Search

Home > Resource Hub > Exploits Explained

Exploits Explained

The Exploits Explained series features technical vulnerability insights from the elite security researchers on the Synack Red Team. It offers a vetted forum for this global community of hackers to share the discovery of real-world vulns and offer tips for uncovering common exploit paths.

Exploits Explained archive filters and sorting

Exploits Explained

How a Pydantic Object Defeated a Jinja2 Sandbox: SSTI to RCE Web Application

How a Pydantic Object Defeated a Jinja2 Sandbox: SSTI to RCE

A Jinja2 SandboxedEnvironment blocked every classic template injection payload and its logic audited clean, yet one request still produced command execution. The cause was an application object in the template context: a Pydantic model whose public parse_raw method reaches pickle.loads. When you find a sandboxed SSTI, ask what the developer put in the room with you instead of which payload beats the sandbox.

G
Synack Red Team
gfuzzer
7 min read
Turning Blind Error-Based SQL Injection into Exploitable Boolean One — Part 4: Oracle Web Application

Turning Blind Error-Based SQL Injection into Exploitable Boolean One — Part 4: Oracle

This post documents a blind SQL injection against an Oracle backend where standard boolean, time-based, UNION and out-of-band techniques did not produce a usable extraction channel on this target. The solution was to use the DECODE function, which converts its return value to the data type of its first result. Put a number in the match branch and a non-numeric string in the default branch, and the false condition forces a conversion error while the true condition runs cleanly. That error/success difference becomes a boolean oracle for character-by-character extraction.

OA
Ozgur Alp Portrait
Ozgur Alp
8 min read
Turning Blind Error-Based SQL Injection into Exploitable Boolean One — Part 3: PostgreSQL Web Application

Turning Blind Error-Based SQL Injection into Exploitable Boolean One — Part 3: PostgreSQL

This post documents a blind SQL injection in a PostgreSQL ORDER BY clause where standard boolean, time-based, and UNION techniques were all unavailable. The solution: use a regex function to trigger a controlled error, isolate it inside a subquery so it only fires on the false branch of a CASE statement, and use the error/success response difference as a boolean oracle for character-by-character data extraction.

OA
Ozgur Alp Portrait
Ozgur Alp
6 min read