Joined June 2023
- Tweets 125
- Following 25
- Followers 242
- Likes 71
29 Photos and videos
25 Jun 2025
#NauthNRPC is a tool that can help you enumerate computer / user accounts anonymously in #ActiveDirectory via DsrGetDcNameEx2 RPC calls.
This is not often in most environments, so used could be blocked via #RPCFirewall.
Nice job by @haider_kabibo šš
hubs.li/Q03tvVVY0
8
28
3,866
Zero Labs retweeted
18 Jun 2025
My thoughts about CVE-2025-33073, and on how to prevent #NTLM / #Kerberos relay attacks in general using #RPCFirewall & #LDAPFirewall
zeronetworks.com/blog/examinā¦
6
10
960
12 Jun 2025
12 Jun 2025
Are you sure you can enumerate all of your #Azure resources? You may be missing some out.
#MapAz is a new #PowerShell Module that (among other things) can help you enumerate hidden resources.
Read more in my latest post:
zeronetworks.com/blog/discovā¦
1
2
206
11 Jun 2025
Excellent writeup by @cybergentix on #WMI #LateralMovement
Didn't mention mitigation via #RPCFirewall, which could be achieved by blocking remote #DCOM operations
blog.fndsec.net/2024/09/11/wā¦
1
34
128
6,505
Zero Labs retweeted
8 Jun 2025
ADCS ā¦ often exploited, rarely mentioned
8 Jun 2025
ADCS Cheat Sheet, by @pentest_swissky
swisskyrepo.github.io/Internā¦
2
12
82
11,965
3 Jun 2025
Read @dekel_paz excellent writeup on #badsuccessor #LDAP vulnerability, and how to mitigate with the #LDAPFirwall
3 Jun 2025
BadSuccessor is a slick AD privilege escalation that uses LDAP to take over user accounts
ā¦and the LDAP Firewall can already block it ā no updates needed.
How the attack works how to block it:
š zeronetworks.com/blog/stoppiā¦
3
160
28 May 2025
Yes, LDAP enumeration is still a thing in 2025.
2ns.fi/en/ldap-enumeration-iā¦
1
18
86
4,872
26 May 2025
A new open source tool to visualize #LDAP data ovre #Neo4j graph database: #Neo4LDAP by @_kripteria !
And, you can inject data directly from #BloodHound š
Check it out here:
github.com/Krypteria/Neo4LDAā¦
1
18
88
7,946
15 May 2025
CVE-2025-29969 is an RPC #RemoteCodeExecution vulnerability, base score 7.5.
Exploits a time-of-check time-of-use & affects Windows vers 2025, 2022, 2019, 2016, 2012 R2, 2012, 2008 R2 SP1, 2008 SP2; Win 11 22H2/23H2/24H2, Win 10 1607/1809/21H2/22H2.
msrc.microsoft.com/update-guā¦
488
Zero Labs retweeted
30 Apr 2025
Shields up! time to limit access to Telnet (TCP port 23) on internal network.
CC: @ZeroNetworks
30 Apr 2025
A critical vuln in Microsoftās Telnet Server - complete 0-click NTLM auth bypass
Most people laughed: āWho the hell still runs Telnet?ā
But a quick Shodan search shows over 2,000 exposed instances, most of them on Windows XP.
Hopefully, many are honeypots - hopefullyā¦
Internally though, itās a different story.
Ask your IT team or run a proper asset discovery - you might find Telnet quietly running on:
- Embedded devices
- Factory lines
- Legacy control systems
- Display systems in airports or hospitals
Iāve seen it before - and itās probably still out there.
(Shameless plug: our THOR scanners can still assess systems as old as Windows XP for signs of compromise.)
securityonline.info/0-click-ā¦
1
4
8
1,138
28 Apr 2025
A handy list of LDAP search filters used by common enumeration tools, compiled by @Unit42_Intel (@PaloAltoNtwks).
The best part? You can block all of them with our open-source #LDAPFW! š·
Full article: unit42.paloaltonetworks.com/ā¦
Get started: github.com/zeronetworks/ldapā¦
2
48
150
9,030
8 Apr 2025
Did you know that you can block DCOM via the #RPCFirewall?
Make sure you're protected against #RemoteMonologue #NTLM #Coersion !
github.com/zeronetworks/rpcfā¦
8 Apr 2025
RemoteMonologue - A Windows credential harvesting attack that leverages the Interactive User RunAs key and coerces NTLM authentications via DCOM. Remotely compromise users without moving laterally or touching LSASS.
Hope you enjoy the blog & tool drop š¤
ibm.com/think/x-force/remoteā¦
6
13
983
1 Apr 2025
This one checks a lot of #LateralMovement TTPs. Could have been nicely blocked by #LDAPFirewall & #RPCFirewall some #NetworkSegmentation
How #blackSuit #ransomware spread from first fake #zoom installer -> d3f@ckloader #IDAT #SectopRAT
thedfirreport.com/2025/03/31ā¦
31 Mar 2025
šNew report out today!š
Fake Zoom Ends in BlackSuit Ransomware
Analysis and reporting completed by @pigerlin, UC1 and @Miixxedup
Audio: Available on Spotify, Apple, YouTube and more!
thedfirreport.com/2025/03/31ā¦
2
7
668
Zero Labs retweeted
5 Feb 2025
Nice work by @YaronZi & @CrowdStrike promoting LDAP Security to detect suspicious LDAP activities.
crowdstrike.com/en-us/blog/iā¦
Maybe someone wants to slap an AI agent on their #LDAPFirewall for similar results? :)
github.com/zeronetworks/ldapā¦
3
65
218
15,267
29 Jan 2025
How to stop #LDAPNightmare / #LDAPBleed
CVE-2024-49112 & CVE-2024-49113
zeronetworks.com/blog/preempā¦
3
7
679
14 Jan 2025
When we first published "What the Filter" we never thought we would have more than a 100 downloads, let alone a thousand.
We're happy to see the community getting value with the latest version bypassing the 1000 mark ! š
powershellgallery.com/packagā¦
2
5
212
Zero Labs retweeted
31 Dec 2024
š2024 brought remarkable growth, new faces to #ZeroNation, and plenty of fun moments together šŖš¼š.
To our customers, partners, investors, and teamāthank you for an incredible year; hereās to a successful and inspiring 2025! š„
#ZeroNetworks #NewYear2025 #Cybersecurity #Gratitude
2
1
4
2,134
16 Dec 2024
Hi all!
We released a native version for WTF-WFP, supporting a limited number of operations. Especially good for those instances when you can't use #PowerShell module #NtObjectManager.
/bypass command will skip the entire layer of filters
github.com/zeronetworks/WTF-ā¦
2
3
215
Zero Labs retweeted
12 Dec 2024
Unauthenticated Remote Code Execution (RCE) on Domain Controllers (DC).
It does not get worse than that. Probably will be included in #ransomware campaigns.
Any technical analysis of CVE-2024-49112 published?
CC: @gentilkiwi @harmj0y @_wald0
16
177
638
146,942
10 Dec 2024
#ShadowHound by @yudasm_ evades EDRs by operating as a PS module & using a stealthy LDAP search query.
šØBlock it with our free #LDAPFirewall tool!
github.com/Friends-Security/ā¦
6
5
372