The tag has no wiki summary.

learn more… | top users | synonyms

8
votes
1answer
49 views

CSRF in ASP.NET

There's this "change password" ASP.NET form that has both event validation and viewstate enabled. There are no specific anti-csrf tokens. From I understanding, in order to execute a successful CSRF ...
2
votes
2answers
114 views

_ _ VIEWSTATE to Protect Against CSRF

I am not a .NET developer and I am trying to understand how exactly does __ViewState protect against CSRF/XSRF attacks. I came across the following : security Stack exchange discussion on similar ...
4
votes
1answer
707 views

Encrypted view state vulnerable?

While reading up on view state as a possible means to prevent CSRF, I came across this Microsoft Security Bulletin which states: An attacker who successfully exploited this vulnerability could ...
3
votes
2answers
1k views

How to determine if ViewState has MAC enabled when crawling a page?

I was using Burp Suite to do some security testing on a site and I noticed that when it detects ViewState it will automatically tell you whether it has MAC enabled. I'm curious if anyone know of a ...