Bojan Zdrnja

@bojanz

IT Security guy, penetration testing is my thing. One of the SANS Internet Storm Center handlers at isc.sans.org. SANS SEC542 instructor and course co-author.

Croatia infigo.hr Joined February 2009

683 Following 4.3K Followers 2.1K Posts

Latest posts 5

Pinned post

Bojan Zdrnja @bojanz Mar 6, 2024

quicmap - QUIC service scanner released by my colleague Fran and myself last week is live. Get it at github.com/bojanisc/quicm… and also make sure you read the @sans_isc diary I wrote about QUIC services at isc.sans.edu/diary//30720

Enjoy!

github.com GitHub - bojanisc/quicmap: quicmap is a simple yet quic (!) QUIC protocol scanner quicmap is a simple yet quic (!) QUIC protocol scanner - bojanisc/quicmap

Bojan Zdrnja @bojanz Oct 23

After a long time, wrote a bit about how I think it's difficult to get a reliable #php2shell exploit. There's probably a lot I missed - but it looks difficult to me.

More available at @sans_isc

isc.sans.edu/forums/diary/%…

isc.sans.edu (Reliable)? php2shell exploitability - SANS ISC (Reliable)? php2shell exploitability, Author: Bojan Zdrnja

Bojan Zdrnja @bojanz Aug 5, 2025

Ooh finally a new diary. This time about why attackers wanted to steal Machine Keys in #SharePoint attacks 2 weeks ago. Read all the details about IIS and Machine Keys in my latest diary at isc.sans.edu/diary/Stealing…

isc.sans.edu Stealing Machine Keys for fun and profit (or riding the SharePoint wave) Stealing Machine Keys for fun and profit (or riding the SharePoint wave), Author: Bojan Zdrnja

Bojan Zdrnja @bojanz Dec 2, 2024

New diary: how Credential Guard prevented extraction of TGT from a service ticket by abusing Benjamin Deply's trick and why you should aim to enable it everywhere.

Read the @sans_isc diary at isc.sans.edu/diary/Credenti…

isc.sans.edu Credential Guard and Kerberos delegation - SANS ISC Credential Guard and Kerberos delegation, Author: Bojan Zdrnja

Bojan Zdrnja @bojanz Nov 4, 2024

Interesting how signature matching in Microsoft Defender is so sensitive regarding anything related to keyword "defender". So while bypassing such detection is tedious and annoying, it can still be done quite easily, as shown below.