How does a website owner decrypt ASP.NET's Viewstate, and cookies

Question

I'd like to audit my viewstate for information I don't want to be sent down to the client. What are the steps needed to decrypt this information into human readable form?

How would I decrypt the cookies?

Are there any tools (akin to Firesheep) that will help with the process?

---

Answer 1

As @blowdart mentioned, the default is to not encrypt the viewstate (again, I think that was changed in the latest versions).
If you jsut want to do an audit - set the viewstate to NOT encrypt (either the default, or manually shut it off), and then you dont need to decrypt it. Then when you're done, you can put viewstate encryption back on.
Though if you're ensuring there is no sensitive info anyway, you probably dont need the encryption, just set it to signing...

As for tools, try any of these (if its not encrypted):

• http://www.pluralsight-training.net/community/blogs/fritz/archive/2007/07/17/updated-viewstate-decoder.aspx
• http://sourceforge.net/projects/viewstate/
• http://www.fiddler2.com/fiddler2/
• http://ashishware.com/ViewStatePeeker.shtml (ala firesheep, i assume you meant easy plugin to firefox)
• I also found this question on SO.

Answer 2

Assuming you've turned the encryption on, which is not the default, ASP.NET will use the web site machine key as the key used to encrypt and sign ViewState and cookies. As you can set the machine keys (for validation and decryption) to a known value in web.config you could then use this to decrypt manually if necessary.

Configuration also allows you to override which algorithms are used, so you'd need to set those in the web.config as well to get a known starting point.

By default it's 3DES, in ECB with PKCS7 padding, and the viewstate itself is a base 64 string, so from that you'd take the base64 string, convert back to a byte array and then push through a 3DES decrypter to get the data back.