The is to accumulate the secret keys / secret materials related to various web frameworks, that are publicly available and potentially used by developers. These secrets will be utilized by the Blacklist3r tools to audit the target application and verify the usage of these pre-published keys.

1. Blacklist3r
- Sanjay Gondaliya

2. Agenda
● Blacklist3r
● Authentication bypass in OWIN Auth cookie
● RCE using ViewState Deserialization

3. #Whoami – Sanjay Gondaliya
● Sr. Security Consultant @NotSoSecure
● 8+ Years of experience in Information Technology
● LinkedIn : https://www.linkedin.com/in/sanjaygondaliya
● Twitter : @realsanjay
● Personal Site: https://www.sanjaygondaliya.com

4. Website creation in IIS

5. WebFarm
Web Server 1 Web Server 2 Web Server 3
Load Balancer

6. Website Development
Web Server
Development Phase

7. Hosting in Production
<machineKey
validationKey="1"
decryptionKey="1"
validation="SHA1"
decryption="AES" />
<machineKey
validationKey="2"
decryptionKey="2"
validation="SHA1"
decryption="AES" />
<machineKey
validationKey="3"
decryptionKey="3"
validation="SHA1"
decryption="AES" />

8. MachineKey configuration error

9. Solution - MachineKey Configuration error

10. Solution - MachineKey Configuration error
Other test case is Open source tools integration without changes the cryptographic keys (Machine Keys)

11. What is Blacklist3r?
● Tool to audit the .NET web applications
○ MVC
○ WebForm
○ etc.
● against usage of pre-published machine
keys.

12. Blacklist3r - Collection of keys

14. Demo
● Authentication bypass in Owin.cookie
● ViewState Deserialization
Demo web application

15. Authentication bypass in Owin.cookie
● Two users created
○ sanjay@mailinator.com
○ admin@mailinator.com
● Goal
○ Impersonate sanjay@mailinator.com to
admin@mailinator.com user.
Demo web application

16. ViewState desealization
.NET used “ObjectStateFormatter”
● To deserialize ViewState
“ObjectStateFormatter” supported gadget of YSoSerial.Net
● ActivitySurrogateSelectorFromFile
● ActivitySurrogateSelector
● TextFormattingRunProperties
● PSObject
● TypeConfuseDelegate

17. ViewState Deserialization RCE
● Legacy (.NET < 4.5) version
● MAC Enabled
● Encryption Disabled
Demo web application

18. ViewState Deserialization RCE
● .NET >= 4.5 version
● MAC Enabled/Disabled
● Encryption Enabled/Disabled
Demo web application