Dailydave mailing list archives

Re: ASP.Net viewstate

From: dvorak <dvorak () xs4all nl>
Date: Wed, 13 Sep 2006 02:59:56 +0200

Hi List,

<SNIP>
If I am not mistaken viewstate holds some kind of HMAC
like thingy inside, something like: 
hash(data in viewstate || server_key). Which might make
changing the viewstate a bit harder, or impossible
depending on the actual implementation. You should be
able to see it in the (base64) decoded viewstate, binary
data probably 16/20/32 bytes in length.

hf.

_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave

Current thread:

ASP.Net viewstate Kartikeya Puri (Sep 12)
- Message not available
  - Re: ASP.Net viewstate Kartikeya Puri (Sep 13)
- Re: ASP.Net viewstate dvorak (Sep 13)
- Message not available
  - Re: [OFFLISTDailydave] ASP.Net viewstate Kartikeya Puri (Sep 13)
    - Re: [OFFLISTDailydave] ASP.Net viewstate Jeremy Kelley (Sep 13)