hunt-aspnet

Identify and exploit ASP.NET vulnerabilities including ViewState deserialization and machineKey recovery.

Updated Jun 18, 2026

Search Tags:#exploitation #web security #vulnerability detection #asp.net #security research

Ready to run

npx skills add https://github.com/Kisilev13/Hermes-Agent-Workspace --skill hunt-aspnet-kisilev13

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-aspnet
Source: https://github.com/Kisilev13/Hermes-Agent-Workspace/tree/main/skills/hunt-aspnet
Command: npx skills add https://github.com/Kisilev13/Hermes-Agent-Workspace --skill hunt-aspnet-kisilev13

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and exploits vulnerabilities in ASP.NET applications, helping to secure web applications.

Core Features & Use Cases

ASP.NET Vulnerability Detection: Identifies common vulnerabilities in ASP.NET applications.
Exploitation Techniques: Provides methods to exploit detected vulnerabilities.
Use Case: A security researcher uses this Skill to identify potential security issues in a web application and then exploit them to demonstrate the severity of the vulnerabilities.

Quick Start

Use the hunt-aspnet skill to identify and exploit ASP.NET vulnerabilities in the target application.

Frequently Asked Questions about hunt-aspnet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I exploit ViewState deserialization vulnerabilities in ASP.NET applications?▼

This skill identifies and exploits ASP.NET ViewState deserialization vulnerabilities by analyzing insecure serialized page state to achieve remote code execution. It leverages known deserialization mechanisms to manipulate and compromise target applications.

What is the best way to recover machineKey values during ASP.NET security research?▼

MachineKey recovery involves extracting cryptographic validation and decryption keys used by ASP.NET to secure ViewState and session data. This skill provides methods to identify exposed or predictable machineKey configurations, enabling further exploitation of ViewState tampering protections.

How does dual-parser MAC-bypass work for ASP.NET vulnerability detection?▼

Dual-parser MAC-bypass exploits differences in how ASP.NET parsers validate Message Authentication Codes, allowing attackers to submit malicious payloads that evade standard security checks. This skill detects and exploits these parser inconsistencies to bypass ViewState integrity enforcement.

Can I bypass request validators to exploit ASP.NET web application security flaws?▼

Yes, request-validator bypass circumvents ASP.NET built-in input validation features to inject malicious payloads. This skill identifies encoding or parser inconsistencies that allow unchecked input to pass through request validators, enabling cross-site scripting or injection attacks.

Do I need prior knowledge of ASP.NET frameworks to identify web application vulnerabilities?▼

Yes, understanding ASP.NET architecture and web application security is required. This advanced skill focuses on identifying and exploiting complex framework-specific issues, assuming the user possesses foundational knowledge of ASP.NET request processing and cryptographic implementations.