---
id: 6575
title: "Reading ASP secrets for $17,000"
source_domain: samcurry.net
source_url: "https://samcurry.net/reading-asp-secrets-for-17000"
published_at: "2018-12-17T00:00:00Z"
tags: ["bug-bounty", "web-security", "path-traversal", "aspnet", "local-file-disclosure", "source-code-disclosure"]
phying_url: "https://phying.com/item/6575"
lang: en
---

# Reading ASP secrets for $17,000

## Summary

Turning local file disclosure on an ASP.NET app into a $17,000 bounty: reading download.aspx source, bypassing the two-dot traversal block, and hunting server-side secrets with the widened access.

## Intelligence Metadata

- **Sources:** samcurry.net
- **Published:** 2018-12-17T00:00:00Z
- **Original:** https://samcurry.net/reading-asp-secrets-for-17000
- **Phying News:** https://phying.com/item/6575