Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to install the vulnerable version of ASP.NET for testing purposes. I've thought about it and I guess the best way would be to delete/disable some security updates to make that possible. Currently I'm running windows XP with all security updates installed.

On the following link I've seen that the 3.5 ASP.NET security update was KB2416471, but I didn't found that update on my system, so I guess it must have the newer version of ASP.NET 3.5 installed which already has this fixed.

Any idea how would I get my hands on the system that is still vulnerable to the Padding Oracle on the ASP.NET Forms Authentication cookie to test it?

share|improve this question
It's a padding oracle, not oracle padding. – CodesInChaos Jan 27 '13 at 19:05

I would suggest running a virtual machine with external network disabled, and install a fresh OS from an old ISO image which predates the fix. Disabling external network prevents automatic installation of updates; it also blocks "Windows activation" so you will have only a few days or weeks to try it (but you can "stall" the clock between runs: since the VM has no external network, it has no way of cross-checking its knowledge of the internal clock).

If the VM technology is VirtualBox, use "Host-only networking" as described in the manual. This will allow your own desktop system to access the server in the VM.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.