Pentagrid AGDec 6, 2024
Pentagrid published two #Hackvertor tags for #EAN13 (also Swiss AHV numbers) and #TOTP for #2FA. These tags are available via the Hackvertor Tag Store by @garethheyes. Our blog post explains what these tags do and how they can be used. https://www.pentagrid.ch/en/blog/hackervertor-ean13-and-totp-tags-for-web-application-penetration-testing-with-burp/ #pentest #OWASP
Hackvertor EAN-13 and TOTP tags for web-application penetration testin

Using Hackvertor tags for Swiss social security number and EAN-13 generation and for second factor authentication with TOTP in web pentests.

Pentagrid AG
Gareth Heyes Feb 28, 2023

Massive #Hackvertor update 1.7.37
🔥 Tag completion
🔥 Tag syntax highlighting
🔥 Fake data tags
🔥 Custom tags syntax highlighting
🔥 Call Hackvertor tags inside custom tags 😮

and much more done on my #HackvertorLunch

https://portswigger.net/bappstore/65033cbd2c344fbabe57ac060b5dd100

Hackvertor

Converts data using a tag-based configuration to apply various encoding and escaping operations.

Gareth Heyes Feb 10, 2023
#Hackvertor autocompletion in action
Gareth Heyes Jan 28, 2023
I've added new tags to #Hackvertor that allow you to encode/decode SAML requests. Should be in the next release.
Gareth Heyes Jan 26, 2023

#Hackvertor Added a new context body tag. This allows you to get the request body and use it somewhere else. Can be used in conjunction with the json_parse tag to parse it and get a prop.

Req header:
x:<@json_parse('$foo')><@context_body/><@/json_parse>

Body:
{
"foo":"bar"
}

Gareth Heyes Jan 25, 2023

Making #Hackvertor context aware. This is actually a fun challenge. I had to pass around a Hackvertor object to static methods then analyse the request and do the replacements.

<@context_header("$Host")/>
<@context_url("$protocol $host $path $file $query $port")/>

Gareth Heyes Jan 21, 2023

#Hackvertor You can now call custom tags within a custom tag! Inception.

output = convert("<@_custom('"+executionKey+"')>"+input+"<@/_custom>")

Coming to the BApp store soon!

Gareth Heyes Jan 20, 2023

Added an awesome feature to #Hackvertor. You can now run conversions inside custom tags!

output = convert("<@base64>"+input+"<@/base64>")