4

I have viewstate logs every seconds :

https://www.mywebsite.ca/Connexion.aspx?__EVENTVALIDATION=xarOopu5INK8aqufalqvDHhxsADhYKgm6p2eMw8ln83m9Hg/0WyoJZDgkqWQpfJsRRfFdD2qPqx56otYY12w6Lm9+ZczIOYCmBikcJ4I+hpdYQRKniNVLhCWJzo/e3aO+4kXNcPwrZpt6SmzdjHSFks7U3rJwhE5Yh2u+QcdTr8sNygtavOR4PvVc4rgmmwQFv63GAYs6cPwPMe9to22EMamYLnH7F6RYTKAsZfMrSLdamdR2tEkAYrjHOr6DDSyDPlEAELEHfcsE0X4TIbH6knplJ/PPcs94BDzQimWeTEwRDbayhqjNRfMmrpJfAZg+P+zBg==&__VIEWSTATE=pGzxkJJzjeV1FtqBzAVEskpB/ySD2FuZ67cAZkrkfeRXfcV44bS5sVM1Xreuwpl/OwKsQ2R5d0IaDQlrDU5AVOUfQEwz12dG

User Agent:

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)

It tries to hit every public page passing various parameters like __EVENTVALIDATION or __VIEWSTATE.

It's an IP from the United States while our website serves only Canadians. This really looks like an attack but we can't block it by IP because it is always from a new IP.

Any idea how to block them or what this type of attack is called?

  • 1
    You got me on this one. It will be interesting to see what people can come up with. Cheers! – closetnoc Feb 10 '16 at 18:43
  • 1
    Install Fail2Ban, or manually block them using IP Class C. – Simon Hayter Feb 10 '16 at 19:49
1

ASP.NET Event validation does provide some level of protection against some specific web security attacks.

Request Validation, a feature included in ASP.NET 1.1, may not adequately sanitize hostile user-supplied input. ASP scripts that depend on Request Validation to sanitize user-supplied input may still be prone to cross-site scripting or HTML injection attacks as a result. Request Validation may be bypassed by including a null byte (%00) in malicious user-supplied input.

Microsoft ASP.NET Request Validation Null Byte Filter Bypass Vulnerability

Microsoft has addressed this issue in a Hotfix rollup package and is available by contacting the vendor. Further information can be obtained from this link.

  • Thank you, At the moment, we use simple forms that never pass __Eventvalidation as a url parameter. So at the moment, if we detect a url that includes this parameter, we redirect the user to a 404 page. I think this will do the trick for the moment. – Yannick Richard Feb 11 '16 at 14:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.