Collected research

Invisibility Purge / .NET Havoc

Invisibility Purge (Slides)

Shay Chen and Niv Sela · Hacktics Advanced Security Center, Ernst & Young

Hidden, disabled or commented ASP.NET and Mono controls can still expose executable server events. The slides map EventValidation and ViewState prerequisites, describe control enumeration and reuse of cached signed state, and introduce the SCIP testing extension. Authorization must be checked inside the event handler.

Record

Document

Invisibility Purge (Slides)

Researcher

Shay Chen and Niv Sela

Published by

Hacktics Advanced Security Center, Ernst & Young

Format

Slides

Topic

Other

In the archive

• Collected in the 2013 research round

Related sources

• .NET Havoc — Manipulating Properties of Dormant Server Side Web Controls (Slides) Slides

Tags

• auth-bypass
• aspnet
• dotnet
• tooling
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Shay Chen and Niv Sela, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 September 2026.