Viewstate

[u2orange]

How crackable/decryptable is the "__VIEWSTATE"?

u2o

[u2orange]

Answer to my own question..!

The "__VIEWSTATE" can be decrypted client side but this will require the use of Microsofts special class "LosFormatter". This class crypt's and decrypt's the content of Page and controls viewstate.

u2o

[Smokie]

what are the advantages of cracking the viewstate?

[u2orange]

I was messing the other day with an asp label with it's visible property set to 'false' and it's text value set to '1'.

Code: Select all

<asp:label id="lblTest" text="1" visible="false" />

When I executed the page and viewed the source (before postback), the label was not visible or in the source. I then submitted the page and was able to read the value of the hidden label.

This data was obviously stored in the viewstate and thought there is a possibility of storing data there, which would be *reasonably* safe. I am just experimenting with this and don't have any plans as of yet to implement any systems without further investigation.

What I cannot understand is that, since the code for the label (which if I remember correctly is rendered as a <span> tag) was not in the source, how can it be put in the viewstate? There is the possibility that I may have read my source incorrectly.

u2o