#hackvertorlunch — Public Fediverse posts

#HackvertorLunch Still working on the tag store

Today on #HackvertorLunch I fixed HV so that it changes the font size based on the Burp setting and allowed you to dynamically alter the font size by pressing CTL/CMD - or CTL/CMD +

#HackvertorLunch Adding support for increment variables tag.

<@increment_var(0,"x",true)/>

Every request/conversion will increase x by one and the tag returns the value.

#HackvertorLunch Used Montoya to manipulate Http requests to solve the H2 issue in Hackvertor but it turns out that the request has already been altered before it reaches Hackvertor. Ugh. Looks like a Burp bug to me unless there's an API I need to use instead but I don't think so

#HackvertorLunch Oh I forgot to post this. Working on Http request handler for Hackvertor using the new Montoya API. This should fix those god damn h2 problems with repeater.

What is Hackvertor?

https://portswigger.net/bappstore/65033cbd2c344fbabe57ac060b5dd100

#HackvertorLunch Spent my lunch making Hackvertor use Montoya and the old API so I can fix repeater requests. Unfortunately this means I'm no longer supporting very old versions of Burp.

#HackvertorLunch Removed loops as they aren't supported in the current parser. Added conditions including if_regex and if_not_regex tags

#HackvertorLunch Something a bit more exciting...conditions

<@set_abc(false)>test<@/set_abc>

<@if_regex('t','<@get_abc/>')>test<@/if_regex>

So here the if_regex tag will only show it's output if it matches the regex in the value which is passed from the variable.

#HackvertorLunch Nothing exciting today just fixing bugs in the context header and base32 encoding/decoding tags.

#HackvertorLunch Allowed custom tags to get context information such as a request body.

#HackvertorLunch Added a uuid tag and improved find tag to support groups.

#HackvertorLunch Fixed a bug where Hackvertor wasn't finding the content-length header if the header value didn't contain a space.

Massive #Hackvertor update 1.7.37
🔥 Tag completion
🔥 Tag syntax highlighting
🔥 Fake data tags
🔥 Custom tags syntax highlighting
🔥 Call Hackvertor tags inside custom tags 😮

and much more done on my #HackvertorLunch

https://portswigger.net/bappstore/65033cbd2c344fbabe57ac060b5dd100

#HackvertorLunch Got basic tag completion working

#HackvertorLunch Finally made some progress with code completion, still a long way to go but at least something is working now.

#HackvertorLunch Trying to get custom autocompletion working to auto complete tags

#HackvertorLunch Finished syntax highlighting in both the main interface and when writing custom tags!

#HackvertorLunch Continued getting syntax highlighting working for custom tags and input/output on the interface. Seems like there is some quirks using RSyntaxTextArea which I think I've fixed.

#HackvertorLunch Today I worked on syntax highlighting for custom tags and the input and output

#HackvertorLunch Added the ability to get a response from a URL:

<@read_url('UTF-8','YOUR KEY')>https://portswigger-labs.net<@/read_url>

This tag requires a valid tag execution key to execute.

#HackvertorLunch Today I added a powershell encode tag.

Input: <@powershell>dir<@/powershell>
Output: ZABpAHIA

#HackvertorLunch Managed to squeeze another one in :D

JSON parsing!
Input: <
@json_parse
('$a $b-c')>{"a":123,"b":{"c":1337}}<@/json_parse>
Output: 123 1337

The argument allows you to define which properties to read

#HackvertorLunch This time I added a new context variable called param which will allow you to fetch parameter values via tags:

URL: x?=123
Input:<@context_param("$paramName")/>
Output: 123

#HackvertorLunch Today I finished off popular tags. Added a menu to enable it (off by default). Hackvertor now will show you popular tags when converting and popular tags per context e.g. GET/POST/JSON.

#HackvertorLunch Continued work on popular tags and context aware counts

#HackvertorLunch Today I fixed some UI issues. Added code snippet in the custom tag code to show how to use custom tags in custom tags. Started to work on popular tags.

#hackvertorlunch Today I worked on the convert tags such as dec2hex to enable you to use regexes instead of a split char:

Input:<@dec2hex('(\\d+)')>255,255<@/dec2hex>

Output:ff,ff

Didn’t finish it in time but should be done on Monday. Another excellent suggestion from @irsdl

RT @gaz: #hackvertorlunch Finished boolean tag attributes and made random tag have an attribute that makes sure it uses all characters in the set.

<@random(10,true)>ABCD<@/random>

ACBDAADCCD

Cool idea from @floyd