A BurpSuite extension for passive scanning and brute-forcing ASP.NET ViewState keys.
English | 简体中文
Precompiled package: Releases
Requires Maven and JDK 17.
$ mvn package
Download machineKeys.txt and place it in the same directory as the plugin JAR. Then, install the plugin in BurpSuite (recommended version 2024.10 or later) to enable it.
The plugin will automatically extract ViewState-related data from request and response traffic. When it detects an unsigned ViewState or successfully brute-forces a key, it will automatically generate a BurpSuite issue entry.
No requests will be generated during the scanning and brute-forcing process.
Partial code and inspiration for this plugin are derived from the following projects:
The MachineKey dictionary is sourced from: