Search code examples
asp.netsecurityviewstate

Is it possible to decrypt and view ViewState values?

I know there are tools out there that will let you see the content of asp.net viewstate. Is it possible to see and modify the content of viewState if it has been encrypted by adding the <machineKey ... /> node to the web.config?

Solution

  • Sure. ViewState is simply base64 encoded (unless you specify that it should be encrypted). Here's a link to someone that wrote a ViewState viewer. Here's another by Fritz Onion. You probably will not be able to directly modify the ViewState (i.e. outside of code) because ASP.NET has checks in place to specifically ensure that nothing has tampered with the ViewState. See the EnableViewStateMAC setting for more.

    Update

    Thanks to link rot, the links to the various viewers are no longer valid. However, a simple search for "viewstate viewer" can find others on the Internet such as ASP.NET ViewState viewer