This proof-of-concept exploit performs a Padding Oracle attack against a simple ASP.NET application (it can be any application) to download a file from the remote Web Server. In this example the proof-of-concept exploit downloads the Web.config file.

This proof of concept exploit can be found at ampliasecurity.com/research/aspx_po_chotext_attack.rb