---
id: 5103
title: "Source Code Disclosure in ASP.NET apps"
source_domain: swarm.ptsecurity.com
source_url: "https://swarm.ptsecurity.com/source-code-disclosure-in-asp-net-apps/"
published_at: "2024-03-07T12:41:50Z"
tags: ["waf-bypass", "aspnet", "iis", "source-code-disclosure", "cookieless-session"]
phying_url: "https://phying.com/item/5103"
lang: en
---

# Source Code Disclosure in ASP.NET apps

## Summary

Building on Cookieless DuoDrop (CVE-2023-36899/36560), the author shows how cookieless sessions in IIS/ASP.NET enable WAF bypass and source code disclosure affecting many .NET web applications.

## Intelligence Metadata

- **Sources:** swarm.ptsecurity.com
- **Published:** 2024-03-07T12:41:50Z
- **Original:** https://swarm.ptsecurity.com/source-code-disclosure-in-asp-net-apps/
- **Phying News:** https://phying.com/item/5103