Macro image of a beetle with circuit board shell patterns on a dark blue background with binary code, representing cybersecurity exploits and vulnerabilities for Synack's Exploits Explained series.

PENTESTING SECRETS

Exploits Explained

The Exploits Explained series features technical vulnerability insights from the elite security researchers on the Synack Red Team. It offers a vetted forum for this global community of hackers to share the discovery of real-world vulns, offer tips for uncovering common exploit paths and unpack their use of GenAI tools.

Read Now

When Cars Get Hacked: Inside Automotive Cyber Warfare A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open. Manh Nguyen Dinh Read more

How Attackers Bypass 2FA with Response Tampering A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open. Ozgur Alp Read more

Turning Blind Error-Based SQL Injection into Exploitable Boolean One — Part 3: PostgreSQL A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open. Ozgur Alp Read more

Beyond the Public PoC Deep Diving CVE 2025-54309 A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open. IronRoot Read more

Client-side Authentication Bypass: 3 Real-World Pentesting Case Studies A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open. Kuldeep Pandya Read more

Exploiting PostMessage Handlers to Achieve DOM XSS A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open. John Kounelis Read more

Microservices Attack Vectors in Modern Web Applications A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open. Mustafa Bilgici Read more

When the Boot Files Talk: How an Open TFTP Directory Handed Attackers the Keys to the Kingdom A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open. Sukesh Shetty Read more

Manipulating the Checkout: A Masterclass in Business Logic Flaws A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open. Tubagus Fahrudiansyah Read more

From OSINT to Exploit: Uncovering Auth Bypass and Leaked Credentials A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open. MukundBhuva Read more

Security Advisory: Critical RCE Vulnerability in React and Next.js (CVE-2025-55182, CVE-2025-66478) A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open. Pieter Ockers Read more

How I Ended Up Managing the World’s Elite A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open. nerrorsec Read more

Using an LLM to Exploit a Novel HTTP Interface A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open. Nicolas Krassas Read more

Turning Frontend Clues into Backend Compromise: Insecure Routing to RCE In this edition of Exploits Explained, SRT member Marouane "Duty1g" Belabbassi recounts how an unsafe eval() call in the process endpoint allowed dynamic backend... Duty1g Read more

The AI/LLM Hacking Cheatsheet This post is a cheatsheet for anyone looking to learn more about testing the security of AI and LLMs. Busra Read more

Dissecting Stored XSS in SAP Concur Open: Event Handler Bypass and Regex Evasion Tactics A Synack Red Team member discovered a cross-site scripting vulnerability in SAP Concur Open. Yeasir Arafat Read more

1 2 3 4 Next »