Oracle padding exploit - how does it download the web.config?

Question

I know there are already a few questions on SO about the oracle padding exploit but none of them explain how it downloads the web.config. I run a couple of ASP .NET apps which I

Answer 1

The following post may be interesting for this thread:

http://blog.mindedsecurity.com/2010/10/breaking-net-encryption-with-or-without.html