Handling MAC protected ViewState

Question

Hi. I am studying a web application built using ASP.NET and want to check if the ViewState is used to send any sensitive information to the server. I have discovered that it uses a ViewState with MAC protection. How can I decode this protection?

Answer 1

You can use BurpSuite for this. When you capture the traffic from the web application, you can use the ViewState Parser provided in Burpsuite to check for the ViewState structure. This will disclose if there is any data being sent to the server through ViiewState. And then it is upto you to decide whether the data is sensitive enough or not.