I would like to install the vulnerable version of ASP.NET for testing purposes. I've thought about it and I guess the best way would be to delete/disable some security updates to make that possible. Currently I'm running windows XP with all security updates installed.

On the following link http://weblogs.asp.net/scottgu/archive/2010/09/30/asp-net-security-fix-now-on-windows-update.aspx I've seen that the 3.5 ASP.NET security update was KB2416471, but I didn't found that update on my system, so I guess it must have the newer version of ASP.NET 3.5 installed which already has this fixed.

Any idea how would I get my hands on the system that is still vulnerable to the Padding Oracle on the ASP.NET Forms Authentication cookie to test it?

  • 1
    It's a padding oracle, not oracle padding. Commented Jan 27, 2013 at 19:05

1 Answer 1


I would suggest running a virtual machine with external network disabled, and install a fresh OS from an old ISO image which predates the fix. Disabling external network prevents automatic installation of updates; it also blocks "Windows activation" so you will have only a few days or weeks to try it (but you can "stall" the clock between runs: since the VM has no external network, it has no way of cross-checking its knowledge of the internal clock).

If the VM technology is VirtualBox, use "Host-only networking" as described in the manual. This will allow your own desktop system to access the server in the VM.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .