: .net viewstate attack from various IP I have viewstate logs every seconds : https://www.mywebsite.ca/Connexion.aspx?__EVENTVALIDATION=xarOopu5INK8aqufalqvDHhxsADhYKgm6p2eMw8ln83m9Hg/0WyoJZDgkqWQpfJsRRfFdD2qPqx56otYY12w6Lm9+ZczIOYCmBikcJ4I+hpdY

@Angela700

ASP.NET Event validation does provide some level of protection against some specific web security attacks.

Request Validation, a feature included in ASP.NET 1.1, may not adequately sanitize hostile user-supplied input. ASP scripts that depend on Request Validation to sanitize user-supplied input may still be prone to cross-site scripting or HTML injection attacks as a result. Request Validation may be bypassed by including a null byte (%00) in malicious user-supplied input.

Microsoft ASP.NET Request Validation Null Byte Filter Bypass Vulnerability

Microsoft has addressed this issue in a Hotfix rollup package and is available by contacting the vendor. Further information can be obtained from this link.

Vote Up Vote Down