An ASP.NET security-testing guide focused on older Microsoft web applications and related services. ASP.NET is Microsoft's web framework; the guide covers issues involving ViewState, leaked encryption keys, exposed diagnostics, and unsafe deserialization, which can sometimes lead to code execution.

Use it when assessing in-scope ASP.NET Web Forms, WCF, SharePoint, Telerik, Sitecore, DotNetNuke, or Umbraco systems from outside the network.

ASP.NET applications can have security-sensitive settings and forgotten endpoints that are easy to miss during a general review. This guide organizes checks for those framework-specific risks.

hunt-aspnet — Skill for Claude Code by Zyrexnn

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add Zyrexnn/Cybermes --skill hunt-aspnet

Clone the repo

git clone --depth 1 https://github.com/Zyrexnn/Cybermes

Made for: Claude Code.

Or install Claude-BugHunter, the plugin that ships this one along with the rest of its 11 skills, 15 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/zyrexnn/cybermes/hunt-aspnet/github.svg)](https://agentmods.dev/skills/zyrexnn/cybermes/hunt-aspnet)

Your own site

<a href="https://agentmods.dev/skills/zyrexnn/cybermes/hunt-aspnet"><img src="https://agentmods.dev/badge/skills/zyrexnn/cybermes/hunt-aspnet/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/zyrexnn/cybermes/hunt-aspnet"><img src="https://agentmods.dev/badge/skills/zyrexnn/cybermes/hunt-aspnet.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 98 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 4,884 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin 100% copy Near-identical to another mod in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00098	$0.04884
Opus 5	$0.00049	$0.02442
Sonnet 5	$0.00020	$0.00977
Haiku 4.5	$0.00010	$0.00488

Measured 9d ago against content hash 1606594f88ee, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

hunt-aspnet scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -sk -X POST "https://target.example/page.aspx" \

Origin

This is a copy

100% identical to hunt-aspnet — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

knowledge/Claude-BugHunter/skills/hunt-aspnet/SKILL.md · 278 lines

How it starts

The opening of the file, as written. The whole thing — 278 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Crown Jewel Targets

ASP.NET deserialization bugs pay among the highest amounts in bug bounty when they reach RCE. Even when patched, the disclosure-tier findings (signed-only ViewState, dual-parser differential, request-validator quirks) reliably pay Low-Medium.

Highest-value targets:

SharePoint farms (any version — 2013/2016/2019/SE) — sign-only ViewState + permissive ToolPane.aspx + anonymous FormDigest creates the CVE-2025-53770 ToolShell precondition chain
Telerik UI for ASP.NET AJAX — Telerik.Web.UI.WebResource.axd is a documented RCE sink when keys leak (CVE-2017-11317, CVE-2017-11357, CVE-2019-18935)
Classic ASP.NET Webforms enterprise apps — banking portals, dealer portals, HR systems left on .NET Framework 4.x
WCF services (*.svc?WSDL) — often forgotten admin endpoints with looser auth than the main app
Sitecore CMS — ViewState + Sitecore-specific deserialization chains (CVE-2021-42237)
DotNetNuke (DNN) — historic ViewState RCE chains
Umbraco CMS — ViewState + custom deserialization sinks

Asset types that pay most: internet-reachable ASP.NET Webforms apps > WCF admin services > Telerik-integrated sites > Classic ASP.NET MVC with VSF (very rare)

Attack Surface Signals

Response headers indicating ASP.NET:

X-AspNet-Version: 4.0.30319          (classic — disclosure on its own)
X-Powered-By: ASP.NET
X-AspNetMvc-Version: 5.2
Server: Microsoft-IIS/10.0
Set-Cookie: ASP.NET_SessionId=...
Set-Cookie: .ASPXAUTH=...            (Forms auth cookie)
Set-Cookie: .ASPXFORMSAUTH=...
Set-Cookie: ASP.NET_SessionId=...; SameSite=None  (suggests cross-origin embedding)

Body signals (in form HTML):

<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="..." />
<input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="..." />
<input type="hidden" name="__VIEWSTATEENCRYPTED" id="__VIEWSTATEENCRYPTED" value="" />
                                        ↑ EMPTY = signed-only, not encrypted = exploitable if key leaks
<input type="hidden" name="__EVENTVALIDATION" id="__EVENTVALIDATION" value="..." />
<input type="hidden" name="__REQUESTDIGEST" id="__REQUESTDIGEST" value="0x...,...">
                                        ↑ SharePoint CSRF token; if anon-issued, see hunt-sharepoint

Read the full file on GitHub · 278 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

9d ago First seen · 278 lines · 98 tokens per session scan A 1606594f88ee

Subscribe to this mod's changes

hunt-aspnet is a skill published in the GitHub repository Zyrexnn/Cybermes (668 stars, last pushed 9d ago), licensed Apache-2.0. It adds 98 tokens to every session and 4,884 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). It is 100% identical to hunt-aspnet, differing in 0 lines, and is treated as a copy.

Security ai-agent appsec bug-bounty cybersecurity devsecops exploit-validation

forensics-kit

Digital forensics and incident response toolbox. Load when the operator asks about a pcap, a binary, a memory dump, a suspicious file, malware triage, IOC hunting, or post-incident analysis. Covers network (tshark), binaries (radare2, strings, binwalk, file, exiftool), memory (volatility), and pattern matching (YARA).…

FrancescoStabile/numasec · 101 tokens

passive-osint

Passive reconnaissance against a target without sending traffic that could alert it. Load when the engagement starts, when you only know a domain/email/username, when scope is unclear, or when you need historical surface area. Covers subdomain enumeration (crt.sh, subfinder), historical archives (wayback), DNS posture…

FrancescoStabile/numasec · 99 tokens

authz-recipe

Broken Access Control is OWASP #1, but there is no drop-in CLI (Autorize / AuthMatrix are Burp extensions). This is the procedure that carries the whole category: an authorization-matrix + A/B session-replay method driving curl, the playwright skill (per-identity sessions), and ffuf (ID enumeration). Live →…

tr4m0ryp/shor · 62 tokens

jwt_tool

Skill "jwt_tool" from tr4m0ryp/shor, covering jwttool — jwt analysis & attacks, when to reach for it, key flags / modes, safe invocation and form field (oidc-style).

tr4m0ryp/shor · 52 tokens

git-security-history

A small recipe over the already-cloned repo. It runs git log --grep for security/CVE/fix patterns, maps the touched files into ranked hot files, and emits historicalsignal.json. It optionally folds in two signals you may have ALREADY produced this phase — osv-scanner JSON (dependency CVEs) and gitleaks JSON (history…

tr4m0ryp/shor · 86 tokens

playwright

Headless Chromium via Playwright (installed pip install playwright && playwright install chromium, with glibc font/nss deps). Use it to interact with JS-heavy apps, complete login/SSO/multi-step flows for an authenticated session, and — critically — to prove client-side findings by observing real execution (an XSS…

tr4m0ryp/shor · 53 tokens

hunt-aspnet