@Zeroedtech

Just a guy that talks at conferences sometimes

Joined July 2019
  • Tweets60
  • Following85
  • Followers329
14Media
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
We’ve released an in-depth analysis of SharpViewStateKing – a stealthy implant framework that blends into normal web traffic to evade detection. Learn what to look for and how to defend against it: cyber.gc.ca/en/news-events/s…
2
3
616
If you're attending #BSidesMelb2026 this weekend, there's still a handful of tickets available for my Friday training session "Attacking and Defending Microsoft IIS" bsidesmelbourne.com/2026-tra… Come and learn how to write and detect web shells, there's something for everyone
1
80
A slightly scary commit, on the plus side, my .NET profiler is a million times easier to extend now
1
81
If you're attending #BSidesMelb2026 and have an interest in IIS security, I'll be running training the day before bsidesmelbourne.com/2026-tra… Come and learn how to write and detect web shells, there's something for everyone
1
71
Success! After hours of debugging, I found that removing runat="server" from the outer most element of the CVE-2025-49704 payload generated by YSoNet fixed it. Every in the wild sample I've seen has this field set so I'm pretty confused now. @irsdl any idea why this might be?
1
2
294
Has anyone managed to exploit any of the SharePoint ToolPane CVE's on a freshly installed server? I'm testing out a CVE-2025-49704 payload generated with YSo.NET against 16.0.10417.20018 in my lab and whilst the auth bypass works, the payloads fail to deserialise
1
1
429
I’ve recently done a deep dive into how IIS view state machine keys are generated and how they are used to decrypt view state messages. I’ve written up my findings in a new blog post and developed an application to assist with the decryption of view states zeroed.tech/blog/decrypting-…

Decrypting View State Messages

Investigating how IIS machine keys are generated and how to decrypt a view state.

zeroed.tech
7
1
14
1,340
...so yes
109
Not the response I want when I resort to AI to debug some mutual TLS issues
112
Replying to @irsdl @BSidesLondon
I'd be very keen, viewstate exploration is a massive issue these days but getting people to under the issue is a nightmare
1
252
Replying to @BertJanCyber
I suspect this will follow the same route as the recent SharePoint vulns, adversaries will start simple with basic subprocesses execution but within a few days we'll have malicious .NET assemblies being reflectively loaded
1
243
I've recently been experimenting with using .NET profilers to hook .NET functions under IIS and decided to write up a blog post while it was fresh in my mind zeroed.tech/blog/hooking-net…

Hooking .NET Functions with Profilers

How can we use .NET's profiling interface to gain improved visibility of functions commonly used by web shells?

zeroed.tech
1
31
101
9,861
TOLLBOOTH: What's yours, IIS mine elastic.co/security-labs/tol…

TOLLBOOTH: What's yours, IIS mine

REF3927 abuses publicly disclosed ASP.NET machine keys to compromise IIS servers and deploy TOLLBOOTH SEO cloaking modules globally.

elastic.co
3
7
2,280
12 months ago I presented a 3 hour course on attacking and defending Microsoft IIS servers to a packed room at BSides Canberra, today the 30+ hour version went live on @XintraOrg !
inversecos
@inversecos14 Oct 2025
New XINTRA course‼️ Advanced IIS Post Exploitation, Detection & Evasion Modern APT groups are actively weaponizing ToolShell and fileless IIS tradecraft to compromise Exchange, SharePoint, ASP workloads. If your detection and response capabilities lag exposure, this course bridges the gap with: - Memory dump analysis (Windbg) - Deserialisation exploits & detections - ViewState attacks - .NET Reflection - Deobfuscation techniques Syllabus and preview videos here👇 xintra.org/courses/9-advance… @XintraOrg
3
14
1,757
Replying to @lucho_in_Oz
The weekend
1
29
Replying to @irsdl @0xTib3rius @TheRealC3rul34n
You don't like waiting 5 mins for the installer to launch, just to tell you you're missing a dependency?
2
71
Not a bad read, I think they may be overanalysing a compiled webshell and its a shame they didn't get a memory dump but its great to see more companies talking about this stuff github.com/RedDrip7/NightEag…

NightEagle_Disclose/Exclusive disclosure of the attack activities of the APT group NightEagle.pdf...

Share threat intelligence and detect tools about APT "NightEgle" (APT-Q-95) - RedDrip7/NightEagle_Disclose

github.com
3
324
Replying to @vinopaljiri
Nice, I've always assumed these timestamps had just been tampered with
1
40
After a bit more digging it look like its referenced in Microsoft.JScript, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a but not Microsoft.JScript, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a The later of which is used by my IIS
1
195
For years I've seen adversaries using the "unsafe" keyword in their JScript eval shells and assumed it was required to eval complex statements (i.e code), but after trying to work out what it actually does for some training I'm working on I found it does nothing! Its unreferenced
1
1
264
Load more