Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Inspect body for: · elementalsouls | DecimalAI

securityby elementalsouls

Inspect body for:

elementalsouls/hunt-aspnet

Source elementalsouls/claude-bughunter ↗License NOASSERTION

Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, request-validator bypass, trace.axd/elmah.axd disclosure, load-balanced ViewState cross-node failures, SafeControl enumeration via reflection, customErrors mode=Off stack-trace leaks, classic Webforms .aspx/.asmx/.svc surface. Built for ASP.NET Webforms + WCF + SharePoint farms.

SkillScore87Maintained

Automatic

Security & AppSec pack

Last verified 8/9/2026

What it changes

Passed 20 of 23 test cases with the skill, and 14 of 23 without it.

Without skill61%

With skill87%

Checks it passed that the model alone missed

Identifies Picker.aspx as the endpoint for type existence checking.
Assigns critical severity to the finding due to session token exposure.
Identifies HTTP cookies as contexts not checked by default request validation.

and 4 more in the full report

6 fixed14 passed either way3 still failing0 broke

Pass-rate lift: +26 pp
Tokens: +233%
Agent turns: 0%
Response time: -34%

Model gemini-3.6-flashMeasured 8/9/2026v120 of 23 cases passed with skill

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/elementalsouls-hunt-aspnet/SKILL.md https://app.decimal.ai/s/elementalsouls-hunt-aspnet/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add elementalsouls-hunt-aspnet, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/elementalsouls-hunt-aspnet/ and pins it in .decimal/skills.lock

decimalai skills add elementalsouls-hunt-aspnet

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/elementalsouls-hunt-aspnet/SKILL.md https://app.decimal.ai/s/elementalsouls-hunt-aspnet/SKILL.md

Raw file: /s/elementalsouls-hunt-aspnet/SKILL.md ↗ · machine-readable summary at /s/elementalsouls-hunt-aspnet.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 6

Prompt

In a SharePoint environment, an auditor wants to test for the existence of internal reflection types within the SafeControl list without triggering full execution. Which SharePoint HTTP endpoint and parameter facilitate type existence checking?

What was checked, without and with the skill
Checked	Without skill	With skill
Identifies Picker.aspx as the endpoint for type existence checking.	Missed	Passed

case-18 · gemini-3.6-flash · 8/9/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md270 linessingle file

Crown Jewel Targets

ASP.NET deserialization bugs pay among the highest amounts in bug bounty when they reach RCE. Even when patched, the disclosure-tier findings (signed-only ViewState, dual-parser differential, request-validator quirks) reliably pay Low-Medium.

Highest-value targets:

SharePoint farms (any version — 2013/2016/2019/SE) — sign-only ViewState + permissive ToolPane.aspx + anonymous FormDigest creates the CVE-2025-53770 ToolShell precondition chain
Telerik UI for ASP.NET AJAX — Telerik.Web.UI.WebResource.axd is a documented RCE sink when keys leak (CVE-2017-11317, CVE-2017-11357, CVE-2019-18935)
Classic ASP.NET Webforms enterprise apps — banking portals, dealer portals, HR systems left on .NET Framework 4.x
WCF services (*.svc?WSDL) — often forgotten admin endpoints with looser auth than the main app
Sitecore CMS — ViewState + Sitecore-specific deserialization chains (CVE-2021-42237)
DotNetNuke (DNN) — historic ViewState RCE chains
Umbraco CMS — ViewState + custom deserialization sinks

Asset types that pay most: internet-reachable ASP.NET Webforms apps > WCF admin services > Telerik-integrated sites > Classic ASP.NET MVC with VSF (very rare)

Attack Surface Signals

Response headers indicating ASP.NET:

X-AspNet-Version: 4.0.30319          (classic — disclosure on its own)
X-Powered-By: ASP.NET
X-AspNetMvc-Version: 5.2
Server: Microsoft-IIS/10.0
Set-Cookie: ASP.NET_SessionId=...
Set-Cookie: .ASPXAUTH=...            (Forms auth cookie)
Set-Cookie: .ASPXFORMSAUTH=...
Set-Cookie: ASP.NET_SessionId=...; SameSite=None  (suggests cross-origin embedding)

Body signals (in form HTML):

<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="..." />
<input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="..." />
<input type="hidden" name="__VIEWSTATEENCRYPTED" id="__VIEWSTATEENCRYPTED" value="" />
                                        ↑ EMPTY = signed-only, not encrypted = exploitable if key leaks
<input type="hidden" name="__EVENTVALIDATION" id="__EVENTVALIDATION" value="..." />
<input type="hidden" name="__REQUESTDIGEST" id="__REQUESTDIGEST" value="0x...,...">

Track record

Benchmark

20 / 23

test cases passed, vs 14 / 23 without

Adoption

Users: 1
Times used: 15

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

elementalsouls / claude-bughunter

skills/hunt-aspnet/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/3/2026Version v1

More skills from the same source and nearby in the registry, with their headline benchmark lift.