---
id: 2322
title: "ViewState snooping"
source_domain: portswigger.net
source_url: "https://portswigger.net/blog/viewstate-snooping"
published_at: "2007-06-13T20:18:00Z"
tags: ["burp-suite", "web-security", "deserialization", "penetration-testing", "portswigger", "asp-net", "pen-testing", "aspnet", "viewstate"]
phying_url: "https://phying.com/item/2322"
lang: en
---

# ViewState snooping

## Summary

A survey of 10,000+ ASP.NET applications found most ViewStates MAC-enabled but only 4% encrypted, so contents stay readable and may be tampered. Stuttard previews a Burp utility to deserialize them.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2007-06-13T20:18:00Z
- **Original:** https://portswigger.net/blog/viewstate-snooping
- **Phying News:** https://phying.com/item/2322