Can I decrypt and view ViewState values?

Question

I know that there are tools that will allow you to see the contents of an asp.net viewstate. Is it possible to view and change the contents of viewState if it has been encrypted by adding a <machineKey ... /> node in web.config?

Answer 1

Of course. The ViewState is just base64 encoded (unless you specify that it should be encrypted). Here's a link to someone who wrote the ViewState viewer . Here is another Fritz Onion . You probably won't be able to directly modify the ViewState (i.e., Outside the code), because ASP.NET has checks to make sure nothing has changed with the ViewState . See EnableViewStateMAC for more details.

Update

Thanks to the rot link, links to various viewers are no longer valid. However, a simple search for “viewstate viewer” can find others on the Internet such as ASP.NET ViewState viewer

Answer 2

Please take a look here. How to decode a viewstate I have provided the full source code to get the StateBag from the viewstate string. Encrypted states can also be decrypted using the same method, but by assigning keys.

Answer 3

Edit: here is the new link for the online status view decoder, since the original one is no longer available.

https://www.httpdebugger.com/Tools/ViewstateDecoder.aspx

Original:

I like this kind of decoder state. Very easy to use.

stale link removed