Potential Viewstate Deserialization Attack

Tim Peck@timpeck

•updated Oct 23, 2025•5•0•130

Detects potential ASP.NET ViewState deserialization attacks, which can occur when an attacker exploits a publicly known machine key. This is often indicated by a POST request to an ASP.NET page containing a large __VIEWSTATE parameter, followed by a 500 Internal Server Error.