Search

Home > Resource Hub > Exploits Explained

Exploits Explained

The Exploits Explained series features technical vulnerability insights from the elite security researchers on the Synack Red Team. It offers a vetted forum for this global community of hackers to share the discovery of real-world vulns and offer tips for uncovering common exploit paths.

Exploits Explained archive filters and sorting

Exploits Explained

One Hotkey to Own Them All: Stored XSS Hidden in a Shared Shortcut File Web Application

One Hotkey to Own Them All: Stored XSS Hidden in a Shared Shortcut File

A Synack Red Team researcher found that a harmless-looking "PF Keys" label in a command-driven terminal was rendered straight into the page as HTML. The payload was stored server-side, fired automatically at every login, and could ride along in a shared shortcut file to reach other agents. The retest shows why output encoding at the sink and server-side validation are two separate fixes.

NS
Nitesh Shetty, SRT, Synack
Nitesh Shetty
6 min read
How a Pydantic Object Defeated a Jinja2 Sandbox: SSTI to RCE Web Application

How a Pydantic Object Defeated a Jinja2 Sandbox: SSTI to RCE

A Jinja2 SandboxedEnvironment blocked every classic template injection payload and its logic audited clean, yet one request still produced command execution. The cause was an application object in the template context: a Pydantic model whose public parse_raw method reaches pickle.loads. When you find a sandboxed SSTI, ask what the developer put in the room with you instead of which payload beats the sandbox.

G
Synack Red Team
gfuzzer
7 min read
One Byte Every 30 Seconds: Permanently Killing epmd with CVE-2026-42792 Network & Host

One Byte Every 30 Seconds: Permanently Killing epmd with CVE-2026-42792

This post walks through CVE-2026-42792, a chain of three small defects in Erlang's epmd (Port Mapper Daemon) that combine into a permanent, unauthenticated remote denial of service. Synack's Sr Pentester Ryan Moore shows how an attacker sending about 34 bytes per second from a single IP can exhaust epmd's connection slots, trigger an unhandled file-descriptor error that kills the daemon, and exploit systemd's default restart-rate limits to permanently disable it, requiring manual operator recovery.

RM
Ryan Moore, Sr Pentester, Synack
Ryan Moore
8 min read
Turning Blind Error-Based SQL Injection into Exploitable Boolean One — Part 4: Oracle Web Application

Turning Blind Error-Based SQL Injection into Exploitable Boolean One — Part 4: Oracle

This post documents a blind SQL injection against an Oracle backend where standard boolean, time-based, UNION and out-of-band techniques did not produce a usable extraction channel on this target. The solution was to use the DECODE function, which converts its return value to the data type of its first result. Put a number in the match branch and a non-numeric string in the default branch, and the false condition forces a conversion error while the true condition runs cleanly. That error/success difference becomes a boolean oracle for character-by-character extraction.

OA
Ozgur Alp Portrait
Ozgur Alp
8 min read