CODEWITHSUNDEEP
asp.netsecurityviewstate
Abe Miessler
Abe Miessler

Reputation: 85056

Is it possible to decrypt and view ViewState values?

I know there are tools out there that will let you see the content of asp.net viewstate. Is it possible to see and modify the content of viewState if it has been encrypted by adding the <machineKey ... /> node to the web.config?

Upvotes: 8

Views: 29077

Answers (3)

Samuel Neff
Samuel Neff

Reputation: 74909

Edit: Here's a new link for an online viewstate decoder, since the original one is no longer available.

https://www.httpdebugger.com/Tools/ViewstateDecoder.aspx

Original:

I like this view state decoder. Very easy to use.

removed outdated link

enter image description here

Upvotes: 0

Thomas
Thomas

Reputation: 64645

Sure. ViewState is simply base64 encoded (unless you specify that it should be encrypted). Here's a link to someone that wrote a ViewState viewer. Here's another by Fritz Onion. You probably will not be able to directly modify the ViewState (i.e. outside of code) because ASP.NET has checks in place to specifically ensure that nothing has tampered with the ViewState. See the EnableViewStateMAC setting for more.

Update

Thanks to link rot, the links to the various viewers are no longer valid. However, a simple search for "viewstate viewer" can find others on the Internet such as ASP.NET ViewState viewer

Upvotes: 10

Basil
Basil

Reputation: 51

Please take a look into here How to decode viewstate I have provided full source code to get StateBag from viewstate string. Encrypted states are also possible to decrypt using same method but assigning keys.

Upvotes: 1

Related Questions