增强现实AR>> viewstate-decoder>> 返回
项目作者： defensahacker

项目描述 ：
Small tool to decode ASP.NET __VIEWSTATE variable when doing webpentests
高级语言： Python
项目地址: git://github.com/defensahacker/viewstate-decoder.git
创建时间： 2018-04-04T11:01:37Z
项目社区：https://github.com/defensahacker/viewstate-decoder
开源协议：
下载


INTRO

VIEWSTATE module and decoder was copied from https://github.com/yuvadm/viewstate.git and all kudos go to yuvadm.

I just wrote a small tool to easily decode ASP.NET __VIEWSTATE variables without having
to install the viewstate module into the system with administrative privileges and be able to decode the variables with a small script using a terminal, without writting python code.

Sometimes when doing webpentesting against a ASP web application is useful a tool like this.

USAGE

  1. $ ./decoder.py "/wEPDwUKMTU5MTA2ODYwOWRkoCvvBWgUOH7PD446qvEOF6GTCq0="
  2. ** ASP.NET __VIEWSTATE decoder **
  4. [*] Decoding __VIEWSTATE:
  5. /wEPDwUKMTU5MTA2ODYwOWRkoCvvBWgUOH7PD446qvEOF6GTCq0=
  6. (('1591068609', None), None)

DEFENSE

To protect against this attacks turn EnableViewStateMac property to True in the machine.config file.
To encrypt turn property validation to 3DES.

DISCLAIMER

Use at your own risk in an environment that you are allowed to attack.

~
(c) defensahacker