viewstate-security-workshop

ViewState 安全工作坊 本仓库用于 使用 YSoNet YSoSerial.NET 测试 ASP.NET ViewState 工作坊。 推荐阅读： 通过 ViewState 利用 ASP.NET 中的反序列化漏洞 解决实验室的推荐工具（当实验室已搭建完成时）： https://github.com/irsdl/crapsecrets https://github.com/irsdl/ysonet 工作坊幻灯片： EXPLOITINGKNOWNMACHINEWORKSHOPv1.0NahamCon2025slides.pdf 安全警告...

CVE-2025-30406

CVE-2025-30406 ViewState Exploit PoC Overview This is a Proof-of-Concept PoC script demonstrating a ViewState deserialization exploit for CVE-2025-30406 in ASP.NET applications. It uses ysoserial to generate a malicious ViewState payload and sends it to a user-specified URL to execute a provided...

AspDotNetWrapper-Edited-

AspDotNetWrapper para probar claves de máquina viewstate en ASP.NET descarga clona y descomprime el archivo en Windows Uso root@kitploit: AspDotNetWrapper.exe --keypath MachineKeys.txt --encrypteddata --decrypt --purpose=viewstate --modifier= --macdecode reemplaza el por el parámetro viewstate=...

CVE-2026-26335-Calero-VeraSMART-RCE

👤 作者 Mohammed Idrees Banyamer 安全研究员 GitHub: https://github.com/mbanyamer Instagram: https://instagram.com/banyamersecurity CVE-2026-26335 - Calero VeraSMART ViewState RCE 漏洞利用 📌 描述 CVE‑2026‑26335 是 Calero VeraSMART （2022 R1 之前版本）中的一个严重未认证远程代码执行漏洞。 该应用程序使用静态硬编码的 ASP.NET 计算机密钥 ，且在所有安装实例中共享。...

EUVD-2019-8731

Malware in sbrugna...

Checkbox Survey 6.12 <= 6.18 RCE

Checkbox Survey is an ASP.NET application that can add survey functionality to a website. Prior to version 7.0, Checkbox Survey implements its own View State functionality by accepting a VSTATE argument, which it then deserializes using LosFormatter. Because this data is manually handled by the...

Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability

Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey, perform cross-site-scripting XSS attacks, compromise the ASP.NET ViewState,...

CVE-2019-19092

ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code MAC. Alterations to Viewstate might thus not be noticed...

Telerik Web UI Information Disclosure (CVE-2017-9248)

A security bypass vulnerability exists in Telerik Web UI. Successful exploitation of this vulnerability can lead to cross-site scripting, arbitrary file uploads and downloads, leak of MachineKey and compromise of the ASP.NET ViewState on the affected system...

Telerik Web UI contains cryptographic weakness

Overview The Telerik Web UI, versions R2 2017 2017.2.503 and prior, is vulnerable to a cryptographic weakness which an attacker can exploit to extract encryption keys. Description CWE-326: Inadequate Encryption Strength - CVE-2017-9248The Telerik.Web.UI.dll is vulnerable to a cryptographic...

CVE-2017-9248

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leadi...

CVE-2017-9248

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leadi...