viewstate-security-workshop

ViewState 安全工作坊 本仓库用于 使用 YSoNet YSoSerial.NET 测试 ASP.NET ViewState 工作坊。 推荐阅读： 通过 ViewState 利用 ASP.NET 中的反序列化漏洞 解决实验室的推荐工具（当实验室已搭建完成时）： https://github.com/irsdl/crapsecrets https://github.com/irsdl/ysonet 工作坊幻灯片： EXPLOITINGKNOWNMACHINEWORKSHOPv1.0NahamCon2025slides.pdf 安全警告...

CVE-2025-30406

CVE-2025-30406 ViewState 漏洞利用 PoC 概述 这是一个概念验证（PoC）脚本，演示了针对 ASP.NET 应用程序中 CVE-2025-30406 的 ViewState 反序列化漏洞利用。它使用 ysoserial 生成恶意 ViewState 载荷，并将其发送到用户指定的 URL 以执行所提供的命令。为获得最佳效果，可将命令输出外带到运行在 VPS 上的自定义 HTTP 服务器（server.py），该服务器会以带时间戳、绿色提示符和白色输出文本的样式化格式显示结果。本脚本仅供教育目的 使用，并且只能在您拥有明确许可...

AspDotNetWrapper-Edited-

AspDotNetWrapper para probar claves de máquina viewstate en ASP.NET descarga clona y descomprime el archivo en Windows Uso root@kitploit: AspDotNetWrapper.exe --keypath MachineKeys.txt --encrypteddata --decrypt --purpose=viewstate --modifier= --macdecode reemplaza el por el parámetro viewstate=...

CVE-2026-26335-Calero-VeraSMART-RCE

👤 作者 Mohammed Idrees Banyamer 安全研究员 GitHub: https://github.com/mbanyamer Instagram: https://instagram.com/banyamersecurity CVE-2026-26335 - Calero VeraSMART ViewState RCE 漏洞利用 📌 描述 CVE‑2026‑26335 是 Calero VeraSMART （2022 R1 之前版本）中的一个严重未认证远程代码执行漏洞。 该应用程序使用静态硬编码的 ASP.NET 计算机密钥 ，且在所有安装实例中共享。...

EUVD-2019-8731

Malware in sbrugna...

Checkbox Survey 6.12 <= 6.18 RCE

Checkbox Survey is an ASP.NET application that can add survey functionality to a website. Prior to version 7.0, Checkbox Survey implements its own View State functionality by accepting a VSTATE argument, which it then deserializes using LosFormatter. Because this data is manually handled by the...

Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability

Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey, perform cross-site-scripting XSS attacks, compromise the ASP.NET ViewState,...

CVE-2019-19092

ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code MAC. Alterations to Viewstate might thus not be noticed...

Telerik Web UI Information Disclosure (CVE-2017-9248)

A security bypass vulnerability exists in Telerik Web UI. Successful exploitation of this vulnerability can lead to cross-site scripting, arbitrary file uploads and downloads, leak of MachineKey and compromise of the ASP.NET ViewState on the affected system...

Telerik Web UI contains cryptographic weakness

Overview The Telerik Web UI, versions R2 2017 2017.2.503 and prior, is vulnerable to a cryptographic weakness which an attacker can exploit to extract encryption keys. Description CWE-326: Inadequate Encryption Strength - CVE-2017-9248The Telerik.Web.UI.dll is vulnerable to a cryptographic...

CVE-2017-9248

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leadi...

CVE-2017-9248

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leadi...