PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Source Code Disclosure in ASP.NET apps

swarm.ptsecurity.com | research | #waf-bypass | #aspnet | #iis | #source-code-disclosure | #cookieless-session
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Building on Cookieless DuoDrop (CVE-2023-36899/36560), the author shows how cookieless sessions in IIS/ASP.NET enable WAF bypass and source code disclosure affecting many .NET web applications.
Published
Collected

Related coverage

blog · samcurry.net
Reading ASP secrets for $17,000
Turning local file disclosure on an ASP.NET app into a $17,000 bounty: reading download.aspx source, bypassing the two-dot traversal block, and hunting server-side secrets with the widened access.
blog · netspi.com
Decrypting IIS Passwords to Break Out of the DMZ: Part 1
The post shows how to use native IIS tools to decrypt database connection strings in web.config files, then pivot from a DMZ server into the internal network with recovered credentials.
research · swarm.ptsecurity.com
Jetty Features for Hacking Web Apps
PT SWARM on attacking Jetty apps: fingerprinting via Server headers and /;' responses, enumerating webapps and contexts, achieving RCE via crafted XML, and bypassing WAFs in assessments.
research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
Bypassing WAFs with the phantom $Version cookie
Legacy $Version cookies downgrade parsers into RFC2109 mode, and frameworks — Flask, Django, PHP, Spring — disagree on the result. The discrepancies can be abused to smuggle attacks past WAFs.
research · portswigger.net
Bypassing WAFs and cracking XOR with Hackvertor
Gareth Heyes showcases Hackvertor's tag-based encoding for chaining multiple conversion layers inside Burp requests, demonstrating a Cloudflare WAF bypass and XOR cracking.
Back