I would like to install the vulnerable version of ASP.NET for testing purposes. I've thought about it and I guess the best way would be to delete/disable some security updates to make that possible. Currently I'm running windows XP with all security updates installed.
On the following link http://weblogs.asp.net/scottgu/archive/2010/09/30/asp-net-security-fix-now-on-windows-update.aspx I've seen that the 3.5 ASP.NET security update was KB2416471, but I didn't found that update on my system, so I guess it must have the newer version of ASP.NET 3.5 installed which already has this fixed.
Any idea how would I get my hands on the system that is still vulnerable to the Padding Oracle on the ASP.NET Forms Authentication cookie to test it?