How to check if MAC Protection is enabled for ViewState in ASP NET application

Question

Can someone tell me how to check if the ViewState of an ASP.NET application is MAC protected or not?

Answer 1

You can check if the ViewState is MAC protected or not by checking the last bytes of the ViewState structure. If it is MAC protected, then there is 20-byte hash at the end of the ViewState structure. Also, you can use the ViewState parser in BurpSuite to check this.

To know more join our Ethical Hacking Certification today.