skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-aspnet

Identify and validate ASP.NET attack surfaces including ViewState deserialization and WCF misconfigurations.

3|1|Updated Jul 2, 2026
Search Tags:#pentest#deserialization#aspnet#recon#viewstate#iis
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-aspnet-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-aspnet
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-aspnet
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-aspnet-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of manually identifying and chaining complex ASP.NET-specific vulnerabilities like ViewState deserialization, configuration leaks, and WCF service misconfigurations.

Core Features & Use Cases

  • Framework Fingerprinting: Automatically identify ASP.NET versions and patch levels via error-page analysis.
  • Deserialization Hunting: Detect vulnerable ViewState configurations and test for parser-level MAC-bypass anti-patterns.
  • Surface Enumeration: Identify exposed admin endpoints like trace.axd, elmah.axd, and WCF services that lead to information disclosure or RCE.

Quick Start

Use the hunt-aspnet skill to fingerprint the target application and identify potential ViewState deserialization entry points.

Frequently Asked Questions about hunt-aspnet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect ASP.NET ViewState deserialization vulnerabilities during a pentest?▼

Detect ASP.NET ViewState deserialization vulnerabilities by analyzing HTTP headers and form parameters to identify vulnerable ViewState configurations and test for parser-level MAC-bypass anti-patterns. This confirms vulnerability primitives and potential RCE impact.

What exposed endpoints should I enumerate when hunting for ASP.NET misconfigurations?▼

Enumerate exposed ASP.NET admin endpoints like trace.axd, elmah.axd, and WCF services to identify misconfigurations. Analyzing these surfaces reveals information disclosure vulnerabilities and potential remote code execution entry points.

How can I fingerprint the exact ASP.NET version and patch level of a target web application?▼

Fingerprint the exact ASP.NET version and patch level through systematic error-page analysis. Identifying specific framework versions helps map known vulnerabilities and validates potential exploit chains during reconnaissance.

Does this approach work for finding WCF service misconfigurations and configuration disclosure?▼

Yes, this approach validates WCF service misconfigurations and configuration disclosure by systematically analyzing HTTP responses and error messages. It confirms vulnerability primitives and impact for offensive security workflows.

What is the best way to identify IIS and ASP.NET attack surfaces for bug bounty hunting?▼

The best way to identify IIS and ASP.NET attack surfaces is systematically analyzing HTTP headers, form parameters, and error responses. This validates vulnerability primitives and supports manual exploit chain development for bug bounty hunting.

Can I use this to test for ViewState MAC validation bypasses?▼

Yes, you can test for ViewState MAC validation bypasses by detecting vulnerable parser-level anti-patterns. This requires systematic analysis of form parameters and error responses to confirm the deserialization vulnerability primitive.

Related Skills

Explore More Software Engineering Skills→
SkobynSkobyn

hunt-aspnet

Discover and exploit ASP.NET-specific vulnerabilities in web applications.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

deserialization-dotnet

Generate ysoserial.net payloads to exploit .NET deserialization vulnerabilities.

Official
Advanced
AeonDaveAeonDave
15

nuclei

Scan web applications and networks for known vulnerabilities using nuclei templates.

Community
Intermediate
sseshachalasseshachala

hunt-aspnet

Identify ASP.NET deserialization and ViewState exposure risks by enumerating endpoints.

Community
Advanced