How can I post to a HTTP endpoint while not providing the __VIEWSTATE and __EVENTVALIDATION for ASP.NET?

319 Views Asked by At

I'm trying to query a delivery companies consignment status page, though it uses ASP.NET viewstate which when not supplied as parameters it does not return a result.

How can I reliably either:

  1. Not submit the values, or submit blank values
  2. Submit a constant value that is reliable.

The resource in question is http:// 61.9.216.242 /xlcoads/contrack.aspx

I've tried using cURL and been successful but I don't know if I need to change viewstate etc.

I've also contacted the company without luck in having a more ReSTful version of the site available.

1

There are 1 best solutions below

1
On

First of all you are trying to do something which doesn't support it, therefore there will not be any standard method for doing it.

__VIEWSTATE and __EVENTVALIDATION is used by .net to provide a sense of statefulness over stateless protocol(Tcp/ip), but it is easy to fool it.

Your friends will be Firefox and firebug, Submit 4-5 different request and see the sent data in firebug, you will be able to figure out which datas are constant and which changes. When figured out, use webrequest to get the url data, then extract view state and other datas as needed make another webrequest to submit the modified data with the search string.

and yes I use this method for a site with the same problem.