Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

2020.4.1 Missing ViewState Tab in Request

Paul | Last updated: May 19, 2020 09:43PM UTC

When viewing a request with a ViewState, previous versions would provide a ViewState tab to display the decoded information in tree view or would show that it was encrypted. As of 2020.4.1, this tab no longer shows. I downgraded back to 2020.4 and it shows the ViewState for the same requests.

Liam, PortSwigger Agent | Last updated: May 20, 2020 06:32AM UTC

Paul, could you provide a screenshot of the tab in 2020.4? Thanks.

Paul | Last updated: May 20, 2020 01:03PM UTC

I have emailed screenshots of the same request from 2020.4 and 2020.4.1. Thank you.

Liam, PortSwigger Agent | Last updated: May 20, 2020 01:45PM UTC

Thanks, Paul.

Yakir | Last updated: May 25, 2020 12:42PM UTC

Same issue

Liam, PortSwigger Agent | Last updated: May 26, 2020 12:48PM UTC

Yakir, the tab has been removed as it’s not used as much as our other views. I've raised a ticket in our development backlog to monitor user requests for its reintroduction. I've added a note with your request. Please let us know if you need any further assistance.

Yakir | Last updated: May 27, 2020 07:07AM UTC

Tnx Have a nice day

Chris | Last updated: Jun 11, 2020 08:40AM UTC

+1 for it's reintroduction :)

Martin | Last updated: Jun 11, 2020 08:48AM UTC

Was looking for this a couple of times this week, would be handy to have back.

Liam, PortSwigger Agent | Last updated: Jun 11, 2020 09:28AM UTC

Thanks for the feedback.

Yakir | Last updated: Jun 24, 2020 11:58AM UTC

Hi, Any update about this issue? Tnx

Liam, PortSwigger Agent | Last updated: Jun 24, 2020 01:33PM UTC

We're still monitoring user feedback. We've made a note of your request.

James | Last updated: Jul 06, 2020 09:38PM UTC

+1 for bringing ViewState tab back.

Yakir | Last updated: Jul 12, 2020 09:02AM UTC

Hi, Almost 2 month and we didn't received any update. This option is very useful and VIEWSTATE is still with us.. Thanks

Liam, PortSwigger Agent | Last updated: Jul 13, 2020 09:41AM UTC

Thanks for the feedback Yakir. Unfortunately, we can't provide an ETA for this feature.

Victor | Last updated: Jul 13, 2020 07:25PM UTC

I would like also to have this functionality back

Yakir | Last updated: Aug 20, 2020 09:28AM UTC

Any update?

Ben, PortSwigger Agent | Last updated: Aug 20, 2020 09:45AM UTC

Hi Yakir, We are still monitoring user feedback. We will update this thread if we have any further news regarding this feature.

Ryan | Last updated: Sep 30, 2020 03:17PM UTC

I was shocked this was removed and would very much like to see this reimplemented. Is there an existing extension anyone is using, or are we all just decoding manually now?

BB | Last updated: Oct 28, 2020 02:09PM UTC

+1 to restore this feature.

Ben, PortSwigger Agent | Last updated: Oct 28, 2020 02:23PM UTC

We have added your interest to the feature development. As noted, we will update this thread if we have any further news to share.

Que | Last updated: Dec 30, 2020 12:55PM UTC

+1 to restore this feature. it's a shame that it was deprecated.

matt | Last updated: Jan 07, 2021 08:29PM UTC

Not really sure why this was removed, it was incredibly useful and the climate of awareness surrounding issues like .NET deserialization is growing if anything. Prior statements that the tab "was not used as often as other tabs" seem like odd reasoning. The other tabs were "Raw," "Params," and "Headers," all of which display vital structural components that are in every HTTP request, so naturally those tabs would be viewed with a higher frequency than ViewState, which I assume you all knew at the time of authorship...? Doesn't especially make sense to me and doesn't mean the ViewState tab wasn't useful. Removing core features from an established product is a bad move 99% of the time, someone obviously is going to be using them.

Liam, PortSwigger Agent | Last updated: Jan 08, 2021 07:04AM UTC

Thanks for the feedback, Matt. We've added your comments to the development ticket we are using to monitor requests for this feature.

Mael | Last updated: Feb 17, 2021 09:59AM UTC

Up. It's a real shame this feature has been removed... It was super handy to check RCE in ViewState... I can't really understand why it has been removed, I mean it was just a tab in repeater, it doesn't change much to leave it, especially when it's used to check critical issues such as RCE...

Liam, PortSwigger Agent | Last updated: Feb 17, 2021 03:11PM UTC

Thanks for the feedback. We'll update this thread when we can.

Liam | Last updated: Mar 09, 2021 12:50PM UTC

+1 for this to be re-implemented. Such a useful feature to have lost.

Hannah, PortSwigger Agent | Last updated: Mar 10, 2021 12:09PM UTC

We have just released an extension in the BApp Store for displaying ViewState requests. You can find it on the BApp Store here: https://portswigger.net/bappstore/ba17d9fb487448b48368c22cb70048dc

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.