hunt-aspnet

Name: hunt-aspnet
Availability: InStock
Author: pdparchitect

Detect ASP.NET security vulnerabilities including ViewState deserialization and configuration disclosure.

13|2|Updated Jun 1, 2026

Search Tags:#security #vulnerability #deserialization #webforms #asp.net #iis

Ready to run

npx skills add https://github.com/pdparchitect/rook --skill hunt-aspnet-pdparchitect

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-aspnet
Source: https://github.com/pdparchitect/rook/tree/main/skills/hunt-aspnet
Command: npx skills add https://github.com/pdparchitect/rook --skill hunt-aspnet-pdparchitect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill automates the discovery of critical vulnerabilities in ASP.NET applications, such as ViewState deserialization, configuration leaks, and administrative endpoint exposure, which are often overlooked in standard security audits.

Core Features & Use Cases

Framework Fingerprinting: Automatically detects ASP.NET versions, patch levels, and server configurations.
Vulnerability Scanning: Probes for ViewState MAC-bypass, trace.axd/elmah.axd leaks, and WCF service misconfigurations.
Use Case: During a security assessment of an enterprise portal, use this skill to identify if the application is vulnerable to ViewState deserialization attacks or if it is leaking sensitive stack traces through misconfigured error pages.

Quick Start

Use the hunt-aspnet skill to audit the target web application for ASP.NET-specific vulnerabilities and configuration weaknesses.

Frequently Asked Questions about hunt-aspnet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect ASP.NET configuration disclosure and trace leaks?▼

ASP.NET configuration disclosure vulnerabilities are identified by probing HTTP headers, form fields, and error responses to detect trace.axd and elmah.axd leaks. This systematic probing confirms if sensitive stack traces or misconfigured error pages are exposed.

Can I use this approach to audit SharePoint and WCF service environments?▼

ASP.NET administrative endpoint exposure is found by systematically probing HTTP responses to identify accessible management interfaces. This confirms vulnerability chains and potential remote code execution paths across targeted web applications.

What is the best way to fingerprint ASP.NET versions and patch levels during a security assessment?▼

The best way to fingerprint ASP.NET versions and patch levels is to analyze HTTP headers and server configurations automatically. This framework fingerprinting detects specific ASP.NET versions and patch levels to assess the application's attack surface.

Why does probing for ViewState MAC-bypass require systematic validation of error responses?▼

Probing for ViewState MAC-bypass requires systematic validation of error responses to confirm vulnerability chains and potential RCE paths. Analyzing error responses ensures that discovered misconfigurations are exploitable rather than false positives.