I don’t quite get it, if you are after protecting your web application and already had encrypted viewstate then there’s not much to add.

Perhaps you could also use the Health Monitoring that comes with ASP.NET 2.0 onwards in order to tailor an additional level of security.

This is very specific to ViewState tho, in fact using ViewStateFailureAuditEvent will give you the chance to log and programmaticaly respond to such events.

I have some project for my university to do some hacking stuff, and my university site is using this viewstate login, I already encrypt the source code and also the viewstate value, but I don’t have any idea for the next step.. can you pls help me little for this?

Regards

Yes few of them.
Depending of the data you are storing keep your viewstate secured (ref: http://msdn.microsoft.com/en-us/library/aa479501.aspx). A first step would be encrypting it using a strong Validation (3DES for example).

Also, from a development and performance prospective also be sure to make a proper use of the viewstate class using it only when it’s needed. Mostly, .NET Controls have the property EnableViewState set to true by default.

Remember; ViewState is something unsecure by default (it can be manipulated by the end user easily). For more secure date transmissions I would recommend using a bespoke implementation.

Cheers!