Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [viewstate]

Microsoft ASP.NET viewstate, in a nutshell, is the technique used by an ASP.NET Web page to persist changes to the state of a Web Form across postbacks.

0
votes
1answer
463 views

How to get session info out of encrypted .NET viewstate?

I am performing a penetration testing for the first time in a .NET application that instead of providing cookies for session management uses the viewstate hidden field. I am using the .NET Beautifier ...
3
votes
1answer
209 views

What is the purpose of the Secret Key in MAC's ViewState ASP.net?

According to what I understand from the ViewState method in ASP.net, when the server generates the ViewState with MAC enabled, he will send it to the client with the MAC computed from the ViewState ...
1
vote
0answers
956 views

Decoding Viewstate of asp page [closed]

I already searched for an answer, and saw that the view state should be base64 encoded. However I used fiddler to try and decode it and the answer I get back is a string of strange characters. Here is ...
8
votes
1answer
930 views

CSRF in ASP.NET

There's this "change password" ASP.NET form that has both event validation and viewstate enabled. There are no specific anti-csrf tokens. From I understanding, in order to execute a successful CSRF ...
4
votes
2answers
4k views

_ _ VIEWSTATE to Protect Against CSRF

I am not a .NET developer and I am trying to understand how exactly does __ViewState protect against CSRF/XSRF attacks. I came across the following : security Stack exchange discussion on similar ...
4
votes
1answer
2k views

Encrypted view state vulnerable?

While reading up on view state as a possible means to prevent CSRF, I came across this Microsoft Security Bulletin which states: An attacker who successfully exploited this vulnerability could read ...
4
votes
2answers
5k views

How to determine if ViewState has MAC enabled when crawling a page?

I was using Burp Suite to do some security testing on a site and I noticed that when it detects ViewState it will automatically tell you whether it has MAC enabled. I'm curious if anyone know of a ...