What problem does it solve? Security testers need a disciplined, evidence-gated workflow for assessing ASP.NET/IIS targets without jumping to unsafe exploitation. This Skill structures the audit of error pages, debug configuration, routing, ViewState handling, file upload, authentication, and historical CVE applicability while enforcing strict stop conditions. ## Core Features & Use Cases - Evidence-Gated Triage: Confirms server, framework, module, and version evidence before any probe, treating banners and stack traces as inconclusive signals rather than vulnerabilities. - Safe Validation Workflow: Uses baseline, single-variable probe, post-baseline, oracle, and evidence steps with owned low-privilege accounts and test data only. - Specialist Routing: Hands off deserialization findings to hunt-deserialization, file issues to hunt-file-upload or hunt-lfi, and CVE checks to the main orchestrator route. - Use Case: During an authorized engagement you discover .aspx endpoints and a __VIEWSTATE field; the Skill guides you to audit MAC/encryption configuration and error handling without constructing executable ViewState payloads. ## Quick Start Ask the agent to run the ASP.NET specialist audit against the authorized target after confirming scope, baseline, and that this route ranks in the orchestrator's top three.
