Prevent data tampering in Response

Question

While reading The Web Application Hacker's Handbook, I tried to make a small test on my own website (ASP.NET MVC3).

I have a model which it contains two fields, the first field is a disabled dropdownlist. The second is an enabled text field. The first field is disabled from the View.chtml and added new {disabled="disabled"} as a paratemer.

Here is what happened to me, I ran Burp Suite tool as a proxy and trapped the response. In the response, I removed the disabled="disabled"attribute from HTML, then forwarded the response to the browser. Oviuosly, the page now has two enabled fields.

The question is how to prevent tampering fields using tools such as Burp Suite?

Answer 1

You can't. For that matter you can't be sure that a post back you receive in your controller is the result from your view in a browser. Just posting whatever you want using some script is easy and something hackers frequently do.

The bottom line is. Never trust input and always validate it is permissible.