I am performing a penetration testing for the first time in a .NET application that instead of providing cookies for session management uses the viewstate hidden field.
I am using the .NET Beautifier plugin in BURP in order to decode the value of the viewstate parameter but it says that it is encrypted and it cannot be decoded.
The ASP.NET version is 4.0.xx. Does this version always encrypt the VIEWSTATE with a key stored in the server? How secure is it?