tools/win-remote/) — Remote agent for Windows-targeted testing. Requires .env configuration (see .env.example).
• Fuzzing (tools/fuzzing/) — JavaScript fuzzers for SpiderMonkey and V8 trigger discovery.

• Databricks Apps Assessment (reports/databricks-apps-assessment/) — Interactive Streamlit dashboard demonstrating security concerns in Databricks App deployments. Built from src/ fragments via build.py.

1. Clone the repo and install Python dependencies where needed (individual requirements.txt files in relevant subdirectories).
2. Browse cves/ for specific CVE reproductions. Each CVE directory contains its own README with setup instructions.
3. See docs/ for research methodology and analysis notes.
4. For the Databricks assessment dashboard: cd reports/databricks-apps-assessment && pip install -r requirements.txt && streamlit run app.py.

• Repository: github.com/AndrewAltimit/exploits
• GitHub Pages: andrewaltimit.github.io/exploits
• Live Dashboard: andrewaltimit.github.io/exploits/dashboard — runs in-browser via WebAssembly, no install required