Later archive addition

Invisibility Purge / .NET Havoc

Shay Chen and Niv Sela · Hacktics Advanced Security Center, Ernst & Young

Hidden, disabled or commented ASP.NET and Mono controls can still expose executable server events. The slides map EventValidation and ViewState prerequisites, describe control enumeration and reuse of cached signed state, and introduce the SCIP testing extension. Authorization must be checked inside the event handler.

Record

Researcher

Shay Chen and Niv Sela

Published by

Hacktics Advanced Security Center, Ernst & Young

Format

Slides

In the archive

• Added to the 2013 archive after the original list was published

Related sources

• .NET Havoc (Slides)

Tags

• auth-bypass
• aspnet
• dotnet
• tooling
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Shay Chen and Niv Sela, first published at the original source. Preserved copies are kept so the citation survives its host.