skills.rest
pdparchitect
pdparchitectCOMMUNITY
Explore all skills by this author →
Website𝕏@pdpGitHub

hunt-aspnet

Detect ASP.NET security vulnerabilities including ViewState deserialization and configuration disclosure.

13|2|Updated Jun 1, 2026
Search Tags:#security#vulnerability#deserialization#webforms#asp.net#iis
One-click install
npx skills add https://github.com/pdparchitect/rook --skill hunt-aspnet-pdparchitect
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-aspnet
Source: https://github.com/pdparchitect/rook/tree/main/skills/hunt-aspnet
Command: npx skills add https://github.com/pdparchitect/rook --skill hunt-aspnet-pdparchitect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill automates the discovery of critical vulnerabilities in ASP.NET applications, such as ViewState deserialization, configuration leaks, and administrative endpoint exposure, which are often overlooked in standard security audits.

Core Features & Use Cases

  • Framework Fingerprinting: Automatically detects ASP.NET versions, patch levels, and server configurations.
  • Vulnerability Scanning: Probes for ViewState MAC-bypass, trace.axd/elmah.axd leaks, and WCF service misconfigurations.
  • Use Case: During a security assessment of an enterprise portal, use this skill to identify if the application is vulnerable to ViewState deserialization attacks or if it is leaking sensitive stack traces through misconfigured error pages.

Quick Start

Use the hunt-aspnet skill to audit the target web application for ASP.NET-specific vulnerabilities and configuration weaknesses.

Frequently Asked Questions about hunt-aspnet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect ASP.NET configuration disclosure and trace leaks?▼

ASP.NET configuration disclosure vulnerabilities are identified by probing HTTP headers, form fields, and error responses to detect trace.axd and elmah.axd leaks. This systematic probing confirms if sensitive stack traces or misconfigured error pages are exposed.

Can I use this approach to audit SharePoint and WCF service environments?▼

ASP.NET administrative endpoint exposure is found by systematically probing HTTP responses to identify accessible management interfaces. This confirms vulnerability chains and potential remote code execution paths across targeted web applications.

What is the best way to fingerprint ASP.NET versions and patch levels during a security assessment?▼

The best way to fingerprint ASP.NET versions and patch levels is to analyze HTTP headers and server configurations automatically. This framework fingerprinting detects specific ASP.NET versions and patch levels to assess the application's attack surface.

Why does probing for ViewState MAC-bypass require systematic validation of error responses?▼

Probing for ViewState MAC-bypass requires systematic validation of error responses to confirm vulnerability chains and potential RCE paths. Analyzing error responses ensures that discovered misconfigurations are exploitable rather than false positives.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.6k

httpx-probe

Probe URL lists for live HTTP/HTTPS services and collect fingerprints, titles, headers, and TLS metadata.

Official
Intermediate
allsmogallsmog
22

Exploit Techniques

Generate Python exploit templates for SQL and command injection vulnerabilities.

Community
Advanced
Kisilev13Kisilev13

hunt-aspnet

Identify and exploit ASP.NET vulnerabilities including ViewState deserialization and machineKey recovery.

Community
Advanced
zebbernzebbern
4.5k

Security Scanning Tools

Automate security scanning workflows for network and vulnerability assessment.

Community
Advanced