There is a long but good discussion on webappsec about the XSS
vulnerability in ViewState of the .NET framework . This is a starting
point only … follow recent comments online. This shall help you to
understand the movie.
http://media.hacking-lab.com/movies/viewstate
Download PDF