deserialization-dotnet

What problem does it solve?

This Skill helps penetration testers identify and exploit dangerous .NET deserialization vulnerabilities in web applications, enabling remote code execution.

Core Features & Use Cases

• Vulnerability Detection: Identifies common .NET deserialization vectors like ViewState, JSON.NET $type properties, and SOAP endpoints.
• Payload Generation: Leverages tools like ysoserial.net to create exploit payloads for various .NET formatters.
• Exploitation: Guides the user through crafting and sending malicious serialized data to achieve RCE.
• Use Case: A penetration tester discovers a web application accepting serialized ViewState data. This Skill assists in generating a signed ViewState payload using known machine keys to gain command execution on the server.

Quick Start

Use the deserialization-dotnet skill to generate a ysoserial.net payload for exploiting a ViewState vulnerability.