Extracting and encoding a VIEWSTATE and EVENTVALIDATION

This script extracts VIEWSTATE and EVENTVALIDATION values. This is typically a hidden field in an HTML file and frequently used in .NET applications.

 
function encodeViewState(str) { 

return escape(str).replace(/\+/g,'%2B').replace(/\*/g, '%2A').replace(/=/g,'%3D').replace(/:/g,'%3A').replace(/;/g,'%3B').replace(/\//g, '%2F'); 

} 

  

var msg = $context.currentItem.previousItem; 

var viewstateValue = msg.getResponse(msg.RESPONSE_HTTP_BODY_AS_HTML, "//*[@name='__VIEWSTATE']/@value")[0]; 


  
// viewstateValue now contains the unencoded viewstate string 

  

$prop.set("MessageClip", "viewstate_unencoded", viewstateValue); 

$context.result.postMessage($context.result.LEVEL_INFO, "viewstate unencoded: " + viewstateValue); 

  

viewstateValue=encodeViewState(viewstateValue); 

$prop.set("MessageClip", "viewstate_encoded", viewstateValue); 

$context.result.postMessage($context.result.LEVEL_INFO, "viewstate encoded: " + viewstateValue); 

  

  

var eventvalidationValue = msg.getResponse(msg.RESPONSE_HTTP_BODY_AS_HTML, "//*[@name='__EVENTVALIDATION']/@value")[0]; 

 
 
// eventvalidationValue now contains the unencoded EVENTVALIDATION string 

  

$prop.set("MessageClip", "eventvalidation_unencoded", eventvalidationValue); 

$context.result.postMessage($context.result.LEVEL_INFO, "eventvalidation unencoded: " + eventvalidationValue); 

  

eventvalidationValue=encodeViewState(eventvalidationValue); 

$prop.set("MessageClip", "eventvalidation_encoded", eventvalidationValue); 

$context.result.postMessage($context.result.LEVEL_INFO, "eventvalidation encoded: " + eventvalidationValue);