Exploiting __VIEWSTATE knowing the secrets

👉 Overview

👀 What ?

__VIEWSTATE is a mechanism used in ASP.NET to store page state data on the client side. It allows the state of objects (serializable) to be preserved. However, if not properly secured, it could be exploited to leak server-side information.

🧐 Why ?

Understanding __VIEWSTATE exploitation is crucial because it is a commonly overlooked aspect of securing ASP.NET applications. When exploited, it can lead to serious information disclosure, potentially revealing sensitive server-side data.

⛏️ How ?

To exploit __VIEWSTATE, an attacker would typically attempt to decode the VIEWSTATE parameter value using Base64 decoding. Then, they would use this decoded data to discover sensitive information about the server-side state.

⏳ When ?

__VIEWSTATE has been in use since the introduction of ASP.NET, and its exploitation has been a known issue since then, especially in applications that do not properly secure their VIEWSTATE.

⚙️ Technical Explanations

__VIEWSTATE is a method in ASP.NET for preserving page and control values between round trips. It is a hidden form field and can be seen using 'View Source' in the browser. When a page is processed, ASP.NET uses this field to control client-side data. However, if not properly encrypted or validated, it can be manipulated to reveal sensitive information. The exploitation involves decoding the VIEWSTATE parameter value using Base64, then using this decoded data to reveal server-side state information.