Skip to main content

28. Finding Web Security Issues by Reversing WASM

Modern frontends often hide sensitive logic in WebAssembly. WASM runs in the browser, but it is ultimately a binary, which creates reversing targets.

Fast analysis flow​

  • Collect: download the .wasm file from DevTools → Network
  • Disassemble: convert it to WAT with wasm2wat, then scan strings and constants
  • Understand the logic: locate input validation, token generation, and encryption routines
  • Attempt a bypass: hook call arguments and return values in the JavaScript glue code

Security checklist​

  • Do not trust client-side validation alone (server-side revalidation is mandatory)
  • Do not embed keys or secrets in WASM
  • Clarify the threat model before focusing on obfuscation

WASM is closer to "raising the difficulty of analysis" than to "strengthening security." An attacker will eventually read it as WAT and bypass it through JavaScript.