POET vs ASP.NET: DotNetNuke

In this video we show how to use POET to attack the latest version of ASP.NET. The target application is DotNetNuke. The attack consists of two phases:

1. In the first phase, we use POET to extract DotNetNuke's secret keys, and use those keys to generate a cookie to login as a super user. The same technique can be used to attack _every_ ASP.NET application.

2. In the second phase, we use Cesar Cerrudo's Token Kidnapping attack to gain SYSTEM privilege on the Windows server hosting DotNetNuke.

This research was done by Thai Duong and Juliano Rizzo. More information can be found at http://netifera.com/research.

• Category

  Science & Technology

[cryptbe]

@Drysar0: ha! thanks for pointing out. We made a mistake because we are new to ASP.NET, and we wanted to demonstrate that error message is irrelevant, so we skimmed the documentation and thought that setting CustomErrors="Off" is the most secure.

What we can say is the setting of CustomErrors is _irrelevant_. We presented this at EKOPARTY, and we're going to release the slide deck soon.

[fukutabe]

Downvoted for douchey music.

[thomas hondema]

Do you still have the poet.py script?

[oddstrat]

I need the this poet.py script to test my asp.net app, urgently..

please help me..

i have googling a week but still not got it :(

Thanks before

[Natnael Lulie]

Please i have a problem in running poet.py in python script.it says insufficient argument.pls help!

[tiagobevilaqua]

My Listening is not good enough for that. But it took using the Shazam! - "Plain White Ts - Hey There Delilah".

[tiagobevilaqua]

My Listening is not good enough for that. But it took using the Shazam! - "Plain White Ts - Hey There Delilah".

[tiagobevilaqua]

My Listening is not good enough for that. But it took using the Shazam! - "Plain White Ts - Hey There Delilah".

[joertjoert]

Google for the lyrics. "just believe me girl sometime I'll pay the bills with this guitar" should do the trick.

[Larry Viezel]

So - assuming you have CustomErrors not set to "Off" and and redirectmode set to "ResponseRewrite" - does this protect you from this vulnerability? Or is this irrelevant?