Questions tagged [viewstate]
Microsoft ASP.NET viewstate, in a nutshell, is the technique used by an ASP.NET Web page to persist changes to the state of a Web Form across postbacks.
8
questions
2
votes
2
answers
846
views
Is this test enough to proof that the web application is vulnerable to Login CSRF?
SCENARIO:
web application which I think is affected by:
a self-xss in the profile section of a user.
logout CSRF
login CSRF
Below I described the test I did to check for the last 2 vulnerabilities, ...
- 567
0
votes
1
answer
1k
views
How to get session info out of encrypted .NET viewstate?
I am performing a penetration testing for the first time in a .NET application that instead of providing cookies for session management uses the viewstate hidden field.
I am using the .NET Beautifier ...
- 524
2
votes
1
answer
587
views
What is the purpose of the Secret Key in MAC's ViewState ASP.net?
According to what I understand from the ViewState method in ASP.net, when the server generates the ViewState with MAC enabled, he will send it to the client with the MAC computed from the ViewState ...
- 717
1
vote
0
answers
2k
views
Decoding Viewstate of asp page [closed]
I already searched for an answer, and saw that the view state should be base64 encoded. However I used fiddler to try and decode it and the answer I get back is a string of strange characters. Here is ...
- 111
9
votes
1
answer
2k
views
CSRF in ASP.NET
There's this "change password" ASP.NET form that has both event validation and viewstate enabled. There are no specific anti-csrf tokens. From I understanding, in order to execute a successful CSRF ...
- 91
5
votes
2
answers
6k
views
_ _ VIEWSTATE to Protect Against CSRF
I am not a .NET developer and I am trying to understand how exactly does __ViewState protect against CSRF/XSRF attacks.
I came across the following :
security Stack exchange discussion on similar ...
- 1,522
4
votes
1
answer
2k
views
Encrypted view state vulnerable?
While reading up on view state as a possible means to prevent CSRF, I came across this Microsoft Security Bulletin which states:
An attacker who successfully exploited this vulnerability could read
...
- 8,185
5
votes
2
answers
10k
views
How to determine if ViewState has MAC enabled when crawling a page?
I was using Burp Suite to do some security testing on a site and I noticed that when it detects ViewState it will automatically tell you whether it has MAC enabled.
I'm curious if anyone know of a ...
- 8,185