viewstate

A small Python 3.5+ library for decoding ASP.NET viewstate.

Viewstate is a method used in the ASP.NET framework to persist changes to a web form across postbacks. It is usually saved on a hidden form field:

&lt;input type=&quot;hidden&quot; name=&quot;__VIEWSTATE&quot; id=&quot;__VIEWSTATE&quot; value=&quot;/wEP...&quot;&gt;

Decoding the view state can be useful in penetration testing on ASP.NET applications, as well as revealing more information that can be used to efficiently scrape web pages.

https://travis-ci.org/yuvadm/viewstate.svg?branch=master

Install

$ pip install viewstate

Usage

The Viewstate decoder accepts Base64 encoded .NET viewstate data and returns the decoded output in the form of plain Python objects.

There are two main ways to use this package. First, it can be used as an imported library with the following typical use case:

&gt;&gt;&gt; from viewstate import ViewState
&gt;&gt;&gt; base64_encoded_viewstate = &#x27;/wEPBQVhYmNkZQ9nAgE=&#x27;
&gt;&gt;&gt; vs = ViewState(base64_encoded_viewstate)
&gt;&gt;&gt; vs.decode()
(&#x27;abcde&#x27;, (True, 1))

It is also possible to feed the raw bytes directly:

&gt;&gt;&gt; vs = ViewState(raw=b&#x27;\xff\x01....&#x27;)

Alternatively, the library can be used via command line by directly executing the module:

$ cat data.base64 | python -m viewstate

Which will pretty-print the decoded data structure.

The command line usage can also accept raw bytes with the -r flag:

$ cat data.base64 | base64 -d | python -m viewstate -r

Viewstate HMAC signatures are also supported. In case there are any remaining bytes after parsing, they are assumed to be HMAC signatures, with the types estimated according to signature length.

&gt;&gt;&gt; vs = ViewState(signed_view_state)
&gt;&gt;&gt; vs.decode()
&gt;&gt;&gt; vs.mac
&#x27;hmac_sha256&#x27;
&gt;&gt;&gt; vs.signature
b&#x27;....&#x27;

Development

$ pytest

References

Since there is no publically available specification of how .NET viewstate is encoded, reverse engineering was based on prior work:

Any official documents would be gladly accepted to help improve the parsing logic.

License

MIT

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

viewstate-0.4.2.tar.gz (5.4 kB view details)

Uploaded Apr 12, 2018 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

viewstate-0.4.2-py2.py3-none-any.whl (8.2 kB view details)

Uploaded Apr 12, 2018 Python 2Python 3

File details

Details for the file viewstate-0.4.2.tar.gz.

File metadata

Download URL: viewstate-0.4.2.tar.gz
Upload date: Apr 12, 2018
Size: 5.4 kB
Tags: Source
Uploaded using Trusted Publishing? No

File hashes

Hashes for viewstate-0.4.2.tar.gz
Algorithm	Hash digest
SHA256	`17eaedfa944125054945d0127cbbb1ad21676d9ee714a2e4b8a2a4d9b190648c`
MD5	`370638c07185e03ded42a7239257fb0f`
BLAKE2b-256	`a145544e5197af5d1325fabb5f4dc14af0767bdcfa403004a9b623cb1598be18`

See more details on using hashes here.

File details

Details for the file viewstate-0.4.2-py2.py3-none-any.whl.

File metadata

Download URL: viewstate-0.4.2-py2.py3-none-any.whl
Upload date: Apr 12, 2018
Size: 8.2 kB
Tags: Python 2, Python 3
Uploaded using Trusted Publishing? No

File hashes

Hashes for viewstate-0.4.2-py2.py3-none-any.whl
Algorithm	Hash digest
SHA256	`df0136812ceef75fc0bc8d840d05f4689bc86204dd3a04ded9542bffaa1deba2`
MD5	`38615c124a95ea2d6afba12a534df4a8`
BLAKE2b-256	`070b9807cfd8f1c344f2ee0d2aa5b08c14996581278a29cf357a7f5055e7f2df`