Synacktiv
@synacktiv.com
Offensive security company. Dojo of many ninjas. Red teaming, reverse engineering, vuln research, dev of security tools and incident response.
Register for our Active Directory Intrusion Tactics: Advanced Level training with @wilfri3d.bsky.social and @rustyphasm.bsky.social at #Nullcon Berlin, from 2-4 Nov 2026 📚 Learn real-world AD attack paths, lateral movement, and defence strategies ⬇️ nullcon.net/training/act...
Interested in old video game vulnerabilities? 🎮 Checkout our latest blogpost on Titan Quest : Anniversary Edition by @tomtombinary.bsky.social ⬇️ www.synacktiv.com/en/publicati...
Exploiting Titan Quest
Exploiting Titan Quest
synacktiv.com
Compliance is no longer enough. Technical evidence is what matters. How can you prove your security measures are actually effective? Discover how #Synacktiv helps organisations move beyond compliance with evidence-based security assessments ⬇️ www.synacktiv.com/en/publicati...
Completing Compliance with Evidence : A Bottom-Up Approach to NIS2,
Completing Compliance with Evidence : A Bottom-Up Approach to NIS2,
synacktiv.com
Synacktiv recrute de nouveaux profils Red Teamer H/F 🥷 🎯 Exercices Red Team (AD, Cloud...), Lab & Furtivité, 0-Day 👤 3+ ans d'expérience 📍 6 bureaux en France ou 100% remote 📩 apply+pentest@synacktiv.com 🔗 www.synacktiv.com/red-teamer
After MySQL, it's now SQL Server's turn. noraj takes a deep dive into Unicode-related security issues. 📚 Read the full article: www.synacktiv.com/en/publicati...
The SQL Server Unicode problem: why your data might not be what you
The SQL Server Unicode problem: why your data might not be what you
synacktiv.com
🔒 #Recrutement | @synacktiv.com recherche un(e) Officier de Sécurité à Paris. Vous souhaitez contribuer à la protection de l'information au sein d'une société d'expertise en cybersécurité ? 👉 Postulez dès maintenant : www.synacktiv.com/officier-sec...
During an internal assessment, our expert found several vulnerabilities in #Xpra (Screen for X11) which, chained together, allow a malicious server to gain RCE on the client. Update your packages! ⬇️ www.synacktiv.com/en/advisorie...
Multiple vulnerabilities in the Xpra client
Multiple vulnerabilities in the Xpra client
synacktiv.com
Tu aimes chercher des failles et passer ton temps sur de la technique et de la R&D ? L'équipe Pentest de @synacktiv.com recrute. 📍 Paris, Rennes, Toulouse, Lille, Lyon, Bordeaux (+ télétravail pour profils expérimentés) Je postule 📝 www.synacktiv.com/pentester-di...
🚀 Le pôle Reverse de @synacktiv.com recrute ! Vous poncez les CTF ? Vous aimez la R&D et vous souhaitez évoluer aux côtés d'experts reconnus dans le domaine ? Rejoignez-nous ! 📍 Paris, Rennes, Toulouse, Lille, Bordeaux, Lyon ou full remote (France). 👉 www.synacktiv.com/recherche-et...
Who said KYC is not fun? Discover how @kevintell.bsky.social and @log-s.bsky.social exploited new #AI techniques to bypass Age Verification and how this technology reshuffles the deck ⬇️ www.synacktiv.com/en/publicati...
Back from @passthesaltcon.bsky.social 🧂 Our team presented: 💥 Livewire RCE (CVE-2025-54068) – @remsio.bsky.social, alongside Worty 🔍 Dicozorus for smarter web fuzzing – us3r777 💥 BadUSB Forensics – acervoise Tools 👇 github.com/synacktiv/Li... github.com/synacktiv/di...
A huge thank you to everyone who stopped by our stand at @le-hack.bsky.social ! Congrats to everyone who took on our challenge 🎯 Missed it? It's now available on our #GitHub, along with the write up: github.com/synacktiv/le... See you next year 🚀
#RBCD attacks in Impacket have been extended across an arbitrary number of domains! 🚀 Discover how to impersonate arbitrary identities through complex #ActiveDirectory forest trusts, including SPN-less exploitation. 📚 www.synacktiv.com/en/publicati... 🔨 github.com/synacktiv/im...
Exploring cross-domain & cross-forest RBCD: part 2
Exploring cross-domain & cross-forest RBCD: part 2
synacktiv.com
A month ago we pointed our local LLM at #FreeBSD and it helped us find a local root exploit plus an ASLR bypass on SUID binaries to go with it 🚨 Both now patched (CVE-2026-49415 & CVE-2026-49414). Update your boxes! ➡️ www.freebsd.org/security/adv... ➡️ www.freebsd.org/security/adv...
CI/CD pwnage with a pre-auth RCE in #ArgoCD by @rustyphasm.bsky.social 💥 Discover how a single misconfiguration in a Helm chart can lead to a full cluster compromise sprinkled with some CodeQL shenanigans! 🥷 www.synacktiv.com/en/publicati...
Caught in the Octopus Trap: Unauthenticated RCE in Argo CD with CodeQL
Caught in the Octopus Trap: Unauthenticated RCE in Argo CD with CodeQL
synacktiv.com
"We're compliant." But can you prove it? With #NIS2, #DORA and the #CRA, compliance is no longer just about documentation. Organisations must demonstrate that their security measures actually work. Learn how technical evidence strengthens compliance 👇 www.synacktiv.com/en/publicati...
Completing Compliance with Evidence : A Bottom-Up Approach to NIS2,
Completing Compliance with Evidence : A Bottom-Up Approach to NIS2,
synacktiv.com
🚨 The #Entrypoint2027 Call For Papers is now open! Have original offensive security research to share? New techniques, tools, or attack stories ? We want to hear from you. 📅 CFP closes: Sept 20, 2026. Our review board will be revealed soon. 👉 cfp.entrypoint.fr/entrypoint-2...
📚 Kindle research, exploitation methodology, and jailbreak development. Missed @le-hack.bsky.social? SidewayRE's talk, "Bootstrapping Kindle Research for the Lazy Attacker", is now available. Read the slides 👇 www.synacktiv.com/sites/defaul...
Using #Helm and #Kubernetes in your CI/CD pipeline? An attacker only needs access to the values.yaml file to compromise your cluster. Recent research by Paul BARBE details a new injection technique to escalate privileges and deploy unauthorized resources ⬇️ www.synacktiv.com/en/publicati...
Charting your way in: Helm template injection
Charting your way in: Helm template injection
synacktiv.com
🚀 @le-hack.bsky.social starts today! Come meet the #Synacktiv team at stand 22 and try the challenge we designed for the event: puzzles to solve, secrets to find, and flags to capture 🔒 See you there 👋
Kernel LPEs dropping before patches are widely available? It's been a wild month for Linux defenders. Our CIO breaks down how tried-and-true hardening measures can raise the bar and buy your Blue Team time against N-days. 🔗 www.synacktiv.com/en/publicati...
Surviving the surge of new Linux LPE : Defense in Depth not dead
Surviving the surge of new Linux LPE : Defense in Depth not dead
synacktiv.com
⏳ 7 days to go until #LeHack ! On 26-27 June, visit #Synacktiv and take on a challenge designed especially for the event 🔒 Gain access, uncover secrets and solve puzzles. Can you capture every flag before time runs out? ⏱️ 📍 Stand 22 Who’s up for the challenge? 👀
Working with #AWS and looking to improve visibility across your #cloud environment? This article introduces the key AWS security and logging services to help strengthen your detection, investigation and incident response capabilities ⬇️ www.synacktiv.com/en/publicati...
AWS Forensics : What you need to know
AWS Forensics : What you need to know
synacktiv.com
🇵🇱 At #x33fcon, our experts unveiled new offensive DCOM techniques, including a COMouflage variant enabling arbitrary executable execution and a fileless lateral movement method based on .NET deserialisation. DCOMIllusionist is now available: 🔗 github.com/synacktiv/DC...
Another excellent edition of #SSTIC2026 🎉 Several #Synacktiv consultants were proud to present their research and exchange ideas with the cybersecurity community. Congratulations to all our speakers! Find all presentations here: www.sstic.org/2026/program...
🚀 Training week is underway at #x33fcon! Our consultants are delivering: 🔐 Azure Intrusion Tactics 🖥️ Advanced Active Directory Red Teaming Three days of hands-on labs, realistic attack scenarios, and offensive security techniques. Great to see so many participants joining us!
🔒 Think you can crack them all? Join #Synacktiv at @le-hack.bsky.social and take on a challenge at our stand, crafted by @niozow.bsky.social 🚀 One laptop. Multiple flags. Encrypted safes. Break in, unlock everything, and recover every secret before time runs out ⏱️💻 See you at stand 22!
🚗🔌 #Tesla patched our #Pwn2Own Automotive 2025 Wall Connector exploit with an anti-downgrade mechanism. #Synacktiv experts bypassed it and replayed the same attack through the charging cable. Part 2 write-up 👇 www.synacktiv.com/en/publicati...
Exploiting the Tesla Wall Connector from its charge port connector -
Exploiting the Tesla Wall Connector from its charge port connector -
synacktiv.com
Back from #THCON 2026 🔥 Proud to see our teams share their latest offensive security research once again this year: 📡 Wi-Fi pentesting in 2025 & WPA3 bypasses - Quentin 🛡️ Cross-domain & cross-forest RBCD - Simon 🏴 THCON pre-challenge write-up - @0xf4b.bsky.social Great work everyone 👏
Make it blink! Our latest article explains how @mtalbi.bsky.social & Matthieu achieved an over-the-air exploitation of the #PhilipsHue Bridge via a #Zigbee flaw. Includes technical details and their #Pwn2Own Cork 2025 demo 👇 www.synacktiv.com/en/publicati...
Make it Blink: Over-the-Air Exploitation of the Philips Hue Bridge
Make it Blink: Over-the-Air Exploitation of the Philips Hue Bridge
synacktiv.com