skills.rest
sseshachala
sseshachalaCOMMUNITY
Explore all skills by this author →
GitHub

hunt-aspnet

Identify ASP.NET deserialization and ViewState exposure risks by enumerating endpoints.

Updated Jun 5, 2026
Search Tags:#deserialization#webforms#wcf#aspnet#viewstate#trace.axd#elmah.axd
One-click install
npx skills add https://github.com/sseshachala/Claude-BugHunter-archive --skill hunt-aspnet-sseshachala
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-aspnet
Source: https://github.com/sseshachala/Claude-BugHunter-archive/tree/main/skills/hunt-aspnet
Command: npx skills add https://github.com/sseshachala/Claude-BugHunter-archive --skill hunt-aspnet-sseshachala

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security researchers detect ASP.NET-specific surface areas that enable ViewState deserialization attacks, misconfigurations, and exposed endpoints, enabling faster risk assessment of enterprise web apps.

Core Features & Use Cases

  • Fingerprint ASP.NET framework version and signed/encrypted ViewState status to determine exploit feasibility.
  • Enumerate common ASP.NET surfaces such as trace.axd, elmah.axd, WCF svc endpoints, and SafeControl paths to map attack surface.
  • Validate bypass paths like dual-parser deserialization, request validator gaps, and cross-node MAC issues to triage exploitability.

Quick Start

Scan a target ASP.NET site to locate ViewState usage, test MAC/bypass conditions, enumerate .svc endpoints, and check for trace/elmah exposure to assess deserialization risk.

Frequently Asked Questions about hunt-aspnet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect ASP.NET ViewState deserialization vulnerabilities?▼

Detect ASP.NET ViewState deserialization risks by enumerating __VIEWSTATE usage, verifying encryption status, and testing MAC validation to determine exploit feasibility. Probe trace.axd and elmah.axd endpoints for anonymous access to map the full attack surface.

What causes ViewState MAC validation bypass in ASP.NET WebForms?▼

ViewState MAC validation bypass in ASP.NET WebForms occurs through dual-parser deserialization gaps, request validator misconfigurations, or cross-node MAC issues in SharePoint-like farms. Testing these bypass paths characterizes exploitability.

How do I check if trace.axd and elmah.axd endpoints are exposed?▼

Check trace.axd and elmah.axd exposure by probing the ASP.NET target for anonymous access to these diagnostic endpoints. Enumerating these surfaces reveals misconfigurations that expose application internals and accelerate risk assessment.

Can I enumerate WCF services and SafeControl paths on SharePoint farms?▼

Yes, you can enumerate WCF .svc endpoints and SafeControl paths on SharePoint-like farms to map attack surface. Fingerprint framework versions and validate dual-parser deserialization bypass conditions to characterize exploitability.

Does this work for testing ASP.NET ViewState encryption across web farm nodes?▼

Yes, it works for testing ASP.NET ViewState encryption across web farm nodes by probing cross-node MAC validation issues. Apply the evaluation to WebForms, WCF, and SharePoint-like farms to identify dual-parser deserialization bypass potential.

Related Skills

Explore More Software Engineering Skills→
rafaelcallejarafaelcalleja
2

ffuf-web-fuzzing

Fuzz web resources to discover hidden directories, files, and subdomains.

Community
Advanced
elementalsoulselementalsouls
3.3k

hunt-aspnet

Identify and validate ASP.NET deserialization and misconfiguration vectors across Webforms, WCF, and SharePoint.

Community
Advanced
alexfazioalexfazio
159

cc-trace

Intercept and inspect Claude Code API traffic using mitmproxy.

Community
Advanced
uphiagouphiago
1.1k

hunt-fastapi

Detect FastAPI-specific vulnerabilities including OpenAPI schema exposure and DI authorization gaps.

Community
Intermediate