the-web-application-hackers-handbook

126 Chapter 5 n Bypassing Client-Side Controls
TIP When you attempt to decode what appears to be a Base64-encoded
string, a common mistake is to begin decoding at the wrong position within the
string. Because of how Base64 encoding works, if you start at the wrong position,
the decoded string will contain gibberish. Base64 is a block-based format
in which every 4 bytes of encoded data translates into 3 bytes of decoded data.
Hence, if your attempts to decode a Base64 string do not uncover anything
meaningful, try starting from four adjacent offsets into the encoded string.
By default, the ASP.NET platform protects the ViewState from tampering by
adding a keyed hash to it (known as MAC protection). However, some applications
disable this default protection, meaning that you can modify the ViewState’s value
to determine whether it has an effect on the application’s server-side processing.
Burp Suite includes a ViewState parser that indicates whether the ViewState
is MAC protected, as shown in Figure 5-3. If it is not protected, you can edit the
contents of the ViewState within Burp using the hex editor below the ViewState
tree. When you send the message to the server or client, Burp sends your updated
ViewState, and, in the present example, enables you to change the price of the
item being purchased.
Figure 5-3: Burp Proxy can decode and render the ViewState, allowing you to
review its contents and edit these if the EnableViewStateMac option is not set