CODEWITHSUNDEEP
asp.net
Robert Smith
Robert Smith

Reputation: 336

How to check if gridview has been tampered

I am running some scan testing on an asp.net website. The scanner is changing some of the data on the gridview such as follows:

Parameter  GridCustom$ctl10$CHK_SelRcd  manipulated from: on to: d4R4rs

As you can see a checkbox inside the grid GridCustom called "CHK_SelRcd" was modified and the grid did not detect this. Is there some type of command similar to:

GridCustom.IsValid()

That I can check if the controls have been tampered with (Or have invalid values such as above checkbox)

Thank You

Upvotes: 1

Views: 42

Answers (1)

Aristos
Aristos

Reputation: 66641

I make a very small example using a DropDownList - and a post back.

<asp:DropDownList runat="server" ID="ddlTest">
    <asp:ListItem Value="1" Text="1"></asp:ListItem>
    <asp:ListItem Value="2" Text="2"></asp:ListItem>
    <asp:ListItem Value="3" Text="3"></asp:ListItem>
</asp:DropDownList>

I change the Value of one using the inspect tools of the browser and here is the message I got.

Invalid postback or callback argument. Event validation is enabled using in configuration or <%@ Page EnableEventValidation="true" %> in a page. For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation.

Now there are parameters that even you can change it are not affect the results on code behind

for example

  1. If you change the id, the post back send the name - so no affect there.
  2. If you change the name again the post back is not affected because this is go to a parameter that not exists
  3. If you replace two names each other its again finds it and throw an error.

Upvotes: 1

Related Questions