Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'd like to audit my viewstate for information I don't want to be sent down to the client. What are the steps needed to decrypt this information into human readable form?

How would I decrypt the cookies?

Are there any tools (akin to Firesheep) that will help with the process?


share|improve this question
add comment

3 Answers 3

up vote 3 down vote accepted

As @blowdart mentioned, the default is to not encrypt the viewstate (again, I think that was changed in the latest versions).
If you jsut want to do an audit - set the viewstate to NOT encrypt (either the default, or manually shut it off), and then you dont need to decrypt it. Then when you're done, you can put viewstate encryption back on.
Though if you're ensuring there is no sensitive info anyway, you probably dont need the encryption, just set it to signing...

As for tools, try any of these (if its not encrypted):

share|improve this answer
add comment

Assuming you've turned the encryption on, which is not the default, ASP.NET will use the web site machine key as the key used to encrypt and sign ViewState and cookies. As you can set the machine keys (for validation and decryption) to a known value in web.config you could then use this to decrypt manually if necessary.

Configuration also allows you to override which algorithms are used, so you'd need to set those in the web.config as well to get a known starting point.

By default it's 3DES, in ECB with PKCS7 padding, and the viewstate itself is a base 64 string, so from that you'd take the base64 string, convert back to a byte array and then push through a 3DES decrypter to get the data back.

share|improve this answer
    
I think the algorithms change depending on ASP.NET version. –  AviD Nov 22 '10 at 7:11
    
Ah, kinda. They added signing with the padding oracle patch. And of course it's all configurable anyway, so you'd need to specifically set an algorithm anyway, just to be sure. –  blowdart Nov 22 '10 at 14:01
    
Do you have any details on the new signing? I'd like to learn as much as possible –  makerofthings7 Nov 22 '10 at 16:22
    
It's not been publicly discussed as far as I am aware, so I'm not going to be the first to do it :) Reflector of course would be your friend in this. –  blowdart Nov 22 '10 at 17:06
add comment

Yes this is possible. Refer to http://stackoverflow.com/questions/22814/how-to-decode-viewstate I have provided full source code in there.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.