hunt-aspnet

Identify and validate ASP.NET deserialization and misconfiguration vectors across Webforms, WCF, and SharePoint.

3.3k|507|Updated May 5, 2026

Search Tags:#deserialization #webforms #wcf #aspnet #viewstate #trace.axd #elmah.axd

Ready to run

npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-aspnet-elementalsouls

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-aspnet
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-aspnet
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-aspnet-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identify and validate ASP.NET surface vectors that enable deserialization and misconfigurations across Webforms, WCF, and SharePoint deployments to assess risk.

Core Features & Use Cases

Fingerprint ASP.NET versions via error banners and headers.
Detect ViewState deserialization vulnerabilities and MAC bypass potential.
Enumerate surface points such as trace.axd, elmah.axd, WCF endpoints, and SafeControl whitelists.
Provide practical steps to map risk and chain potential exploit paths.

Quick Start

Describe a target and run the hunt-aspnet workflow to enumerate ASP.NET surfaces and test deserialization vectors.

Frequently Asked Questions about hunt-aspnet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test ASP.NET ViewState deserialization vulnerabilities?▼

To test ASP.NET ViewState deserialization vulnerabilities, you POST crafted __VIEWSTATE payloads to the target and interpret the validation errors to distinguish signed versus encrypted ViewState and map machineKey dependencies.

What are common ASP.NET misconfiguration vectors in IIS deployments?▼

Common ASP.NET misconfiguration vectors include exposed trace.axd and elmah.axd endpoints, enumerable .svc, .asmx, and .axd endpoints, and vulnerable WCF services across classic Webforms and SharePoint deployments.

How does ViewState MAC validation impact deserialization risk?▼

ViewState MAC validation impacts deserialization risk by requiring a valid machineKey to accept payloads; testing involves sending crafted __VIEWSTATE POSTs and interpreting errors to determine if MAC signing or encryption is enforced.

Can I use this for SharePoint and WCF endpoint security testing?▼

Yes, you can use this workflow for SharePoint and WCF endpoint security testing by enumerating .svc and .asmx endpoints, probing SafeControl whitelists, and validating deserialization vectors across enterprise IIS web applications.

What is the best way to fingerprint ASP.NET versions during a security assessment?▼

The best way to fingerprint ASP.NET versions during a security assessment is by analyzing error banners and HTTP headers returned by the target IIS server to identify the framework version and potential attack surface.

Why are trace.axd and elmah.axd endpoints a security risk?▼

Trace.axd and elmah.axd endpoints are a security risk because they can expose application tracing and error handling data, allowing testers to enumerate surface points and chain potential exploit paths during red-team assessments.