You can configure ASP.NET to load HTTP Handlers and Modules for use in the request/response pipeline via the web.config file (from the file system, not over HTTP).

But if your attacker has gotten so far as to be able to tamper with these config files then it's probably game-over already.