The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

When you are attempting to decode what appears to be a Base64-

encoded string, a common mistake is to begin decoding at the wrong position

within the string. Because of the way Base64 encoding works, if you start at the

wrong position, the decoded string will contain gibberish. Base64 is a block-

based format in which each 4 bytes of encoded data translates into 3 bytes of

decoded data. Hence, if your attempts to decode a Base64 string do not

uncover anything meaningful, try starting from four adjacent offsets into the

encoded string. For example, cycling through the first four offsets into

Hh4aGVsbG8gd29ybGQu

generates the following results:

— —  [  È ÛÜ>

‡††VÆÆò v÷&Æ

á¡•±±¼ ´Y½É±

hello world.

Chapter 5 

■

Bypassing Client-Side Controls

103

70779c05.qxd:WileyRed  9/16/07  5:14 PM  Page 103

---

There are two versions of the ViewState format, corresponding to different

versions of ASP.NET. Version 1.1 is a simple text-based format that is effec-

tively a compressed form of XML. Version 2, which is becoming more preva-

lent, is a binary format and is shown in the example. String-based data can be

easily spotted, and the decoded ViewState clearly contains the product price

that was previously stored in a hidden HTML form field. You can simply

change the value of the price parameter in a hex editor.

FF 01 0F 0F 05 0D 0A 31 32 31 34 32 32 39 33 34 ; ÿ......121422934

32 0F 16 02 1E 05 70 72 69 63 65 05 01 31 64 64 ; 2.....price..1dd

N OT E