On the good days in security research, you get to channel equal parts Archimedes and Ric Ocasek in your successes. The pieces all come together as expected, the hunches turn into reality, everything just works. And you should, of course, celebrate those moments of eureka and magic that went into your discovery, since your newest exploit is often your favorite exploit. Though there's the rub -- your favorite exploit may forever be the one that you haven't found yet. The perennial next one.
But this post isn't about successes in security research; it's about the failures. If you're lucky, failure comes quickly. A guess or a "what about..." falls apart and is disproven in minutes and not hours (or longer). Plus every failure is an opportunity to use what you've learned about an application or a protocol or whatever in the future. The work that goes into ten dead ends from poring over source code or RFCs can lead to a much better understanding of the overall system. And those failures might lead you to something that you otherwise wouldn't have found or wouldn't have thought about. Something real. But not today.
Today we'll be looking at some ColdFusion vulnerability research that was interesting and promising at first look, but ultimately wasn't exploitable in the way I had hoped.