> NeffIsBack~/nxc/ NetExec spider mark

Alexander Neff

Penetration tester focused on Active Directory security and a maintainer of NetExec. I build open-source tools and share security research.

Contact

Writing

ESC17 16 min read

Using ADCS to Attack HTTPS-Enabled WSUS Clients

Introducing ESC17: how ADCS certificate templates can expose HTTPS-enabled WSUS clients to attack.

Read the article
All articles

Projects

5,940 NetExec The Network Execution Tool. Part of the maintainer team. 415 wsuks Automating attacks on Windows Server Update Services. 141 EVENmonitor Monitor Windows Event Logs remotely with flexible event filtering. 128 Onelogon Code and data for our paper "Onelogon: Taking over Active Directory Accounts via Netlogon" (WOOT’26).

Featured talk

ESC17: Using ADCS to Attack HTTPS-Enabled WSUS Clients Watch on YouTube ↗

Publications & Talks

  1. Talk · hack.lu 2026

    ESC17: Using ADCS to Attack HTTPS-Enabled WSUS Clients

    Alexander Neff

  2. Paper · USENIX WOOT26

    Onelogon: Taking over Active Directory Accounts via Netlogon

    Alexander Neff, Tobias Holl, Kevin Borgolte

  3. Talk · TROOPERS26

    ESC17: Using ADCS to Attack HTTPS-Enabled WSUS Clients

    Alexander Neff, Phil Knüfer

  4. Thesis · Master's thesis · Ruhr University Bochum

    Analyzing the Security of the Netlogon Remote Protocol

    Alexander Neff

  5. Podcast · Secure After Dark · Alias Cybersecurity

    Episode 14: Rewriting Pentesting — Netexec's Developer Insights

    Tanner Shinn (host), Alex, Thomas

All publications & talks