Language/Japanese

This tool is an extension of PortSwigger product, Burp Suite. Supports Burp suite Professional/Community.

This extension is a tool that allows you to display ViewState of ASP.NET. Note that it is also possible to decode using the command line.

ViewState has been hidden in Burp suite since v2020.3. It is intended for use with Burp suite v2020.x or later.

Fixed some issues with ViewState in the existing Burp suite.

The main repository (master) may contain code under development. Please download the stable release version from the following.

• https://github.com/raise-isayan/ViewStateDecoder/releases

Please use the following versions

• Burp suite v2023.1.2 or less than

  • ViewStateDecoder v2.2.14.0 or less than

• Burp suite v2023.1.2 or above

  • ViewStateDecoder v3.0.0 or above
  • ViewStateDecoder v0.5.3.0 or less (currently available)

The Burp Suite Extender can be loaded by following the steps below.

1. Click [add] on the [Extender] tab
2. Click [Select file ...] and select BigIPDiscover.jar.
3. Click [Next], confirm that no error is occurring, and close the dialog with [Close].

If the __VIEWSTATE parameter exists, you can select the ViewState from the "select extension..." button in the Message Tab of History. button on the Message Tab of the History to select the ViewState.

Switch tabs to view Raw JSON.

• [expand] Button Expand the selected tree.

• [collapse] Button Collapse the selected tree.

• [Decode] Button Decode the ViewState value.

• [Clear] Button Clear the decoded value.

It is possible to decode the value of ViewState from the command line.

java -jar ViewStateDecoder.jar -vs=<viewState>

Specify the ViewState to be decoded in . The response will be output in JSON format.

example)

java -jar ViewStateDecoder.jar -vs=/wEPDwUKLTM0MjUyMzM2OWRkmW75zyss5UROsLtrTEuOq7AGUDk=

MAC: true
digest: 996ef9cf2b2ce5444eb0bb6b4c4b8eabb0065039
{
  "Pair": [
    {
      "Pair": [
        {
          "string": "-342523369"
        },
        null
      ]
    },
    null
  ]
}

Even if the ViewState is URLEncoded, the ViewState will be output after URLDecode.

example)

java -jar ViewStateDecoder.jar -vs=%2FwEPDwUKLTM0MjUyMzM2OWRkmW75zyss5UROsLtrTEuOq7AGUDk%3D

You can also launch it standalone with the -gui option, which does not require Burp sute.

java -jar ViewStateDecoder.jar -gui

gradlew release

.Java

• JRE (JDK) 17 (Open JDK is recommended) (https://openjdk.java.net/)

.Burp suite

• v2023.1.2 or higher (http://www.portswigger.net/burp/)

• NetBean 18.0 (https://netbeans.apache.org/)
• Gradle 7.5 (https://gradle.org/)

Building requires a BurpExtensionCommons library.

• BurpExtensionCommons v3.1.x
  • https://github.com/raise-isayan/BurpExtensionCommons

• google gson (https://github.com/google/gson)

  • Apache License 2.0
  • https://github.com/google/gson/blob/master/LICENSE

• Universal Chardet for java (https://code.google.com/archive/p/juniversalchardet/)

  • MPL 1.1
  • https://code.google.com/archive/p/juniversalchardet/

Operation is confirmed with the following versions.

• Burp suite v2023.9.2

This tool developed by my own personal use, PortSwigger company is not related at all. Please do not ask PortSwigger about problems, etc. caused by using this tool.