The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

102

Chapter 5 

■

Bypassing Client-Side Controls

70779c05.qxd:WileyRed  9/16/07  5:14 PM  Page 102

---

In addition to this core purpose of the ViewState, developers can use it to

store arbitrary information across successive requests. For example, instead of

saving the product’s price in a hidden form field, an application may save it in

the ViewState as follows:

string price = getPrice(prodno);

ViewState.Add(“price”, price);

The form returned to the user will now look something like this:

value=”/wEPDwUKMTIxNDIyOTM0Mg8WAh4FcHJpY2UFBzEyMjQuOTVkZA==” />

Product: Sony VAIO A217S

Quantity:

and when the user submits the form, their browser will send the following:

POST /order.aspx HTTP/1.1

Host: wahh-app.com

Content-Length: 95

__VIEWSTATE=%2FwEPDwUKMTIxNDIyOTM0Mg8WAh4FcHJpY2UFBzEyMjQuOTVkZA%3D%3D&q

uantity=1&buy=Buy%21

The request apparently does not contain the product price — only the quan-

tity ordered and the opaque ViewState parameter. Changing that parameter at

random results in an error message, and the purchase is not processed.

The ViewState parameter is actually a Base64-encoded string, which can be

easily decoded:

FF 01 0F 0F 05 0D 0A 31 32 31 34 32 32 39 33 34 ; ÿ......121422934

32 0F 16 02 1E 05 70 72 69 63 65 05 07 31 32 32 ; 2.....price..122

34 2E 39 35 64 64                               ; 4.95dd

T I P