Menu
How to decode the ASP.NET EventValidation and ViewState?
609
This means that knowing the validation key and its algorithm is enough to exploit a website. It seems ViewState is encrypted by default since version 4.5 even when the viewStateEncryptionMode property has been set to Never .
Usage of the ViewStateGenerator parameter When the __VIEWSTATEGENERATOR parameter is known, it can be used for the ASP.NET applications that use . NET Framework version 4.0 or below in order to sign a serialised object without knowing the application path.
The ViewState is a parameter specific to the ASP.NET framework, it's used as a breadcrumb trail when the user navigates the application preserving values and controls between different web pages. Present on the pages in the __viewstate parameter, all the values are serialized and encoded in base64 in a hidden field.
We understand that the Bearer token is the vulnerable parameter; theoretically, whatever JSON data we send to it should be parsed.
I answered a similar question recently, Getting values from viewstate using JQuery?.
Basically, by default ViewState is just Base64-encoded, so you can decode it as long as the administrator hasn't configured the site to encrypt it. Quoting from my previous answer:
If you are writing the control for your own consumption and you only need to read from
ViewState, you could do so, but I wouldn't recommend it unless you find a well-debugged library to parse it for you. The format is a bit hairy (see ViewState: All You Wanted to Know for more details).
That link provides an extremely thorough and clear introduction to ViewState.
As for Event Validation, I'm unsure whether it's Base64-encoded or if it just looks like Base64 (I can't find a conclusive, authoritative reference). This Rexiology article might help though.
53
I'm not sure about EventValidation, but you can decode ViewState by using Fritz Onion's ViewState Decoder.
30
I needed to decode ViewStates recently and found this tool useful: View State decoder
34
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
