SKILL.md

hunt-aspnet

Agent skill fromelementalsouls/Claude-BugHunter

Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, request-validator bypass, trace.axd/elmah.axd disclosure, load-balanced ViewState cross-node failures, SafeControl enumeration via reflection, customErrors mode=Off stack-trace leaks, classic Webforms .aspx/.asmx/.svc surface. Built for ASP.NET Webforms + WCF + SharePoint farms.

install hunt-aspnet

# install the Claude-BugHunter pack with the skills CLI

npx skills add elementalsouls/Claude-BugHunter

# or add only this skill to Claude Code: copy the folder

skills/hunt-aspnet/

# into

~/.claude/skills/hunt-aspnet/ (all projects)

.claude/skills/hunt-aspnet/ (one project)

skills/hunt-aspnet/SKILL.md

MITFull file

1## Crown Jewel Targets
2 
3ASP.NET deserialization bugs pay among the highest amounts in bug bounty when they reach RCE. Even when patched, the disclosure-tier findings (signed-only ViewState, dual-parser differential, request-validator quirks) reliably pay Low-Medium.
4 
5**Highest-value targets:**
6 
7- **SharePoint farms** (any version — 2013/2016/2019/SE) — sign-only ViewState + permissive ToolPane.aspx + anonymous FormDigest creates the CVE-2025-53770 ToolShell precondition chain
8- **Telerik UI for ASP.NET AJAX** — `Telerik.Web.UI.WebResource.axd` is a documented RCE sink when keys leak (CVE-2017-11317, CVE-2017-11357, CVE-2019-18935)
9- **Classic ASP.NET Webforms enterprise apps** — banking portals, dealer portals, HR systems left on .NET Framework 4.x
10- **WCF services** (`*.svc?WSDL`) — often forgotten admin endpoints with looser auth than the main app
11- **Sitecore CMS** — ViewState + Sitecore-specific deserialization chains (CVE-2021-42237)
12- **DotNetNuke (DNN)** — historic ViewState RCE chains
13- **Umbraco CMS** — ViewState + custom deserialization sinks
14 
15**Asset types that pay most:** internet-reachable ASP.NET Webforms apps > WCF admin services > Telerik-integrated sites > Classic ASP.NET MVC with VSF (very rare)
16 
17---
18 
19## Attack Surface Signals
20 
21**Response headers indicating ASP.NET:**
22```
23X-AspNet-Version: 4.0.30319          (classic — disclosure on its own)
24X-Powered-By: ASP.NET
25X-AspNetMvc-Version: 5.2
26Server: Microsoft-IIS/10.0
27Set-Cookie: ASP.NET_SessionId=...
28…

Excerpt shown under the repository's MIT license.

How to install hunt-aspnet

skills/hunt-aspnet/SKILL.md

More skills in Claude-BugHunter

Newsletter

Join the Community