Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Source Code Disclosure in ASP.NET apps

swarm.ptsecurity.com | research | #waf-bypass | #aspnet | #iis | #source-code-disclosure | #cookieless-session

Summary

Building on Cookieless DuoDrop (CVE-2023-36899/36560), the author shows how cookieless sessions in IIS/ASP.NET enable WAF bypass and source code disclosure affecting many .NET web applications.
Published
Collected

original ↗

Related coverage

  1. Reading ASP secrets for $17,000 (samcurry.net)
  2. Jetty Features for Hacking Web Apps (swarm.ptsecurity.com)
  3. What's in a tag name? JavaScript, apparently (portswigger.net)
  4. Bypassing WAFs with the phantom $Version cookie (portswigger.net)
  5. Bypassing WAFs and cracking XOR with Hackvertor (portswigger.net)
  6. When security features collide (portswigger.net)

back