skills.rest
hhjkjkjk
hhjkjkjkCOMMUNITY
Explore all skills by this author →
GitHub

hunt-aspnet

Detect ASP.NET ViewState deserialization, machineKey, and disclosure vulnerabilities in authorized engagements.

Updated May 29, 2026
Search Tags:#security testing#sharepoint#deserialization#aspnet#bug bounty#viewstate#machinekey
One-click install
npx skills add https://github.com/hhjkjkjk/Claude-skills --skill hunt-aspnet-hhjkjkjk
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-aspnet
Source: https://github.com/hhjkjkjk/Claude-skills/tree/main/skills/hunt-aspnet
Command: npx skills add https://github.com/hhjkjkjk/Claude-skills --skill hunt-aspnet-hhjkjkjk

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security researchers testing ASP.NET Webforms, WCF, and SharePoint targets need a systematic methodology to identify high-value deserialization and disclosure bugs like signed-only ViewState, machineKey leaks, and exposed trace.axd/elmah.axd endpoints without missing subtle parser differentials. ## Core Features & Use Cases - ViewState Analysis: Fingerprint signed-only vs encrypted ViewState, run the 7-payload dual-parser differential test, and detect load-balanced cross-node MAC failures. - Disclosure Surface Hunting: Probe trace.axd, elmah.axd, customErrors stack traces, WCF .svc metadata, and Telerik WebResource handlers for anonymous exposure. - Use Case: During an authorized bug bounty engagement against a SharePoint farm, use the methodology to confirm an anonymously reachable ToolPane.aspx with signed-only ViewState and anonymous FormDigest, establishing the CVE-2025-53770 ToolShell precondition chain for a Critical report. ## Quick Start Use the hunt-aspnet skill to fingerprint the target's ASP.NET version and test its ViewState MAC validation with the parser differential probe.

Frequently Asked Questions about hunt-aspnet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test ASP.NET ViewState for deserialization vulnerabilities?▼

Check whether __VIEWSTATEENCRYPTED is empty, which indicates signed-only ViewState exploitable if the validationKey leaks. Then send seven payload shapes and compare error messages to detect the dual-parser differential where some payloads reach deserialization before MAC validation.

What ASP.NET endpoints should I probe during a security assessment?▼

Probe /trace.axd and /elmah.axd for anonymous access, enumerate .svc WCF services with ?wsdl and ?mex, check Telerik.Web.UI.WebResource.axd for known RCE versions, and trigger 500 errors to detect customErrors mode=Off stack-trace leaks.

Does the ASP.NET request validator block all XSS payloads?▼

No. The request validator only covers URL-encoded bodies and querystrings by default. Cookies, Referer headers, JSON and XML bodies, and multipart fields are not validated, so payloads in those contexts can bypass it.

Why does ViewState MAC validation fail across load-balanced servers?▼

When a web farm uses AutoGenerate machineKey without synchronizing keys across nodes, each server generates a different key, so ViewState issued by one node fails validation on another. The error message itself confirms the farm topology.

When is a signed-only ViewState finding actually exploitable?▼

Signed-only ViewState alone is a Low-Medium primitive. It becomes Critical only when the validationKey is recovered through web.config disclosure, source leaks, or elmah.axd, enabling forged ViewState and RCE via ysoserial.net gadget chains.

Related Skills

Explore More Software Engineering Skills→
sseshachalasseshachala

hunt-aspnet

Identify ASP.NET deserialization and ViewState exposure risks by enumerating endpoints.

Community
Advanced
sseshachalasseshachala

hunt-rce

Identify and validate remote code execution vulnerabilities in target systems.

Community
Advanced
bpnrockstarbpnrockstar

hunt-ntlm-info

Identify NTLM/Negotiate information disclosure from IIS, SharePoint, and Exchange servers.

Community
Advanced
jokken79jokken79
1

Burp Suite Web Application Testing

Intercept, modify, and analyze HTTP traffic to identify web application vulnerabilities.

Community
Advanced