2

I read somewhere that its possible to modify viewstate but I didn't find the steps to achieve it.

For example: I want to modify the viewstate of label, initially lable text is "Hi.." and I want to change it to "Hello" by modifying its viewstate on postback.

Any suggestion will be appreciated.

Pawan
  • 41
  • 1
  • 3
  • Just change the label text usingthe label's `Text` property; why do you need to modify view state? – Rahul May 28 '12 at 14:33
  • Actually, someone asked this question to me "How we can modify the viewsate of the control?" so I am trying to find the correct answer of this question. – Pawan May 28 '12 at 14:38
  • Got it, but that's not recomended. You need to understand what viewstate and how it's implemented first if at all you wanted to modify it. Better Starting point is MSDN and research. – Rahul May 28 '12 at 14:39
  • You might want to update the question to clarify that you are asking if it is possible to modify viewstate on the client and have that pushed back up to the server (if that really is what you are asking). georgefox's answer is the right one if that is the question. – David Archer Jul 11 '12 at 21:23

5 Answers5

4

I'm guessing you're talking about maliciously modifying the __VIEWSTATE hidden field as an end user, not modifying the ViewState from within code. This may or may not be feasible (hopefully not), depending on some of your application's settings. The two that are going to make it pretty hard are EnableViewStateMac and ViewStateEncryptionMode. These are often set on the <pages> element in Web.config.

ViewStateEncryptionMode is not really designed to prevent ViewState tampering; it's meant to obscure whatever content you have embedded in ViewState. For example, if you decided to add some secret information about yourself to ViewState (e.g., ViewState["secretinfo"] = "My social security number is xxx-xx-xxxx.";), any user that comes along and loads your page can take your __VIEWSTATE field and run it through a base64 decoder to find your social security number—unless, of course, you're encrypting ViewState.

As an example, here's a .aspx page I found through a simple Google search. View source, grab the ViewState, and paste it into this base64 decoder. Among a few ugly characters, you'll find a bunch of plain text. This ViewState has obviously not been encrypted (which is probably not a bad thing).

Now, if you were a curious or possibly malicious person, you might try to modify some of the text you found in the ViewState, re-encode it as base64, and plop it back into the __VIEWSTATE field. (In many browsers, just open the JS console and type document.querySelector("[name=__VIEWSTATE]").value = "whatever your base64 text is";.) Now when you submit the form, the page will post back with the modified ViewState.

This is where EnableViewStateMac comes into play. As MSDN notes, this setting should always be enabled on a production site, as this is the setting that's meant to prevent malicious folks from tampering with the __VIEWSTATE field. To oversimplify, it basically calculates a hash (actually a message authentication code) of the __VIEWSTATE value and sends this alongside the __VIEWSTATE. (It's embedded at the end of the string and doesn't decode back to a nice plain-text string.) If you modify some text within the __VIEWSTATE, the message will no longer match the MAC, and .NET will catch this and throw an exception before you even have a chance to process the request.

TL;DR
As long as you have EnableViewStateMac on (which you should), you can't really modify the __VIEWSTATE field.

Jonathan S.
  • 2,238
  • 16
  • 16
1

You can change the viewstate of the label by just setting the Text property on the label object in the code-behind. Most properties of the built-in ASP.NET controls are backed by viewstate so setting the property will indirectly change the viewstate for that control.

In your .aspx:

<asp:Label id="myLabel" Text="Hi.." />

In your .aspx.cs:

myLabel.Text = "Hello";
David Archer
  • 2,121
  • 1
  • 15
  • 26
  • Yes, I can do this, its not my application requirement. Actually, someone asked this question to me "How we can modify the viewsate of the control?" so I am trying to find the correct answer of this question. Is it possible to modify the viewstate of a control, if yes then how? – Pawan May 28 '12 at 14:28
  • What if that question is just to see if you understand what a viewstate is, and the correct answer simply is to change the text property? ;) – f2lollpll May 29 '12 at 05:10
1

Couldn't you reset the value on PostBack event? such like:


    mylabel.Text = "Hello";
Ras
  • 628
  • 1
  • 11
  • 29
  • Yes, I can do this, its not my application requirement. Actually, someone asked this question to me "How we can modify the viewsate of the control?" so I am trying to find the correct answer of this question. Is it possible to modify the viewstate of a control, if yes then how? – Pawan May 28 '12 at 14:28
1

The view state is stored in a hidden field on the page. Although view state stores data in a hashed format [encoded format], so it will be not easy to modify with correct values and it will lead tempering in viewstate.

You need to modify Viewstate, you need to know proper encoding and decoding algo.

So don't try to modify the view state.

Romil Kumar Jain
  • 20,239
  • 9
  • 63
  • 92
  • Thanks for your response Romil..!! Its not my application requirement. Actually, someone asked this question to me "How we can modify the viewsate of the control?" so I am trying to find the correct answer of this question. Is it possible to modify the viewstate of a control, if yes then how? – Pawan May 28 '12 at 14:30
  • Look for encoding/decoding algo used by Microsoft to store ViewState. – Romil Kumar Jain May 28 '12 at 14:32
0

The short answer is that you can.

To modify the View State, you would essentially have to:

  1. Deserialize the view state
  2. Identify the key/value pair associated with your label text (by this time it is an Xml dictionary containing key/value pairs)
  3. Modify
  4. Serialize the View State

This article gives a more in-depth look into parsing the View State. It also includes references to tools which may be used for parsing/decoding View State: Understanding ASP.NET View State.

Jeremy
  • 8,902
  • 2
  • 36
  • 44