Java Script Encode As
Summary: PortSwigger's BApp Store lists a third-party Burp extension called JavaScript Encode As, version 1.0 by author ret2desync, last updated 31 January 2025, that encodes strings in JavaScript format (Unicode or Hex) for use within JSON and JavaScript. The extension is applied through a right-click menu in Burp tools such as Repeater and Intruder, and the listing states it can be useful for bypassing WAFs and web application validation, particularly when the value is later returned as is and read by JavaScript in the browser.
What you should know: A free, third-party Burp extension whose stated purpose is evading WAF and application validation means the payloads your filters block can be re-encoded in a few clicks by anyone testing against you, and the listing carries no warranty from PortSwigger about its quality.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026