Bypassing WAFs and cracking XOR with Hackvertor
Summary: PortSwigger researcher Gareth Heyes described Hackvertor, a Burp Suite extension that applies nested tag-based encoding and decoding inside Repeater, Intruder and optionally Proxy requests, and demonstrated using its throw_eval XSS tag to bypass the Cloudflare WAF on a test URL. Heyes also added an auto decoder that brute-forces rot encodings across 25 shifts and scores results against English quadgram frequencies, plus a repeating-XOR cracker that guesses key length up to 30 characters using index of coincidence and frequency analysis.
What's compelling: A free extension that automates multi-layer decoding and repeating-XOR cracking lowers the effort needed to spot weak obfuscation, and the same tag mechanism was shown defeating a Cloudflare WAF in a single Repeater request.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026