# Blacklist3r | Accumulate Secret Keys / Secret Materials Related To Various Web Frameworks

**URL:** <https://onehack.st/t/blacklist3r-accumulate-secret-keys-secret-materials-related-to-various-web-frameworks/251570>\
**Category:** Tools & Scripts\
**Tags:** tools, privacy\
**Created:** [July 11, 2023, 10:10pm UTC](https://onehack.st/t/blacklist3r-accumulate-secret-keys-secret-materials-related-to-various-web-frameworks/251570 "2023-07-11T22:10:58Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [July 11, 2023, 10:10pm UTC](https://onehack.st/t/blacklist3r-accumulate-secret-keys-secret-materials-related-to-various-web-frameworks/251570/1 "2023-07-11T22:10:58Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/c/2/c2e1e5e037247ecf5196145662fb31d4608f4b31.jpeg)

# Blacklist3r

The goal of this project is to accumulate the secret keys / secret materials related to various web frameworks, that are publicly available and potentially used by developers. These secrets will be utilized by the Blacklist3r tools to audit the target application and verify the usage of these pre-published keys.

We are releasing this project [with.Net](http://with.Net) machine key tool to identify usage of pre-shared Machine Keys in the application for encryption and decryption of forms authentication cookie.

Note: Requires Visual Studio 2019, not 2022. Visual Studio 2022 does not support .NET Framework 4.5, which this repo relies on.

## References:

- [Project Blacklist3r](https://www.notsosecure.com/project-blacklist3r/)
- [Identify and Exploit ViewState Deserialization](https://notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/)

## Mention

- [ASP.NET Cryptography for Pentesters](https://blog.liquidsec.net/2021/06/01/asp-net-cryptography-for-pentesters/)
- [Customising Blacklist3r for OWIN OAuth Access Tokens](https://zxsecurity.co.nz/research/blacklist3r-customisation/)

## GitHub:

> **[GitHub - NotSoSecure/Blacklist3r: project-blacklist3r](https://github.com/NotSoSecure/Blacklist3r)**
>
> project-blacklist3r