Just a guy that talks at conferences sometimes
Joined July 2019
- Tweets60
- Following85
- Followers329
- Likes26
Zeroed retweeted
We’ve released an in-depth analysis of SharpViewStateKing – a stealthy implant framework that blends into normal web traffic to evade detection.
Learn what to look for and how to defend against it: cyber.gc.ca/en/news-events/s…
If you're attending #BSidesMelb2026 this weekend, there's still a handful of tickets available for my Friday training session "Attacking and Defending Microsoft IIS" bsidesmelbourne.com/2026-tra… Come and learn how to write and detect web shells, there's something for everyone
If you're attending #BSidesMelb2026 and have an interest in IIS security, I'll be running training the day before bsidesmelbourne.com/2026-tra…
Come and learn how to write and detect web shells, there's something for everyone
I’ve recently done a deep dive into how IIS view state machine keys are generated and how they are used to decrypt view state messages. I’ve written up my findings in a new blog post and developed an application to assist with the decryption of view states
zeroed.tech/blog/decrypting-…
I've recently been experimenting with using .NET profilers to hook .NET functions under IIS and decided to write up a blog post while it was fresh in my mind zeroed.tech/blog/hooking-net…
Zeroed retweeted
TOLLBOOTH: What's yours, IIS mine elastic.co/security-labs/tol…
12 months ago I presented a 3 hour course on attacking and defending Microsoft IIS servers to a packed room at BSides Canberra, today the 30+ hour version went live on @XintraOrg !
New XINTRA course‼️
Advanced IIS Post Exploitation, Detection & Evasion
Modern APT groups are actively weaponizing ToolShell and fileless IIS tradecraft to compromise Exchange, SharePoint, ASP workloads.
If your detection and response capabilities lag exposure, this course bridges the gap with:
- Memory dump analysis (Windbg)
- Deserialisation exploits & detections
- ViewState attacks
- .NET Reflection
- Deobfuscation techniques
Syllabus and preview videos here👇
xintra.org/courses/9-advance…
@XintraOrg
Not a bad read, I think they may be overanalysing a compiled webshell and its a shame they didn't get a memory dump but its great to see more companies talking about this stuff
github.com/RedDrip7/NightEag…
For years I've seen adversaries using the "unsafe" keyword in their JScript eval shells and assumed it was required to eval complex statements (i.e code), but after trying to work out what it actually does for some training I'm working on I found it does nothing! Its unreferenced
It put my life on hold for a month and I'm very sleep deprived but thanks for the great CTF @HuntressLabs @_JohnHammond @HuskyHacksMK @_BensonBoy23 @sudo_Rem @IzzyBoopFPV @Kaspertame #HuntressCTF
Thank you to everyone who attended my training session and a massive thanks to @BSidesCbr for providing me the opportunity to run it. The slides and any code we used can be found here zeroed.tech/blog/bsides-2024…
I'd love any feedback on the session
For those planing to attend my "Attacking and Defending Microsoft IIS" training session at @BSidesCbr next week, checkout the following post for the list of recommended software to have reaady to go zeroed.tech/blog/bsides-2024…
See you all Friday
Defender seems interested in my upcoming BSides Canberra training on Attacking and Defending Microsoft IIS Training
I'll be running a free 3 hour training session at @BSidesCbr teaching people how to defend IIS servers by learning how to attack them.
I'll be posting recommended host setups closer to the event so be sure to give me a follow.
cfp.bsidescbr.com.au/bsides-…