skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-aspnet

Detects ASP.NET ViewState deserialization, machineKey, and disclosure vulnerabilities in authorized bug bounty engagements.

Updated Sep 6, 2026
Search Tags:#penetration testing#sharepoint#deserialization#aspnet#bug bounty#viewstate#machinekey
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-aspnet-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-aspnet
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-aspnet
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-aspnet-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? ASP.NET Webforms, WCF, and SharePoint applications expose a distinctive attack surface—ViewState deserialization, machineKey misconfiguration, trace.axd/elmah.axd disclosure, and Telerik handler RCE—that generic web scanners routinely miss. This Skill gives security researchers a structured methodology to fingerprint, probe, and validate these ASP.NET-specific weaknesses during authorized bug bounty engagements. ## Core Features & Use Cases - ViewState Security Analysis: Distinguish signed-only versus encrypted ViewState via __VIEWSTATEENCRYPTED, and run the 7-payload dual-parser differential test to detect MAC-bypass anti-patterns. - Disclosure Endpoint Hunting: Systematically probe trace.axd, elmah.axd, WCF .svc?wsdl metadata, and customErrors stack-trace leaks that expose credentials and internal paths. - Framework-Specific RCE Chains: Identify Telerik WebResource.axd (CVE-2017-11317, CVE-2019-18935), SharePoint ToolShell preconditions, and SafeControl enumeration via Picker.aspx reflection. - Use Case: While testing an enterprise banking portal, you fingerprint X-AspNet-Version: 4.0.30319, find an empty __VIEWSTATEENCRYPTED field, confirm the dual-parser differential, and recover the machineKey from a config leak—building a validated Critical-severity ViewState deserialization report. ## Quick Start Ask the AI to fingerprint the target's ASP.NET stack and run the ViewState parser differential test against a specific page URL.

Frequently Asked Questions about hunt-aspnet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test ASP.NET ViewState for deserialization vulnerabilities?▼

Check whether the __VIEWSTATEENCRYPTED hidden field is empty, which indicates signed-only ViewState. Then send seven payload shapes (trivial, real, flipped-bit, oversize, base64, XML-shaped, LosFormatter) and classify error responses to detect the dual-parser MAC-bypass anti-pattern.

What HTTP headers indicate an ASP.NET application?▼

Look for X-AspNet-Version (classic .NET Framework only), X-Powered-By: ASP.NET, Server: Microsoft-IIS, and cookies like ASP.NET_SessionId or .ASPXAUTH. The __VIEWSTATE hidden form field confirms Webforms specifically, not MVC or Razor Pages.

How do I check if trace.axd or elmah.axd is exposed?▼

Request /trace.axd and /elmah.axd anonymously and check for HTTP 200. A 200 on trace.axd leaks full request data including Authorization headers, while elmah.axd exposes error logs with stack traces and sometimes connection strings.

Can the ASP.NET request validator be bypassed?▼

Yes. The request validator only covers URL-encoded bodies and querystrings by default. Payloads in Cookie or Referer headers, JSON/XML bodies, and multipart fields are not validated in classic ASP.NET, allowing filter evasion.

When is a signed-only ViewState finding actually exploitable?▼

Signed-only ViewState alone is a Low-Medium primitive. It becomes Critical only when the validationKey is recovered through web.config disclosure, source leaks, or elmah.axd, enabling ysoserial.net gadget chains like TypeConfuseDelegate for RCE.

What are the limitations of this ASP.NET hunting methodology?▼

It targets classic .NET Framework 4.x stacks; .NET Core and 5+ do not emit X-AspNet-Version or use Webforms ViewState. Encrypted ViewState without key recovery cannot be exploited, and Telerik RCE chains require leaked encryption keys.

Related Skills

Explore More Software Engineering Skills→
uphiagouphiago
1.1k

hunt-aspnet

Detect ASP.NET Webforms, WCF, SharePoint, and Telerik vulnerability primitives.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

deserialization-dotnet

Generate ysoserial.net payloads to exploit .NET deserialization vulnerabilities.

Official
Advanced
jellaharshithjellaharshith
1

hunt-ntlm-info

Capture and decode NTLM Type-2 AV_PAIRS from IIS, SharePoint, and Exchange endpoints.

Community
Intermediate
cybersecwomancybersecwoman
5

hunt-aspnet

Identify and exploit ASP.NET vulnerabilities like ViewState deserialization and machineKey recovery.

Community
Advanced