INVISIBILITY PURGE – UNMASKING THE DORMANT EVENTS OF INVISIBLE WEB CONTROLS – ADVANCED HACKING METHODS FOR ASP.NET, MONO AND RIA

No ratings

Presented at BlackHat EU 2013 by

Shay Chen

"N/A Server Web Controls are common components in modern platforms that speed up development and enable content reuse. Since events of server controls implement additional application features, they might be protected via privilege validation, comments or properties that disable or render them invisible. However, since Invisibility, by definition, is in the eyes of the beholder, an invisible object can still be visible to instruments designed to locate it. By abusing the event activation mechanism of server controls, it's possible to enumerate and execute dormant events, in-spite of most security measures - all using a refined methodology and a new designated tool."