title: Pen test blind SQL injection and viewstate error
body: <p>I have an asp.net web app that's going through a pen test by internal IT. They are using IBM AppScan to run scans against the web app. One of the errors that keeps coming up is viewstate input field related. The tool modifies the viewstate and sends it back to the server. The server throws an error then catch and redirect the user generic error handling screen. AppScan marks this as a blind SQL injection.</p>
  
  <p>I'm explaining this to the IT security guys. I tell them that the best thing I can do is catch the error and return an error screen to the user. They are insisting that there's some kind of SQL injection going on.</p>
  
  <p>What other way or method do you recomend for this kind of situation?
  How do others handle this? If a user deliberately changes the viewstate isn't an error screen the best reply?</p>