hunt-aspnet

Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, request-validator bypass, trace.axd/elmah.axd disclosure, load-balanced ViewState cross-node failures, SafeControl enumeration via reflection, customErrors mode=Off stack-trace leaks, classic Webforms .aspx/.asmx/.svc surface. Built for ASP.NET Webforms + WCF + SharePoint farms.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced hunting playbook with strong code examples and a validation gate. Weaknesses are minor verbosity in illustrative sections and a monolithic single-file structure that underuses progressive disclosure.

Suggestions

Move the Real Impact Examples and the longer Payload & Detection Patterns into reference files under references/ and link them from SKILL.md to improve progressive disclosure and reduce inline token load.

Tighten the Crown Jewel Targets list and trim explanatory asides in the methodology to lift conciseness toward 5.

Interleave a quick validation/confirmation note after the key recon steps (not only at Gate 0) to strengthen workflow feedback loops.

Dimension	Reasoning	Score
Conciseness	Mostly efficient operational prose that assumes Claude's competence (no generic 'what is ViewState' padding), but the three full Real Impact Examples and some explanatory asides could be trimmed; not a 5 because length could be reduced without losing clarity.	4 / 5
Actionability	Provides copy-paste-ready curl and Python probes — e.g. the 7-shape ViewState differential script and `trace.axd` anonymous check — covering the common cases with executable, specific commands.	5 / 5
Workflow Clarity	A clear 12-step methodology plus a Gate 0 Validation checklist gives good sequencing and a validation gate, but checkpoints are concentrated at report-time rather than interleaved per-step, leaving minor validation gaps vs the anchor above.	4 / 5
Progressive Disclosure	The file is well-headed but is a 271-line monolith with no bundle files (references/scripts/assets are empty); content like the payload-pattern block and Real Impact Examples could live in reference files to slim SKILL.md, matching the 'content that should be separate is inline' anchor.	3 / 5
	Total	16 / 20 Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, distinctive ASP.NET hunting description with excellent trigger-term coverage. Its only weakness is the lack of an explicit 'Use when...' trigger clause, which caps completeness at 3.

Suggestions

Add an explicit trigger clause such as 'Use when hunting ASP.NET Webforms, WCF, or SharePoint targets for bug bounty or authorized pentest.' to raise completeness.

Lead with the trigger scenario before enumerating sub-techniques so the 'when' is as prominent as the 'what'.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete hunting targets/actions — 'ViewState deserialization (signed-only vs encrypted)', 'machineKey recovery', 'dual-parser MAC-bypass', 'SafeControl enumeration via reflection', 'customErrors mode=Off stack-trace leaks' — matching the comprehensive-coverage anchor.	5 / 5
Completeness	The 'what' is clear and comprehensive, but there is no explicit 'Use when...' trigger clause; 'Built for ASP.NET Webforms + WCF + SharePoint farms' is a target-scope statement, only weakly implying 'when', so the missing-trigger cap of 3 applies.	3 / 5
Trigger Term Quality	Natural terms a bug-bounty hunter would actually say are densely present — 'ASP.NET', 'ViewState', 'machineKey', 'trace.axd', 'elmah.axd', 'Webforms', 'WCF', 'SharePoint', '.aspx/.asmx/.svc' — covering synonyms and file extensions.	5 / 5
Distinctiveness Conflict Risk	A clearly bounded ASP.NET-specific niche (Webforms + WCF + SharePoint farms) with distinct triggers and minimal overlap with sibling skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-aspnet/SKILL.md
Commit: 58017df

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.