hunt-aspnet

What problem does it solve?

It helps you identify and validate high-impact ASP.NET security exposure—especially ViewState deserialization and related framework disclosures—so you can produce actionable bug bounty reports instead of guesswork.

Core Features & Use Cases

• ASP.NET stack and surface fingerprinting: Detects classic ASP.NET/Webforms indicators (headers, cookies, __VIEWSTATE presence, and version banners) to confirm the right attack surface.
• ViewState exploitable-surface triage: Determines whether ViewState is signed-only versus encrypted by checking __VIEWSTATEENCRYPTED and runs a parser-error differential to spot dual-entry-point anti-patterns.
• High-value endpoint discovery & validation: Checks trace.axd and elmah.axd exposure, enumerates WCF .svc metadata, and flags common misconfigurations (customErrors, request-validation gaps).
• Framework-specific pivots: Guides focused follow-ups for SharePoint farms, Telerik AXD handlers, and SafeControl-related reflection enumeration to complete the exploit chain.

Use case: You have a target URL for an unknown enterprise .NET application; you run this skill to confirm classic ASP.NET/Webforms presence, determine whether ViewState is signed-only, test for disclosure endpoints, and assemble a reproducible evidence chain for your report.

Quick Start

Use the hunt-aspnet skill on a target you can reach over the internet to generate an ASP.NET-specific hunting and triage report focused on ViewState and common disclosure endpoints.