domains / families / security / hunt-aspnet

hunt-aspnet

authentic

Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, request-validator bypass, trace.axd/elmah.axd disclosure, load-balanced ViewState cross-node failures, SafeControl enumeration via reflection, customErrors mode=Off stack-trace leaks, classic Webforms .aspx/.asmx/.svc surface. Built for ASP.NET Webforms + WCF + SharePoint farms.

When to use

• ViewState deserialization
• machineKey recovery
• dual-parser MAC-bypass
• request-validator bypass
• trace.axd/elmah.axd disclosure
• SafeControl enumeration
• customErrors stack-trace leaks
• classic Webforms .aspx/.asmx/.svc surface

Skill page

Source