the-web-application-hackers-handbook

Chapter 5 n Bypassing Client-Side Controls 127
TRY IT!
http://mdsec.net/shop/76/
HACK STEPS
1. If you are attacking an ASP.NET application, verify whether MAC protection
is enabled for the ViewState. This is indicated by the presence of a
20-byte hash at the end of the ViewState structure, and you can use the
ViewState parser in Burp Suite to confirm whether this is present.
2. Even if the ViewState is protected, use Burp to decode the ViewState
on various application pages to discover whether the application is using
the ViewState to transmit any sensitive data via the client.
3. Try to modify the value of a specific parameter within the ViewState
without interfering with its structure, and see whether an error message
results.
4. If you can modify the ViewState without causing errors, you should
review the function of each parameter within the ViewState and
see whether the application uses it to store any custom data. Try to
submit crafted values as each parameter to probe for common vulnerabilities,
as you would for any other item of data being transmitted
via the client.
5. Note that MAC protection may be enabled or disabled on a per-page
basis, so it may be necessary to test each significant page of the application
for ViewState hacking vulnerabilities. If you are using Burp Scanner
with passive scanning enabled, Burp automatically reports any pages that
use the ViewState without MAC protection enabled.
Capturing User Data: HTML Forms
The other principal way in which applications use client-side controls to restrict
data submitted by clients occurs with data that was not originally specified by
the server but that was gathered on the client computer itself.
HTML forms are the simplest and most common way to capture input from
the user and submit it to the server. With the most basic uses of this method,
users type data into named text fields, which are submitted to the server as
name/value pairs. However, forms can be used in other ways; they can impose
restrictions or perform validation checks on the user-supplied data. When an