net-route-mapper

ASP.NET Source Route & Parameter Mapper

From ASP.NET Web project source code (including decompiled artifacts of closed-source dlls)extractall HTTP routes and request parameter structures, providing complete routing data for downstream vulnerability audit Skills.Do not perform security vulnerability assessment, code quality analysis, or output anything beyond the scope of route extraction.

⚠️ Core requirement: complete output

This skill must output all discovered routes; omissions are not allowed.

✅ Every route must have complete parameter analysis (Query / Form / Body / Path / Header / Cookie / RouteValue)
✅ Output the total number of routes and a list for verification
❌ Do not use "...", "etc.", or "other" to omit
❌ Do not output only "key interfaces" or "important interfaces"
❌ Do not omit due to large quantity

📌 Applicable scenarios

Interface inventory of ASP.NET projects without API documentation
Restore accessible endpoints after decompiling closed-source dlls
Provide input for downstream skills such as net-auth-audit / net-sql-audit

🧩 Supported project types

Type	Entry identifier	Route carrier
ASP.NET Web Forms	`.aspx` / `.ashx` / `.asmx`	Physical file path + `Global.asax` in `MapPageRoute`
ASP.NET MVC 5 and below	`App_Start/RouteConfig.cs` + `Global.asax`	`RouteCollection.MapRoute` + Controller/Action convention
ASP.NET Core (.NET 5/6/7+)	`Program.cs` / `Startup.cs`	`MapControllerRoute` / `MapControllers` / attribute routing `[Route]`/`[HttpGet]`
Web API 2 (.NET Framework)	`App_Start/WebApiConfig.cs`	`config.Routes.MapHttpRoute` + `[RoutePrefix]`/`[Route]`
Minimal API (.NET 6+)	`Program.cs`	`app.MapGet/MapPost/...`

0. Project type identification (must be the first step)

Before performing any route extraction, the project type must first be determined according to the following process:

0.1 Check the entry file extension

A large number of .aspx/.asax/.ashx/.asmx physical files exist → possibly Web Forms(may also be mixed in MVC)
Exists App_Start/RouteConfig.cs → ASP.NET MVC 5 or earlier
Exists App_Start/WebApiConfig.cs → Web API 2
Exists Program.cs calls in WebApplication.CreateBuilder → ASP.NET Core / Minimal API
Only bin/ under the directory .dll without .cs source code → closed-source project, must go through the shared binary preprocessing process: first reuse/generate {project}_audit/deobfuscated/ and {project}_audit/decompiled/ artifact declarations, then analyze the decompiled code (see references/DECOMPILE_STRATEGY.md）

0.2 Check the declaration at the top of .aspx

The .aspx directive at the top of each <%@ Page %> is the key to locating the backend code:

<%@ Page Language="C#" AutoEventWireup="true"
         CodeBehind="DBModules.aspx.cs"
         Inherits="JHSoft.Web.WorkFlat.DBModules" %>

Extraction rules:

Inherits The value of = namespace.class name
The first part (such as JHSoft.Web.WorkFlat) corresponds to bin/ the dll file name in
The second part (DBModules) is the class name / backend control class
CodeBehind is valid only in source code projects; if only a dll is available, it must bedecompiled JHSoft.Web.WorkFlat.dll the DBModules class in

0.3 Check web.config

Check the <system.web> / <authentication> / <authorization> section to understand the authentication method (used for the "no authentication" annotation of routes)
Inspect the <httpHandlers> / <handlers> section, identify custom IHttpHandler registered URL → class mappings

0.4 Inspect the bin directory and namespaces

Closed-source project: prioritize reusing the shared decompilation artifacts declared by {project}_audit/decompiled/manifest.json ; if they do not exist or are incomplete, follow references/DECOMPILE_STRATEGY.md to first deobfuscate/decompile and generate the manifest, then globally search for namespace *.Controllers to locate the control layer
Note: theSystem.* namespace belongs to the .NET built-in class library and must be excluded
Globally search for RegisterRoutes / MapRoute / MapControllerRoute / MapPageRoute / Application_Start

0.5 Quick determination of framework vs. non-framework

Form	Determination
`bin/.dll` + `Views/.cshtml` + paths shaped like `/Home/Index`	MVC framework
Scattered `.aspx` physical files, URLs directly correspond to file paths	Web Forms (non-framework)

1. ASP.NET MVC 5 and below route extraction

1.1 Route configuration location

Main file: theApp_Start/RouteConfig.cs method in RegisterRoutes(RouteCollection routes) Method
Registration entry: theGlobal.asax.cs in Application_Start calls RouteConfig.RegisterRoutes(RouteTable.Routes)

// App_Start/RouteConfig.cs
public class RouteConfig
{
    public static void RegisterRoutes(RouteCollection routes)
    {
        routes.IgnoreRoute("{resource}.axd/{*pathInfo}");
        routes.MapRoute(
            name: "Default",
            url: "{controller}/{action}/{id}",
            defaults: new { controller = "Home", action = "Index", id = UrlParameter.Optional }
        );
    }
}

1.2 Extraction steps

Parse all RouteConfig.cs calls in MapRoute(...) , record each route template (including name / url / defaults / constraints）
From defaults derive the default controller / action
Globally search for classes that inherit from Controller / ApiController (the namespace often contains .Controllers）
For each Controller, enumerate all public methods as Actions (excluding [NonAction]）
Inspect the attributes on each Action:[HttpGet]/[HttpPost]/[Route(...)]/[ActionName(...)]/[Authorize]/[AllowAnonymous]
Generate the final URL by superimposing the conventional route template ({controller}/{action}/{id}) + attribute routes
For each Action's formal parameters, classify the parameter sources according to the following rules:
- [FromBody] annotated or a complex model → Body
- [FromUri]/[FromQuery] or primitive types → Query / RouteValue
- Appears as a placeholder in the URL template → Path
- HttpContext.Request.Form[...] / Request["..."] → Form / Mixed
When the closed-source project has no RouteConfig.cs ,first decompile the dll, then execute according to the above rules

1.3 Key search terms

MapRoute / RegisterRoutes / RouteTable.Routes / IgnoreRoute
: Controller / : ApiController
[Route( / [HttpGet( / [HttpPost( / [HttpPut( / [HttpDelete(
[RoutePrefix(

2. ASP.NET Core (.NET 5/6/7+) route extraction

2.1 Route configuration location

Program.cs(.NET 6+) or Startup.cs::Configure（.NET Core 3.1）
Key middleware:app.UseRouting() + app.UseEndpoints(...) or minimal API app.MapGet/MapPost/...

// Program.cs (.NET 6+) 约定路由
var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();
app.UseRouting();
app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Index}/{id?}");
app.Run();

// 属性路由（推荐写法）
[Route("api/[controller]")]
public class ProductsController : Controller
{
    [HttpGet("{id}")]                 // GET  /api/products/{id}
    public IActionResult GetProduct(int id) { ... }

    [HttpPost]                         // POST /api/products
    public IActionResult Create([FromBody] Product p) { ... }
}

2.2 Extraction steps

Parse Program.cs / Startup.cs：
- MapControllerRoute / MapDefaultControllerRoute / MapAreaControllerRoute → record the conventional route template
- MapControllers() → indicates pure attribute routing
- app.MapGet/MapPost/MapPut/MapDelete/MapMethods → record the minimal API endpoint
Globally search for classes that inherit ControllerBase / Controller class
Extract class-level [Route("...")]、[ApiController]、[Area("...")]
Extract method-level [HttpGet("...")] / [HttpPost("...")] / [Route("...")] / [AcceptVerbs(...)]
URL = class-level Route + method-level Route, and expand tokens:
- [controller] → class name with the Controller suffix removed
- [action] → method name
- [area] → area name
Parameter analysis:
- [FromBody] / [FromForm] / [FromQuery] / [FromRoute] / [FromHeader] / [FromServices]
- Not annotated + simple type → default Query / Route (depending on the template)
- Not annotated + complex type → default Body (API Controller) or Form (MVC)
[Authorize] / [AllowAnonymous] must be recorded on each route for use by the downstream authentication skill

2.3 Key search terms

WebApplication.CreateBuilder
UseRouting / UseEndpoints / MapControllers / MapControllerRoute
MapGet( / MapPost( / MapPut( / MapDelete( / MapMethods(
[ApiController] / [Route( / [HttpGet( / [HttpPost(
[Authorize / [AllowAnonymous

3. ASP.NET Web Forms route extraction

3.1 Two route forms

3.1.1 Physical file paths (default)

Each .aspx file itself is a route, and the URL is directly the relative path:

/Default.aspx
/admin/UserList.aspx
/Contact.aspx?id=123

3.1.2 Friendly URLs (manual registration)

In Global.asax.cs::Application_Start register via MapPageRoute :

protected void Application_Start(object sender, EventArgs e)
{
    RouteTable.Routes.MapPageRoute(
        "ProductsRoute",            // 路由名称
        "products/{category}",       // URL 模式
        "~/Products.aspx"           // 实际页面
    );
}

3.2 Extraction steps

Enumerate all .aspx / .ashx / .asmx physical files, and record their relative paths as the base URL
Parse the .aspx directive at the top of each <%@ Page %> :
- Inherits="X.Y.Z.ClassName" → full name of the backend class
- CodeBehind="X.aspx.cs" → source file (decompile the dll when there is no source code)
Decompile/view the backend class, and extract:
- Page_Load(object sender, EventArgs e): page load logic
- Control event methods:btnSubmit_Click / gridView_RowCommand / LinkButton1_Click , etc.
- IHttpHandler.ProcessRequest(for .ashx)
Parameter analysis:
- Request.QueryString["x"] → Query parameter x
- Request.Form["y"] → Form parameter y
- Request["z"] → Mixed（QueryString ∪ Form ∪ Cookies ∪ ServerVariables）
- control txtUser.Text / ddlRole.SelectedValue → indirect Form (control name=ctl00$... form)
- Request.Cookies / Request.Headers → Cookie / Header
Parse all Global.asax.cs in MapPageRoute(...), and associate the URL pattern with the target .aspx Associate
Parse the web.config of <httpHandlers>/<handlers>, and record the custom Handler URL
For .asmx Web Service, list all methods annotated with [WebMethod] , with URLs of the form /Service.asmx/MethodName, and the parameters are the method's formal parameters

3.3 Key search terms

<%@ Page  /  <%@ Control  /  <%@ WebService  /  <%@ WebHandler
Inherits="
MapPageRoute
Page_Load / OnLoad
Request.QueryString / Request.Form / Request.Cookies / Request.Headers
[WebMethod]
IHttpHandler / ProcessRequest

4. Shared binary preprocessing workflow (when there is no .cs source code)

For the complete workflow, see references/DECOMPILE_STRATEGY.md. Key points:

Source code first: if the project has usable .cs / .csproj / Program.cs / Startup.cs / App_Start source code, analyze the source code directly; enter binary preprocessing only when the source code is missing or the backend class exists only in a dll.
Check the shared decompilation declaration first: if {project}_audit/decompiled/manifest.json exists, its status is success or an acceptable partial, and input_dir matches the current target, directly reuse {project}_audit/decompiled/。
Obfuscation identification (preliminary): first sample and inspect the target dll in bin/ ; if member names such as \u0001 / \u0002 , single-character namespaces, or strings <dll> | grep -i confuser matching an obfuscator watermark appear, it indicates the assembly has been obfuscated → skip to step 4; otherwise skip to step 5
Deobfuscation (only when obfuscated): use de4dot to clean bin/ → {project}_audit/deobfuscated/bin_clean/in a batch, and generate {project}_audit/deobfuscated/DEOBFUSCATE_MANIFEST.md and {project}_audit/deobfuscated/manifest.json; subsequent ilspycmd must preferentially use this bin_clean/ as input and --referencepath
Decompile and declare: use ilspycmd to batch decompile all project dlls under bin/(or {project}_audit/deobfuscated/bin_clean/), output to {project}_audit/decompiled/<AssemblyName>/, and generate {project}_audit/decompiled/DECOMPILE_MANIFEST.md and {project}_audit/decompiled/manifest.json
Do not silently ignore failures: the manifest must record the success / partial / failed / skipped status of each dll/exe; if the entry assembly fails, the route output must indicate that the audit is incomplete
Locate the entry:
- Global search RegisterRoutes / Application_Start / MapPageRoute / MapControllerRoute
- Global search namespace *.Controllers, filter System.*
When there is only Global.asax and no route configuration class, first confirm in the shared decompilation artifacts Global.asax the corresponding dll's Application_Start, then locate the RouteConfig class it calls
Closed-source Web Forms: use the .aspx in the Inherits value to look up dll → class → method
Deobfuscation and decompilation artifacts are both project-level shared audit evidence, for reuse by net-route-mapper、net-auth-audit、net-sql-audit and other skills

5. Output Specification

Output is uniformly saved to the {project}_audit/route_mapper/ directory.

5.1 Directory Structure

{project}_audit/route_mapper/
├── README.md                  # 主索引：项目类型、路由总数、模块分布
├── routes_index.md            # 全部路由清单（按模块分组的精简表格）
├── modules/
│   ├── {ModuleA}.md          # 每模块一份详细路由
│   ├── {ModuleB}.md
│   └── ...
└── webforms_pages.md          # 仅 Web Forms 项目：物理 .aspx 列表

5.2 Minimum Information Fields for a Single Route

Each route must provide:

Field	Description
No.	Globally unique identifier
Name	Inferred function name (e.g. "User Login")
Entry location	`Namespace.Class.Method` + file relative path:line number (or decompilation artifact path)
HTTP method	GET / POST / PUT / DELETE / ANY
URL path	Final path with tokens expanded
Route form	Convention / Attribute / MapPageRoute / Physical / MinimalAPI
Parameter structure	Query / Form / Body / Path / Header / Cookie / RouteValue list
Authorization annotation	`[Authorize]` / `[AllowAnonymous]` / None / rules from `web.config` rules
Remarks	Whether obtained by decompilation, special attributes, etc.

5.3 Compact Format for Interface Blocks

Each route is output in the following format (parameters usecompact single line, tokens omitted):

=== [N] 用户登录 ===
位置: WebApplication1.Controllers.AccountController.Login
       (Controllers/AccountController.cs:42 或 decompiled/WebApplication1/Controllers/AccountController.cs:42)
HTTP 方法: POST
URL 路径: /Account/Login
路由形态: Convention（{controller}/{action}/{id}）
鉴权: [AllowAnonymous]
参数: Body(form-urlencoded): userName:string, password:string, returnUrl:string

Parameter writing specification (only write when parameters actually exist; if no parameters, fill in 无）：

For multiple types, concatenate in the order Path: ... | Query: ... | Body(...): ... | Form: ... | Header: ... | Cookie: ... | RouteValue: ... sequential concatenation
Body(...) Write the Content-Type abbreviation in parentheses:json / form-urlencoded / multipart / xml
List Header / Content-Type lines separately only in the following cases：
- multipart/form-data(file upload)
- SOAP / xml
- Custom authorization header (e.g. X-Auth-Token) and non-standard Authorization
Do not output HTTP request templates

5.4 Web Forms Physical Page List

=== Physical .aspx Pages ===
| 序号 | 页面 | URL | 后端类 | dll | 鉴权 |
|------|------|------|--------|-----|------|
| 1 | Default.aspx | /Default.aspx | WebApplication1.Default | WebApplication1.dll | 无 |
| 2 | admin/UserList.aspx | /admin/UserList.aspx | WebApplication1.Admin.UserList | WebApplication1.dll | <authorization> 拒绝匿名 |

See the detailed output template in references/OUTPUT_TEMPLATE.md。

6. Execution Checklist

After completion, check item by item:

Project type identified (MVC5 / Core / WebForms / WebAPI / Minimal API / hybrid)
All RegisterRoutes / MapRoute / MapControllerRoute / MapPageRoute / MapGet* calls recorded
All Controllers enumerated (including those in decompilation artifacts)
All Actions enumerated (including [Route] / [HttpGet] / [HttpPost] / [NonAction]）
Web Forms: all .aspx / .ashx / .asmx physical files enumerated
Web Forms: each .aspx 's Inherits and corresponding dll parsed Inherits with the corresponding dll
Closed-source project has generated/reused {project}_audit/deobfuscated/manifest.json(when not obfuscated, declare the skip reason in the decompilation manifest)
Closed-source project has generated/reused {project}_audit/decompiled/manifest.json
All closed-source dll/exe decompiled and stored, failed or skipped assemblies recorded
Parameter sources analyzed for every route (Query / Form / Body / Path / Header / Cookie)
Every route has recorded [Authorize] / [AllowAnonymous] annotation
Output files saved by {project}_audit/route_mapper/ directory
Total route count matches the list, none omitted

7. Reference Documents

references/ASPNET_MVC5.md: Detailed rules for MVC 5 / Web API 2
references/ASPNET_CORE.md: Detailed rules for ASP.NET Core / Minimal API
references/ASPNET_WEBFORMS.md: Detailed rules for Web Forms
references/DECOMPILE_STRATEGY.md: dll decompilation strategy
references/OUTPUT_TEMPLATE.md: standard output template