Logo
Picture

Zeroed @Zeroedtech

Just a guy that talks at conferences sometimes Joined July 2019
  • Tweets
    59
  • Followers
    326
  • Following
    84
  • Likes
    25
Zeroedtech Profile Picture

Zeroed @Zeroedtech

4 weeks ago

If you're attending #BSidesMelb2026 this weekend, there's still a handful of tickets available for my Friday training session "Attacking and Defending Microsoft IIS" bsidesmelbourne.com/2026-training-… Come and learn how to write and detect web shells, there's something for everyone

Zeroedtech Profile Picture

Zeroed @Zeroedtech

2 months ago

A slightly scary commit, on the plus side, my .NET profiler is a million times easier to extend now

Zeroedtech Profile Picture

Zeroed @Zeroedtech

2 months ago

If you're attending #BSidesMelb2026 and have an interest in IIS security, I'll be running training the day before bsidesmelbourne.com/2026-training-… Come and learn how to write and detect web shells, there's something for everyone

Zeroedtech Profile Picture

Zeroed @Zeroedtech

2 months ago

Success! After hours of debugging, I found that removing runat="server" from the outer most element of the CVE-2025-49704 payload generated by YSoNet fixed it. Every in the wild sample I've seen has this field set so I'm pretty confused now. @irsdl any idea why this might be?

Zeroedtech Profile Picture

Zeroed @Zeroedtech

2 months ago

Has anyone managed to exploit any of the SharePoint ToolPane CVE's on a freshly installed server? I'm testing out a CVE-2025-49704 payload generated with YSo.NET against 16.0.10417.20018 in my lab and whilst the auth bypass works, the payloads fail to deserialise

Zeroedtech Profile Picture

Zeroed @Zeroedtech

4 months ago

I’ve recently done a deep dive into how IIS view state machine keys are generated and how they are used to decrypt view state messages. I’ve written up my findings in a new blog post and developed an application to assist with the decryption of view states zeroed.tech/blog/decryptin…

Zeroedtech Profile Picture

Zeroed @Zeroedtech

6 months ago

...so yes

Zeroedtech Profile Picture

Zeroed @Zeroedtech

6 months ago

Not the response I want when I resort to AI to debug some mutual TLS issues

Zeroedtech Profile Picture

Zeroed @Zeroedtech

7 months ago

@irsdl @BSidesLondon I'd be very keen, viewstate exploration is a massive issue these days but getting people to under the issue is a nightmare

Zeroedtech Profile Picture

Zeroed @Zeroedtech

7 months ago

@BertJanCyber I suspect this will follow the same route as the recent SharePoint vulns, adversaries will start simple with basic subprocesses execution but within a few days we'll have malicious .NET assemblies being reflectively loaded

Zeroedtech Profile Picture

Zeroed @Zeroedtech

7 months ago

I've recently been experimenting with using .NET profilers to hook .NET functions under IIS and decided to write up a blog post while it was fresh in my mind zeroed.tech/blog/hooking-n…

Zeroed retweeted
Dinosn Profile Picture

Nicolas Krassas @Dinosn

8 months ago

TOLLBOOTH: What's yours, IIS mine elastic.co/security-labs/…

Zeroedtech Profile Picture

Zeroed @Zeroedtech

8 months ago

12 months ago I presented a 3 hour course on attacking and defending Microsoft IIS servers to a packed room at BSides Canberra, today the 30+ hour version went live on @XintraOrg !

inversecos Profile Picture

inversecos @inversecos

8 months ago

New XINTRA course‼️ Advanced IIS Post Exploitation, Detection & Evasion Modern APT groups are actively weaponizing ToolShell and fileless IIS tradecraft to compromise Exchange, SharePoint, ASP workloads. If your detection and response capabilities lag exposure, this course

Zeroedtech Profile Picture

Zeroed @Zeroedtech

10 months ago

@lucho_in_Oz The weekend

Zeroedtech Profile Picture

Zeroed @Zeroedtech

10 months ago

@irsdl @0xTib3rius @TheRealC3rul34n You don't like waiting 5 mins for the installer to launch, just to tell you you're missing a dependency?

Zeroedtech Profile Picture

Zeroed @Zeroedtech

11 months ago

Not a bad read, I think they may be overanalysing a compiled webshell and its a shame they didn't get a memory dump but its great to see more companies talking about this stuff github.com/RedDrip7/Night…

Zeroedtech Profile Picture

Zeroed @Zeroedtech

a year ago

@vinopaljiri Nice, I've always assumed these timestamps had just been tampered with

Zeroedtech Profile Picture

Zeroed @Zeroedtech

a year ago

After a bit more digging it look like its referenced in Microsoft.JScript, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a but not Microsoft.JScript, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a The later of which is used by my IIS

Zeroedtech Profile Picture

Zeroed @Zeroedtech

a year ago

For years I've seen adversaries using the "unsafe" keyword in their JScript eval shells and assumed it was required to eval complex statements (i.e code), but after trying to work out what it actually does for some training I'm working on I found it does nothing! Its unreferenced

Zeroedtech Profile Picture

Zeroed @Zeroedtech

a year ago

@AlienPacket @DebugPrivilege Sometimes you just don't care, as long as you achieve your objective, does it really matter that the blue team knows how you did it? A lot of the c# malware I look at does very little to hide what it's doing

Trends for United States

Larkin
Yzerman
$SPIN
Karmelo
Cardi
Bolton
Bello
Wash
#vibragame
Ivory Coast
#LGRW
Red Wings
TADC
Hunter Biden
Latto
Down Syndrome
Summerlin
Earthquake in Vegas
Coal
55 Chevy

You might like

24-26th September 2026
BSidesCanberra
@BSidesCbr
4K Followers
Digital forensics & incident response #DFIR + #CTI | Horse and Dog mum | Co-host @ComfyConAU | @torincybergroup | RB/SCP for @BlackHatEvents & @BSidesMelbourne
Shanna Niggans 🦄
@fancy_4n6
4K Followers
I use data to hunt down fraudsters and insider threats. Here for all the *sec, data science, and equality.
J͓̽e͓̽s͓̽s͓̽ ...
@printfJess
2K Followers
Full Spectrum Degraded Cyber Intrusion Disruption Cartographer (/s)
🔥
@0x706972686f
57 Followers
Security consultant | @BlackHatEvents @BSidesCbr @BSidesSG @OWASPMelbourne Review Boards | @SDR_Melbourne | VK3HXX |@haXX_group | @sheasecurity🖖📚☕️
Pam O’Shea
@pamoshea
3K Followers
Ex-(NSW)cop, SES road rescue, RFS. Security/forensics/electronics/stuff. Views strictly my own (or my wifes).
old hack
@gudnotevl
235 Followers
Geekette | Übernerd | Mental health hacker | DFIR/OSINTforGood practitioner | Foodie | Public speaker | Tweets are my own.
Gyle 🌻🇵🇭🇦...
@GyledC
2K Followers
Breaking computers one by one. Focus on offensive security development and research.
Henri Nurmi
@HenriNurmi
2K Followers
Founder & organiser of Au hackercon @BSidesCbr | Tech startup founder @infosectcbr | Network Engineering & Infosec Researcher
Kylie McDevitt
@kylieengineer
5K Followers
co-founder/CEO @Assetnote. Organiser of @sectalks_BNE & @tuskcon. @mwg@infosec.exchange
Michael Gianarakis
@mgianarakis
2K Followers
I'm a software developer who enjoys pulling apart old software for fun. Tweets are my own.
Ben Stone
@BenStoneOnline
92 Followers
Did a Cybersecurity Bachelor and Master in Computer Science with a focus on Security. Deputy Manager - Cloud Threat Intelligence Opinion/Thoughts are my own.
Sebastian Walla
@SebastianWalla
212 Followers
Cybersecurity | DFIR | CSIRT/SOC Specialist | IR Coordinator at Cybolt
gabi ratti
@gabriratti
474 Followers
✝️🧦🇦🇺🇲🇾 🐧🏗 | on the better site 🦋 @andrew.donnellan.id.au | @GreaterCanberra | @AbundantHNA
Andrew Donnellan
@ajdlinux
1K Followers