Microsoft ASP

# check-aspnet-validaterequest.ps1

# Exit codes:

#   0 = PATCHED / not applicable

#   1 = VULNERABLE / high-likelihood legacy exposure indicators found

#   2 = UNKNOWN / ASP.NET present but exploitability cannot be proven from host config


$ErrorActionPreference = 'SilentlyContinue'

function Add-Finding {
    param([string]$Message)
    $script:Findings += $Message
}

$Findings = @()
$AspNetPresent = $false
$LegacyIndicators = $false
$ModernIndicators = $false

# Detect IIS

$iisSvc = Get-Service -Name W3SVC
if ($iisSvc) { $AspNetPresent = $true }

# Detect .NET Framework installs

$ndp = 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP'
$versions = @()
Get-ChildItem $ndp -Recurse | ForEach-Object {
    $p = Get-ItemProperty $_.PSPath
    if ($p.Version -and $p.Install -eq 1) {
        $versions += [PSCustomObject]@{ Name = $_.PSChildName; Version = $p.Version }
    }
}
if ($versions.Count -gt 0) { $AspNetPresent = $true }

# Candidate config paths

$paths = @(
    "$env:windir\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config",
    "$env:windir\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config",
    "$env:windir\Microsoft.NET\Framework\v4.0.30319\CONFIG\machine.config",
    "$env:windir\Microsoft.NET\Framework64\v4.0.30319\CONFIG\machine.config",
    "$env:SystemDrive\inetpub\wwwroot"
)

# Add discovered web.config files under common IIS roots

$commonRoots = @("$env:SystemDrive\inetpub", "$env:SystemDrive\web", "$env:SystemDrive\sites")
foreach ($root in $commonRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Filter web.config -Recurse -Force -ErrorAction SilentlyContinue | ForEach-Object {
            $paths += $_.FullName
        }
    }
}

$paths = $paths | Sort-Object -Unique

foreach ($path in $paths) {
    if (-not (Test-Path $path)) { continue }

    if ((Get-Item $path).PSIsContainer) {
        Get-ChildItem -Path $path -Filter web.config -Recurse -Force -ErrorAction SilentlyContinue | ForEach-Object {
            $file = $_.FullName
            $content = Get-Content -Path $file -Raw -ErrorAction SilentlyContinue
            if (-not $content) { return }
            $AspNetPresent = $true

            if ($content -match 'requestValidationMode\s*=\s*"2\.0"' -or $content -match 'requestValidationMode\s*=\s*"0\.0"') {
                $LegacyIndicators = $true
                Add-Finding "Legacy requestValidationMode in $file"
            }
            if ($content -match 'validateRequest\s*=\s*"false"') {
                $LegacyIndicators = $true
                Add-Finding "validateRequest=false in $file"
            }
            if ($content -match 'ValidateInput\s*\(\s*false\s*\)' -or $content -match 'AllowHtml' -or $content -match 'Request\.Unvalidated') {
                $LegacyIndicators = $true
                Add-Finding "Application code/config bypass marker referenced near $file"
            }
            if ($content -match 'requestValidationMode\s*=\s*"4\.0"' -or $content -match 'requestValidationMode\s*=\s*"4\.5"') {
                $ModernIndicators = $true
                Add-Finding "Modern requestValidationMode in $file"
            }
        }
    }
    else {
        $content = Get-Content -Path $path -Raw -ErrorAction SilentlyContinue
        if (-not $content) { continue }
        $AspNetPresent = $true

        if ($content -match 'requestValidationMode\s*=\s*"2\.0"' -or $content -match 'requestValidationMode\s*=\s*"0\.0"') {
            $LegacyIndicators = $true
            Add-Finding "Legacy requestValidationMode in $path"
        }
        if ($content -match 'validateRequest\s*=\s*"false"') {
            $LegacyIndicators = $true
            Add-Finding "validateRequest=false in $path"
        }
        if ($content -match 'requestValidationMode\s*=\s*"4\.0"' -or $content -match 'requestValidationMode\s*=\s*"4\.5"') {
            $ModernIndicators = $true
            Add-Finding "Modern requestValidationMode in $path"
        }
    }
}

# Version heuristics

$hasOnlyModern = $true
foreach ($v in $versions) {
    if ($v.Version -match '^1\.' -or $v.Version -match '^2\.' -or $v.Version -match '^3\.') {
        $hasOnlyModern = $false
        Add-Finding "Legacy .NET Framework present: $($v.Name) $($v.Version)"
    }
}
if ($versions.Count -eq 0) { $hasOnlyModern = $false }

if (-not $AspNetPresent) {
    Write-Output 'PATCHED'
    Write-Output 'No IIS/ASP.NET footprint found on this host.'
    exit 0
}

if ($LegacyIndicators) {
    Write-Output 'VULNERABLE'
    Write-Output 'Legacy ASP.NET request-validation indicators found:'
    $Findings | Sort-Object -Unique | ForEach-Object { Write-Output " - $_" }
    exit 1
}

if ($hasOnlyModern -and $ModernIndicators) {
    Write-Output 'PATCHED'
    Write-Output 'Only modern ASP.NET request-validation indicators were found; app-level XSS review may still be warranted, but no strong legacy exposure markers were detected.'
    exit 0
}

Write-Output 'UNKNOWN'
Write-Output 'ASP.NET is present, but host configuration alone cannot prove whether any application actually reflects untrusted input without output encoding.'
if ($Findings.Count -gt 0) {
    $Findings | Sort-Object -Unique | ForEach-Object { Write-Output " - $_" }
}
exit 2