Skip to content
ViewState snooping
portswigger.net | blog | #burp-suite | #web-security | #deserialization | #penetration-testing | #portswigger | #asp-net | #pen-testing | #aspnet | #viewstate
Summary
A survey of 10,000+ ASP.NET applications found most ViewStates MAC-enabled but only 4% encrypted, so contents stay readable and may be tampered. Stuttard previews a Burp utility to deserialize them.
- Published
- Collected