Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was using Burp Suite to do some security testing on a site and I noticed that when it detects ViewState it will automatically tell you whether it has MAC enabled.

I'm curious if anyone know of a programatic way to determine if MAC is enabled if you are crawling a site without actually attempting to modify the ViewState, submit it and see if anything blows up?

From what I can tell Burp Suite is doing this just by look at the request (and not modifying/submitting).

share|improve this question
    
Cross posting between Stackexchange websites is highly discouraged. stackoverflow.com/questions/17841544/… –  Lucas Kauffman Jul 24 '13 at 18:43
add comment

2 Answers

ViewStates are basically BASE64 encoded strings. So what you can do is try to decode them with a BASE64 decoder. If it's encrypted you will get some binary content which is not really readable. If no encryption is used you will be able to see the contents. For instance Fiddler2 can assist you in decoding ViewStates in your browser.

Now there is also the option of using a MAC:

If the viewstate has its MAC enabled then there The security of this system lies in the secrecy of the secret key value. This value is always stored on the server, either in memory or in a configuration file (more on this later)—it is never written to the page. Without knowing the key, there would be no way for an attacker to compute a valid view state hash.

from MSDN "View State Security".

You can check this by decoding the VIEWSTATE (if not encrypted) and verify if a 20-byte hash is present at the end of the ViewState structure.

share|improve this answer
    
+1 for introducing a great tool. Does it do all what you can get from burp or owasp zap? Or its focus is catching developers mindset. –  Saladin Jul 24 '13 at 19:14
    
It's just for deserializing and viewing viewstates :) –  Lucas Kauffman Jul 24 '13 at 19:19
add comment

The "ViewState" is part of the page, as a hidden field value to be sent back to the server. If the ViewState is protected by a MAC then the MAC value is part of it, so it is a matter of extracting the ViewState value from the page, decoding it, and then see if there is a MAC or not. Burp does just that.

ViewState format is not publicly documented (you are not supposed to fiddle with it) but it has been reverse engineered.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.