Synack Red Team

"I'm still not an automation guy...it's not my style." - @ozgur_bbh Ozgur Alp joins WE'RE IN to share his views on AI and how he became a full-time independent security researcher: open.spotify.com/episode/7IQbxh…

"Admin / Admin." Two words you never want to find hardcoded in production firmware. 😱 SRT researcher @daemon_user gives a full technical write-up on how a simple directory listing can lead to the keys to the kingdom: synack.com/exploits-expla…

Is your checkout logic costing you? 💸 In our Exploits Explained blog, SRT member Tubagus Fahrudiansyah exposes a critical business logic flaw that turned a standard checkout into a free-for-all. By exploiting a synchronization gap between the payment gateway and the shopping cart, this researcher successfully finalized high-value orders for the price of a single, cheap item. Read the full breakdown & remediation steps: synack.com/exploits-expla…

DEF CON is less than two weeks away! ⚡ We're a proud sponsor of this year's Bug Bounty Village 🐞, where you can expect to meet many of the world's top ethical hackers. Best of all, they'll be sharing their #cybersecurity insights. Hope to see you there: hubs.ly/Q03yVBGT0

Synack Red Team member Yeasir “zy1l0i2u” Arafat discovered a cross-site scripting vulnerability in SAP Concur Open that could be exploited to hijack sessions, exfiltrate data and more. Follow along as he walks us through his discovery of this vuln → hubs.ly/Q03jWHCS0

💭 It all started during an assessment of a web application. In the latest Exploits Explained, Synack Red Team member "nerrorsec" recounts the discovery of a DOM-based XSS vulnerability that was patched…and then found in another product from the same company a year later. Interested in reading more? Follow along → hubs.ly/Q03gXrdc0 #cybersecurity #pentesting #infosec

👀 Synack Red Team member Busra (@turakbusra) walks us through her discovery of an access control violation vulnerability that led to account takeover. Follow along → hubs.ly/Q03fZ7fR0

🪖 From military to private sector cybersecurity, Synack Director of Infrastructure and Security Operations Todd Humes brought his unique skill set to the table when he joined the team in 2018 to further strengthen Synack’s systems globally. The innovative vision behind Synack and the vision of aligning the power of highly skilled and vetted researchers on a single platform deeply resonated with him. Why should veterans with cybersecurity experience consider joining the Synack Red Team (SRT)? Read on → hubs.ly/Q037gv0p0 Apply to the SRT today → hubs.ly/Q037gjM00

👾 The OWASP Foundation introduced a new version of the OWASP Top 10 for Large Language Model Apps. While there’s no one-size-fits-all solution for security, having the @SynackRedTeam on your side certainly helps. Read on → hubs.ly/Q035Nx3f0.

💭 Default credentials are a thing of the past, right? Wrong. Follow along as Popeax, a Synack Red Team member, explains why they still plague organizations today and how the Synack Platform can help discover these vulnerabilities in ways that cannot be replicated by scanner or automated solutions. Check out this previous Exploits Explained here → hubs.ly/Q034vNWv0

☃️ Synack wishes you and yours a wonderful holiday season filled with festive cheer, loved ones, family and friends! We’re proud to keep our customers secure this season as people unwind, relax and ring in the new year. Happy holidays!

Happy Thanksgiving! Whether you’re gathering with loved ones, friends or family, we hope your holiday is filled with fantastic food and memories. At Synack, we’re thankful for all of our incredible employees, customers, partners, Synack Red Team and more.

👀 SRT member William W. (@phyr3wall) discusses his discovery of a notable problem in a chatbot deployed on a platform associated with a large healthcare insurance company. Read on for an in-depth analysis of the techniques used to uncover this vuln → hubs.ly/Q02YMj1s0

👩🏽‍💻 The Synack Red Team’s very own Jennifer Villarreal joined the latest installment of the WE’RE IN! podcast, sharing her personal journey into the world of ethical hacking. Give it a listen → hubs.ly/Q02QBvr-0

Adiós, Las Vegas! We had a blast this past week. Don’t forget to check out the Synack Red Team for part-time hacking opportunities. We also have several SRT Pathways that can speed up the application process. 👀 To learn more, click here → hubs.ly/Q02KTWhs0

👀 Don't miss out! Swing by Creator Stage 4 at 2:00 p.m. at @BugBountyDEFCON

Learn from a full-time bug bounty hunter, with tips, tricks and real-world examples. "Reflections on a Decade in Bug Bounties: Experiences and Major Takeaways" by Nikhil Shrivastava (@niksthehacker) and Charlie Waterhouse! 📅 Friday, Aug 9 ⏰ 5 PM 📍 Creator Stage 4

Uncover corporate banking vulnerabilities at #DefCon! 🚨🔍 See how researchers hacked global banking systems & found critical flaws. Perfect for #securityprofessionals, #researchers and #redteam experts. 📅 Aug 9, 12:30 PM 📍 AppSec Village 🔗 hubs.ly/Q02K8wr-0