code-white.com/blog/leaking-objrefs-to-exploit-http-dotnet-remoting

Preview meta tags from the code-white.com website.

Linked Hostnames

17

Thumbnail

Search Engine Appearance

Google

https://code-white.com/blog/leaking-objrefs-to-exploit-http-dotnet-remoting

CODE WHITE | Leaking ObjRefs to Exploit HTTP .NET Remoting

Although already considered deprecated in 2009, .NET Remoting is still around. Even where developers might not expect it such as in ASP.NET web applications, both on-premises and on Azure. In this blog post, we will elaborate on an hidden attack surface in ASP.NET web applications that might unknowingly leak internal object URIs, which can be used to perform .NET Remoting attacks via HTTP, possibly allowing unauthenticated remote code execution.



Bing

CODE WHITE | Leaking ObjRefs to Exploit HTTP .NET Remoting

https://code-white.com/blog/leaking-objrefs-to-exploit-http-dotnet-remoting

Although already considered deprecated in 2009, .NET Remoting is still around. Even where developers might not expect it such as in ASP.NET web applications, both on-premises and on Azure. In this blog post, we will elaborate on an hidden attack surface in ASP.NET web applications that might unknowingly leak internal object URIs, which can be used to perform .NET Remoting attacks via HTTP, possibly allowing unauthenticated remote code execution.



DuckDuckGo

https://code-white.com/blog/leaking-objrefs-to-exploit-http-dotnet-remoting

CODE WHITE | Leaking ObjRefs to Exploit HTTP .NET Remoting

Although already considered deprecated in 2009, .NET Remoting is still around. Even where developers might not expect it such as in ASP.NET web applications, both on-premises and on Azure. In this blog post, we will elaborate on an hidden attack surface in ASP.NET web applications that might unknowingly leak internal object URIs, which can be used to perform .NET Remoting attacks via HTTP, possibly allowing unauthenticated remote code execution.

  • General Meta Tags

    4
    • title
      CODE WHITE | Red Teaming & Attack Surface Management
    • charset
      utf-8
    • viewport
      width=device-width, initial-scale=1
    • description
      Although already considered deprecated in 2009, .NET Remoting is still around. Even where developers might not expect it such as in ASP.NET web applications, both on-premises and on Azure. In this blog post, we will elaborate on an hidden attack surface in ASP.NET web applications that might unknowingly leak internal object URIs, which can be used to perform .NET Remoting attacks via HTTP, possibly allowing unauthenticated remote code execution.

  • Open Graph Meta Tags

    5
    • og:title
      CODE WHITE | Leaking ObjRefs to Exploit HTTP .NET Remoting
    • og:description
      How leaking valid `ObjRef`s to target .NET Remoting for Remote Code Execution is not considered a vulnerability – at least according to Microsoft.
    • og:type
      article
    • og:url
      https://code-white.com/blog/leaking-objrefs-to-exploit-http-dotnet-remoting/
    • og:image
      https://code-white.com/images/featured.png

  • Link Tags

    20
    • alternate
      https://code-white.com/index.xml
    • alternate
      https://code-white.com/blog/index.xml
    • canonical
      https://code-white.com/blog/leaking-objrefs-to-exploit-http-dotnet-remoting/
    • stylesheet
      https://code-white.com/css/header.css
    • stylesheet
      https://code-white.com/css/style.css

Links

67