I searched in google for "ASP.Net 4.0.30319 vulnerability " keyword. finally,I found "Microsoft ASP.NET Forms Authentication Bypass" in below link:


but I don't know how to penetration test this vulnerability. otherwords , if someone get me one application that implemented by ASP.Net 4.0.30319 ,I can't proof exists this vulnerability.

My question is how to prove the existence of this vulnerability in a ASP.NET Applications? Do the necessary steps to patch this vulnerability has done by programer?

  • The details in the link provide your answer. I'm not sure what else you are looking for. Your last sentence is very unclear. – schroeder Oct 26 '14 at 21:15

First, please review the corresponding MS bulletin on this vulnerability (MS11-100). Which you could have found by googling the CVE. I would recommend reading through this document, googling anything you do not understand and then checking the patch and versions depending on your operating system.

If the corresponding patches are installed on the machine, this would indicate that it is not vulnerable. If you are using something like nessus, you can prove it exists, there seems to be a nessus plugin to check for this (plugin id 57414).

Also, the link you provided has Proof of concept code you can utilize.

For your last question, I am not intimately familiar with this, but from reading through these links it is a vulnerable in the framework not in the way the code is authored, so if you are using a patched version of the framework this issue should not be present, but please read the details yourself to verify.

  • tanks, for your reply – za_al Oct 28 '14 at 11:05
  • Where is the PoC code? It's only pinpointing the issue but there is no working PoC code? – Silver Jun 13 '17 at 7:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.