Fingerprint ASP.NET surfaces and triage ViewState security properties.
npx skills add https://github.com/AKasem1/claude-bug-bounty --skill hunt-aspnet
Please help me install this Agent Skill. Skill: hunt-aspnet Source: https://github.com/AKasem1/claude-bug-bounty/tree/main/skills/hunt-aspnet Command: npx skills add https://github.com/AKasem1/claude-bug-bounty --skill hunt-aspnet
It helps you identify and validate high-impact ASP.NET security exposure—especially ViewState deserialization and related framework disclosures—so you can produce actionable bug bounty reports instead of guesswork.
Use case: You have a target URL for an unknown enterprise .NET application; you run this skill to confirm classic ASP.NET/Webforms presence, determine whether ViewState is signed-only, test for disclosure endpoints, and assemble a reproducible evidence chain for your report.
Use the hunt-aspnet skill on a target you can reach over the internet to generate an ASP.NET-specific hunting and triage report focused on ViewState and common disclosure endpoints.
High-intent search queries and answers about installing and using this skill.
To test ASP.NET ViewState for deserialization vulnerabilities, you need to fingerprint the application, check if ViewState is signed-only versus encrypted using __VIEWSTATEENCRYPTED, and run parser-error differentials to identify exploitable RCE chains.
ViewState triage examines __VIEWSTATEENCRYPTED and parser error differentials to detect dual-entry-point anti-patterns. This process exposes remote code execution risks by identifying when ViewState validation is signed-only rather than properly encrypted.
You can check for exposed trace.axd and elmah.axd endpoints by probing the target URL for admin endpoint exposure and customErrors misconfigurations, validating these disclosure signals to map high-value information leaks.
Yes, this approach works for hunting WCF and SharePoint vulnerabilities by enumerating .svc metadata, fingerprinting SharePoint farm topology errors, and guiding focused follow-ups for Telerik AXD handlers and SafeControl reflection enumeration.
Yes, you can use this to generate a bug bounty report for .NET application exposure by mapping observable indicators to specific tests and producing a structured, report-ready evidence workflow for reproducible findings.
Your ViewState parser throws different errors due to dual-parser behavior and farm topology errors. Running an error-path differential helps spot dual-entry-point anti-patterns indicating framework misconfigurations or signed-only ViewState.
grivera82Detects and analyzes ASP.NET surface vulnerabilities in WebForms, WCF, and SharePoint deployments.
dreadnodeCreate, retrieve, and list structured security research findings with deduplication and filtering.
elementalsoulsIdentify and validate ASP.NET deserialization and misconfiguration vectors across Webforms, WCF, and SharePoint.
securityfortechIdentify and exploit default or weak credentials on web login forms.
