Search

Home > Resource Hub > Exploits Explained

Exploits Explained

The Exploits Explained series features technical vulnerability insights from the elite security researchers on the Synack Red Team. It offers a vetted forum for this global community of hackers to share the discovery of real-world vulns and offer tips for uncovering common exploit paths.

Exploits Explained archive filters and sorting

Exploits Explained

Turning Blind Error-Based SQL Injection into Exploitable Boolean One — Part 4: Oracle Web Application

Turning Blind Error-Based SQL Injection into Exploitable Boolean One — Part 4: Oracle

This post documents a blind SQL injection against an Oracle backend where standard boolean, time-based, UNION and out-of-band techniques did not produce a usable extraction channel on this target. The solution was to use the DECODE function, which converts its return value to the data type of its first result. Put a number in the match branch and a non-numeric string in the default branch, and the false condition forces a conversion error while the true condition runs cleanly. That error/success difference becomes a boolean oracle for character-by-character extraction.

OA
Ozgur Alp Portrait
Ozgur Alp
8 min read
When Cars Get Hacked: Inside Automotive Cyber Warfare Network & Host

When Cars Get Hacked: Inside Automotive Cyber Warfare

This post covers four common automotive attack techniques: CAN bus injection, UDS security access bypass, keyfob replay, and FOTA spoofing. It describes how each maps to the vulnerability classes that AppSec researchers already know. Synack Red Team researcher Manh Nguyen Dinh breaks down the vehicle attack surface, draws the parallels to traditional web security, and explains what it takes to pivot into automotive security research.

MN
Manh N Dinh Portrait
Mạnh Đình Nguyễn
10 min read
Turning Blind Error-Based SQL Injection into Exploitable Boolean One — Part 3: PostgreSQL Web Application

Turning Blind Error-Based SQL Injection into Exploitable Boolean One — Part 3: PostgreSQL

This post documents a blind SQL injection in a PostgreSQL ORDER BY clause where standard boolean, time-based, and UNION techniques were all unavailable. The solution: use a regex function to trigger a controlled error, isolate it inside a subquery so it only fires on the false branch of a CASE statement, and use the error/success response difference as a boolean oracle for character-by-character data extraction.

OA
Ozgur Alp Portrait
Ozgur Alp
6 min read