CVE-2023-36899

This repository provides a detailed writeup and proof-of-concept for CVE-2023-36899, which exploits the cookieless session feature in ASP.NET Framework to bypass IIS authentication and application pool restrictions.

This PoC exploits CVE-2023-36899 by crafting a malicious URL that bypasses cookie-based authentication in a .NET web application. It uses WinHTTP to send a GET request to a vulnerable path, demonstrating an authentication bypass vulnerability.