Exploiting __VIEWSTATE without knowing the secrets

👉 Overview

👀 What ?

__VIEWSTATE is a method used by Microsoft's ASP.NET web application technology to persist changes to the state of a web page over multiple page requests. The __VIEWSTATE parameter is a base64-encoded string that contains data about the controls on the web page and their values. Exploiting __VIEWSTATE without knowing the 'secrets' refers to the ability to manipulate the state of a web page without having the necessary keys or tokens.

🧐 Why ?

Understanding the potential exploitation of __VIEWSTATE is important for both web developers and penetration testers. For developers, it highlights the importance of securing the __VIEWSTATE parameter to prevent unauthorized changes to a web page's state. For testers, it presents a potential vector for attack and further exploration. Moreover, since ASP.NET is a popular web application technology, a large number of web pages could potentially be vulnerable to this kind of exploitation.

⛏️ How ?

Exploiting __VIEWSTATE without knowing the secrets involves manipulating the __VIEWSTATE parameter in a way that changes the state of the web page. This could involve changing the values of controls on the page, such as text boxes or drop-down menus, or even adding new controls. To do this, an attacker would need to decode the __VIEWSTATE parameter, make their changes, then re-encode it before submitting it back to the server.

⏳ When ?

The exploitation of __VIEWSTATE has been a known issue since the early years of the ASP.NET technology, which was first released in the early 2000s. Despite improvements in security and awareness over the years, this exploitation technique can still be viable if the __VIEWSTATE parameter is not properly secured.

⚙️ Technical Explanations

__VIEWSTATE is a hidden field that ASP.NET uses to store changes to the state of a web page between page requests. It is encoded using base64 and can be decoded to reveal its contents. While it is intended to be a secure way of maintaining state, it can be exploited if not properly secured. For example, if an attacker can decode the __VIEWSTATE and make changes to it, they can manipulate the state of the page in ways that the developer did not intend. This could include changing the values of controls on the page or even adding new controls. To prevent this, developers should always use the __VIEWSTATEUSERKEY to secure the __VIEWSTATE, and regularly change the encryption keys used by the application.