如何解码viewstate

Ser*_*gel 56 asp.net viewstate

我需要查看asp.net页面的viewstate的内容.我查找了一个视图状态解码器,找到了Fridz Onion的ViewState Decoder,但它要求页面的url获取其viewstate.由于我的视图状态是在回发后形成的,并且是由于更新面板中的操作而导致的,因此我无法提供网址.我需要复制并粘贴viewstate字符串,看看里面是什么.是否存在可以帮助查看viewstate内容的工具或网站?

Jam*_*mes 40

这是一个在线ViewState解码器:

http://ignatu.co.uk/ViewStateDecoder.aspx

编辑:不幸的是,上面的链接已经死了 - 这是另一个ViewState解码器(来自评论):

http://viewstatedecoder.azurewebsites.net/

  • `格式标记:C9`,`未知格式标记,退出!` (9认同)
  • @james现在是404 (4认同)
  • 如果这告诉您序列化数据无效,请尝试http://viewstatedecoder.azurewebsites.net/:处理此解码器出错的内容. (3认同)
  • http://viewstatedecoder.azurewebsites.net/ 给我一个服务器错误 (2认同)

Dar*_*opp 37

使用Fiddler并在响应中抓取视图状态并将其粘贴到左下角的文本框中然后解码.

  • 对于使用当前版本的Fiddler(2.5.1)的用户,现在可以通过单击顶部菜单中的TextWizard选项找到此答案中描述的文本框(*或*工具> TextWizard*或*Ctrl + E) .将ViewState粘贴到顶部框中,然后将Transform更改为"From Base64". (13认同)
  • 如果你不想安装Fiddler,你也可以使用Firefox的HttpFox插件:https://addons.mozilla.org/en-US/firefox/addon/6647 (7认同)
  • 我猜测有些东西已经改变了 - 左下方的文本框是某种命令提示符,在viewstate中粘贴没有任何用处.我看不出它已经消失了 - 它仍然在当前版本中吗? (7认同)

Sam*_*eer 13

以下是Scott Mitchell关于ViewState的文章中 ViewState可视化工具的源代码(25页)

using System;
using System.Collections;
using System.Text;
using System.IO;
using System.Web.UI;


namespace ViewStateArticle.ExtendedPageClasses
{
    /// <summary>
    /// Parses the view state, constructing a viaully-accessible object graph.
    /// </summary>
    public class ViewStateParser
    {
        // private member variables
        private TextWriter tw;
        private string indentString = "   ";

        #region Constructor
        /// <summary>
        /// Creates a new ViewStateParser instance, specifying the TextWriter to emit the output to.
        /// </summary>
        public ViewStateParser(TextWriter writer)
        {
            tw = writer;
        }
        #endregion

        #region Methods
        #region ParseViewStateGraph Methods
        /// <summary>
        /// Emits a readable version of the view state to the TextWriter passed into the object's constructor.
        /// </summary>
        /// <param name="viewState">The view state object to start parsing at.</param>
        public virtual void ParseViewStateGraph(object viewState)
        {
            ParseViewStateGraph(viewState, 0, string.Empty);    
        }

        /// <summary>
        /// Emits a readable version of the view state to the TextWriter passed into the object's constructor.
        /// </summary>
        /// <param name="viewStateAsString">A base-64 encoded representation of the view state to parse.</param>
        public virtual void ParseViewStateGraph(string viewStateAsString)
        {
            // First, deserialize the string into a Triplet
            LosFormatter los = new LosFormatter();
            object viewState = los.Deserialize(viewStateAsString);

            ParseViewStateGraph(viewState, 0, string.Empty);    
        }

        /// <summary>
        /// Recursively parses the view state.
        /// </summary>
        /// <param name="node">The current view state node.</param>
        /// <param name="depth">The "depth" of the view state tree.</param>
        /// <param name="label">A label to display in the emitted output next to the current node.</param>
        protected virtual void ParseViewStateGraph(object node, int depth, string label)
        {
            tw.Write(System.Environment.NewLine);

            if (node == null)
            {
                tw.Write(String.Concat(Indent(depth), label, "NODE IS NULL"));
            } 
            else if (node is Triplet)
            {
                tw.Write(String.Concat(Indent(depth), label, "TRIPLET"));
                ParseViewStateGraph(((Triplet) node).First, depth+1, "First: ");
                ParseViewStateGraph(((Triplet) node).Second, depth+1, "Second: ");
                ParseViewStateGraph(((Triplet) node).Third, depth+1, "Third: ");
            }
            else if (node is Pair)
            {
                tw.Write(String.Concat(Indent(depth), label, "PAIR"));
                ParseViewStateGraph(((Pair) node).First, depth+1, "First: ");
                ParseViewStateGraph(((Pair) node).Second, depth+1, "Second: ");
            }
            else if (node is ArrayList)
            {
                tw.Write(String.Concat(Indent(depth), label, "ARRAYLIST"));

                // display array values
                for (int i = 0; i < ((ArrayList) node).Count; i++)
                    ParseViewStateGraph(((ArrayList) node)[i], depth+1, String.Format("({0}) ", i));
            }
            else if (node.GetType().IsArray)
            {
                tw.Write(String.Concat(Indent(depth), label, "ARRAY "));
                tw.Write(String.Concat("(", node.GetType().ToString(), ")"));
                IEnumerator e = ((Array) node).GetEnumerator();
                int count = 0;
                while (e.MoveNext())
                    ParseViewStateGraph(e.Current, depth+1, String.Format("({0}) ", count++));
            }
            else if (node.GetType().IsPrimitive || node is string)
            {
                tw.Write(String.Concat(Indent(depth), label));
                tw.Write(node.ToString() + " (" + node.GetType().ToString() + ")");
            }
            else
            {
                tw.Write(String.Concat(Indent(depth), label, "OTHER - "));
                tw.Write(node.GetType().ToString());
            }
        }
        #endregion

        /// <summary>
        /// Returns a string containing the <see cref="IndentString"/> property value a specified number of times.
        /// </summary>
        /// <param name="depth">The number of times to repeat the <see cref="IndentString"/> property.</param>
        /// <returns>A string containing the <see cref="IndentString"/> property value a specified number of times.</returns>
        protected virtual string Indent(int depth)
        {
            StringBuilder sb = new StringBuilder(IndentString.Length * depth);
            for (int i = 0; i < depth; i++)
                sb.Append(IndentString);

            return sb.ToString();
        }
        #endregion

        #region Properties
        /// <summary>
        /// Specifies the indentation to use for each level when displaying the object graph.
        /// </summary>
        /// <value>A string value; the default is three blank spaces.</value>
        public string IndentString
        {
            get
            {
                return indentString;
            }
            set
            {
                indentString = value;
            }
        }
        #endregion
    }
}
Run Code Online (Sandbox Code Playgroud)

这是一个简单的页面,用于从文本框中读取视图状态,并使用上面的代码对其进行图形化

private void btnParse_Click(object sender, System.EventArgs e)
        {
            // parse the viewState
            StringWriter writer = new StringWriter();
            ViewStateParser p = new ViewStateParser(writer);

            p.ParseViewStateGraph(txtViewState.Text);
            ltlViewState.Text = writer.ToString();
        }
Run Code Online (Sandbox Code Playgroud)


Jos*_*man 7

正如刚才提到的另一个人,它是一个base64编码的字符串.在过去,我使用此网站对其进行解码:

http://www.motobit.com/util/base64-decoder-encoder.asp

  • 它是base64编码的序列化对象,因此解码数据不是特别有用.最好使用正确的视图状态解码器. (5认同)

Rom*_*kov 6

这是另一个在2014年运行良好的解码器:http://viewstatedecoder.azurewebsites.net/

这对Ignatu解码器失败并且"序列化数据无效"的输入起作用(尽管它使BinaryFormatter序列化数据未解码,仅显示其长度).


XP1*_*XP1 5

JavaScript-ViewState-Parser:

解析器应该与大多数未加密的 ViewState 一起工作。它不处理 .NET 版本 1 使用的序列化格式,因为该版本非常过时,因此在任何实际情况下都不太可能遇到。

http://deadliestwebattacks.com/2011/05/29/javascript-viewstate-parser/


解析 .NET ViewState