Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to install the vulnerable version of ASP.NET for testing purposes. I've thought about it and I guess the best way would be to delete/disable some security updates to make that possible. Currently I'm running windows XP with all security updates installed.

On the following link http://weblogs.asp.net/scottgu/archive/2010/09/30/asp-net-security-fix-now-on-windows-update.aspx I've seen that the 3.5 ASP.NET security update was KB2416471, but I didn't found that update on my system, so I guess it must have the newer version of ASP.NET 3.5 installed which already has this fixed.

Any idea how would I get my hands on the system that is still vulnerable to the Padding Oracle on the ASP.NET Forms Authentication cookie to test it?

share|improve this question
1  
It's a padding oracle, not oracle padding. –  CodesInChaos Jan 27 '13 at 19:05
add comment

1 Answer

I would suggest running a virtual machine with external network disabled, and install a fresh OS from an old ISO image which predates the fix. Disabling external network prevents automatic installation of updates; it also blocks "Windows activation" so you will have only a few days or weeks to try it (but you can "stall" the clock between runs: since the VM has no external network, it has no way of cross-checking its knowledge of the internal clock).

If the VM technology is VirtualBox, use "Host-only networking" as described in the manual. This will allow your own desktop system to access the server in the VM.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.