Look into Razor MVC syntax (https://en.wikipedia.org/wiki/ASP.NET_Razor) for HTML and JavaScript encoding. In addition to that, I'd suggest setting the x-xss-protection HTTP headers properly, and for good measure it's a decent idea to have a Content Security Policy. You want to be validating your inputs, and escaping your
outputs.. Razor MVC is a good option for this in ASP.NET.
I believe ASP.NET by default will prevent typical source-based HTML injections, so what you really want to be looking out for are DOM-Based flaws (for example, URL redirection to a javascript: uri scheme) and injections in the context of in-line javascript injection (e.g. their payload landing between some script tags so they can inject pure JS code without any need for tags and/or event handlers)
Also, props to you for using my buddy Brute's browser hooking payload/syntax ;D rather than using some beef hooks. Brute is great at XSS stuff :) he's a chill friend of mine. I'm assuming you know him since that's his browser hooking payload that you posted.
There was a (kinda recent) request validation bypass method for ASP.NET, although I'd be surprised if it wasn't patched by now because it was pretty high-profile at the time that it got released. Check this out, though - https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/september/rare-aspnet-request-validation-bypass-using-request-encoding/ if it isn't patched then you want to be using Razor MVC to ensure that you're properly sanitizing malicious inputs of this nature.
but yeah, the other answer summarized things pretty well, here's what you want to do:
- validate inputs / escape outputs (I'd suggest using Razor for this)
- implement a Content Security Policy
- Ensure you don't mess anything up regarding ViewState MAC auth (as this could lead to XSS in ASP.NET)
- Add the x-xss-protection headers with the correct mode
- Implement CORS rules
With those measures in place, you should be good... as long as you take into consideration all forms of DOM-Based attacks (as DOM-Based XSS can get around some of these countermeasures).