hunt-aspnet
starsforks
How to install hunt-aspnet?
elementalsouls/claude-bughunter/hunt-aspnet
$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-aspnetHunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, request-validator bypass, trace.axd/elmah.axd disclosure, load-balanced ViewState cross-node failures, SafeControl enumeration via refle
SKILL.md
| 1 | ## Crown Jewel Targets |
| 2 | |
| 3 | ASP.NET deserialization bugs pay among the highest amounts in bug bounty when they reach RCE. Even when patched, the disclosure-tier findings (signed-only ViewState, dual-parser differential, request-validator quirks) reliably pay Low-Medium. |
| 4 | |
| 5 | **Highest-value targets:** |
| 6 | |
| 7 | - **SharePoint farms** (any version — 2013/2016/2019/SE) — sign-only ViewState + permissive ToolPane.aspx + anonymous FormDigest creates the CVE-2025-53770 ToolShell precondition chain |
| 8 | - **Telerik UI for ASP.NET AJAX** — `Telerik.Web.UI.WebResource.axd` is a documented RCE sink when keys leak (CVE-2017-11317, CVE-2017-11357, CVE-2019-18935) |
| 9 | - **Classic ASP.NET Webforms enterprise apps** — banking portals, dealer portals, HR systems left on .NET Framework 4.x |
| 10 | - **WCF services** (`*.svc?WSDL`) — often forgotten admin endpoints with looser auth than the main app |
| 11 | - **Sitecore CMS** — ViewState + Sitecore-specific deserialization chains (CVE-2021-42237) |
| 12 | - **DotNetNuke (DNN)** — historic ViewState RCE chains |
| 13 | - **Umbraco CMS** — ViewState + custom deserialization sinks |
| 14 | |
| 15 | **Asset types that pay most:** internet-reachable ASP.NET Webforms apps > WCF admin services > Telerik-integrated sites > Classic ASP.NET MVC with VSF (very rare) |
| 16 | |
| 17 | --- |
| 18 | |
| 19 | ## Attack Surface Signals |
| 20 | |
| 21 | **Response headers indicating ASP.NET:** |
| 22 | ``` |
| 23 | X-AspNet-Version: 4.0.30319 (classic — disclosure on its own) |
| 24 | X-Powered-By: ASP.NET |
| 25 | X-AspNetMvc-Version: 5.2 |
| 26 | Server: Microsoft-IIS/10.0 |
| 27 | Set-Cookie: ASP.NET_SessionId=... |
| 28 | Set-Cookie: .ASPXAUTH=... (Forms auth cookie) |
| 29 | Set-Cookie: .ASPXFORMSAUTH=... |
| 30 | Set-Cookie: ASP.NET_SessionId=...; SameSite=None (suggests cross-origin embedding) |
| 31 | ``` |
| 32 | |
| 33 | **Body signals (in form HTML):** |
| 34 | ``` |
| 35 | <input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="..." /> |
| 36 | <input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="..." /> |
| 37 | <input type="hidden" name="__VIEWSTATEENCRYPTED" id="__VIEWSTATEENCRYPTED" value="" /> |
| 38 | ↑ EMPTY = signed-only, not encrypted = exploitable if key leaks |
| 39 | <input type="hidden" name="__EVENTVALIDATION" id="__EVENTVALIDATION" value="..." /> |
| 40 | <input type="hidden" name="__REQUESTDIGEST" id="__REQUESTDIGEST" value="0x...,..."> |
| 41 | ↑ SharePoint CSRF token; if anon-issued, see hunt-sharepoint |
| 42 | ``` |
| 43 | |
| 44 | **URL patterns to probe:** |
| 45 | ``` |
| 46 | /trace.axd (per-app trace viewer; sometimes anon-accessible) |
| 47 | /elmah.axd (ELMAH error log viewer) |
| 48 | /elmah.axd/?id=... (ELMAH RCE / stack-trace leak) |
| 49 | /*.svc (WCF services) |
| 50 | /*.svc?wsdl (WCF WSDL) |
| 51 | /*.svc/mex (Metadata Exchange) |
| 52 | /*.asmx (legacy SOAP) |
| 53 | /*.asmx?WSDL (legacy SOAP description) |
| 54 | /*.asmx?disco (legacy discovery) |
| 55 | /Telerik.Web.UI.WebResource.axd (Telerik AJAX components) |
| 56 | /ChartImg.axd (DataVisualization controls; historic deserialization) |
| 57 | /ScriptResource.axd (script resource handler; sometimes leaks paths) |
| 58 | /WebResource.axd (web resource handler) |
| 59 | /_vti_bin/* (SharePoint Web Service Forwarder) |
| 60 | /api/ (Web API 2.x is ASP.NET on classic framework) |
| 61 | /signin (often FedAuth / WS-Federation) |
| 62 | ``` |
| 63 | |
| 64 | **Tech-stack signals:** |
| 65 | - `Server: Microsoft-IIS/10.0` (or `/8.5`, `/7.5`) — confirmed Windows + IIS |
| 66 | - `X-AspNet-Version` header — classic .NET Framework (4.x); .NET Core/5+ does NOT emit this |
| 67 | - Cookies with `ASP.NET_SessionId`, `.ASPXAUTH`, `FedAuth` — Forms or claims auth |
| 68 | - `__VIEWSTATE` in form bodies — Webforms (NOT MVC, NOT Razor Pages, NOT Blazor) |
| 69 | - `MicrosoftSharePointTeamServices` header (sometimes stripped by ELB but leaks in `start.aspx` body) — SharePoint |
| 70 | |
| 71 | --- |
| 72 | |
| 73 | ## Step-by-Step Hunting Methodology |
| 74 | |
| 75 | 1. **Fingerprint the framework version.** Trigger any 500 error (stale ViewState POST is a reliable way) and look for `Version Information: Microsoft .NET Framework Version:X.X.XXXXX; ASP.NET Version:X.X.XXXX.X` in the error body. This banner discloses both the runtime and ASP.NET-version-specific patch level. .NET 4.0.30319 + ASP.NET 4.8.x is the most common modern combination. |
| 76 | |
| 77 | 2. **Locate every form with `__VIEWSTATE`.** Spider the target and grep for `name="__VIEWSTATE"`. Each is a candidate sink for deser |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
