Security Cipher
Home Blog About Us
Resources β–Ό
πŸ—ΊοΈ Penetration Testing Roadmap 🌐 Web Application Security Checklist πŸ€– OWASP Top 10 for LLM Applications 🧠 LLM AI Security Checklist πŸ› οΈ Security Tools 🎯 Penetration Testing Tricks πŸ“„ Secure Code Explain πŸ“– Vulnerability Explain ☁️ AWS Cloud Security Checklist
My Resume
Contact UsContact
← Security Tools View on GitHub

Hackvertor

Tag-based conversion and encoding Burp extension for complex payload transforms.

Hackvertor

Hackvertor is a tag based conversion tool written in Java implemented as a Burp Suite extension. Tags are constructed as follows: <@base64></@base64> the @ symbol is used as an identifier that it's a Hackvertor tag followed by the name of the tag in this case base64.

Tags also support arguments. The find tag allows you to find a string by regex and has parenthesis after the tag name: <@find("\\w")>abc</@find> this indicates it supports arguments. The argument in this case is the regex string to find on the text in-between the tags. Hackvertor allows you to use three types of arguments either strings (double, single), boolean (true, false) or numbers (including hex).

Getting started

For help getting started please visit the wiki. If you want to know about recent changes take a look at the changelog.

Installation

  • In order to use Hackvertor you need to open Burp Suite.
  • Click the Extender tab
  • Click the BApp store tab inside the Extender tab
  • Scroll down and click Hackvertor
  • Then click install on the right

How to use Hackvertor

To use Hackvertor once it has been installed, click on the Hackvertor tab in the main Burp Suite window. You can then type into the input box to create some text to convert. For instance if you want to convert some text to base64, select the text in the input box then click on the encode tab in Hackvertor, then find the base64 tag and click it. Hackvertor will then add the tag around the selected text and the output window will show a base64 encoded string of your text. It's worth noting that Hackvertor supports an unlimited amount of nesting, you can use multiple tags to encode or decode text. Hackvertor will work from the inner most tag to the outer tag and each step will be converted using the relevant tag you have chosen.

Advanced usage

For more advanced users, you can use tags within repeater tabs. Simply click the repeater tab, right click and select the Hackvertor menu. Then you can use any tag within the repeater tab. Tags will be displayed in the repeater window but when a request is sent they will be converted by Hackvertor and the server will see the converted request. Hackvertor also have a message editor tab, you can select this tab from any request tab in Burp. This will then create the Hackvertor interface inside a request tab, allowing to use the Hackvertor interface to modify a request.

Creating custom tags

  1. Go to Hackvertor menubar
  2. Click "Create custom tag"

Editing custom tags

  1. Go to Hackvertor menubar
  2. Click "List custom tags"
  3. Select tag to edit
  4. Click "Edit tag"

Deleting custom tag

  1. Go to Hackvertor menubar
  2. Click "List custom tags"
  3. Select tag to delete
  4. Click "Delete tag"

Global variables

Global variables can be used throughout Hackvertor.

Create a global variable

  1. Go to Hackvertor menubar
  2. Click "Global variables"
  3. Enter variable name and value
  4. Click "Create/Update variable"

Edit a global variable

  1. Go to Hackvertor menubar
  2. Click "Global variables"
  3. Select variable
  4. Click Edit
  5. Update variable
  6. Click "Create/Update variable"
Press Escape to close the search panel.

Donate

Buy me a Coffee

Penetration Testing Services - Fiverr

Buy me a Coffee

Penetration Testing Services

penetration Testing Services

Web Application Security Quiz

Web Application Security Quiz

Daily Bug Bounty Writeups - Twitter

Daily Bug Bounty Writeups

Download our Latest Android Application

Guide for Penetration Testing

Daily Bug Bounty Writeups - Telegram

Daily Bug Bounty Writeups

Author

Piyush
Senior Product Security Engineer

Ethical Hacker || Penetration Tester || Gamer || Blogger || Application Security Engineer

READ ARTICLE

Donate

Buy me a Coffee

Recent Posts

  • Software Supply Chain Security in 2026: Packages, Pipelines, and Provenance
    Software Supply Chain Security in 2026: Packages, Pipelines, and Provenance
    August 10, 2026/
    0 Comments
  • I Ran Codex Security on a Shop API Lab: 14 Bugs, $1.64, Full Playbook
    I Ran Codex Security on a Shop API Lab: 14 Bugs, $1.64, Full Playbook
    August 3, 2026/
    0 Comments
  • How I Would Hack Your Startup in 24 Hours (Real-World Pentest Guide)
    How I Would Hack Your Startup in 24 Hours (Real-World Pentest Guide)
    July 27, 2026/
    0 Comments

Follow Us

SecurityCipher

Practical security guides, vulnerability deep-dives, and hands-on resources for bug bounty hunters and penetration testers.

Useful Links

  • Start Here
  • Cybersecurity Jobs
  • CVE Lookup
  • Bug Bounty Programs
  • Security Conferences
  • Payload Cheatsheets
  • Interview Prep
  • Report Templates
  • Blogs
  • About
  • Contact
  • RSS Feed

Recent Post

  • Software Supply Chain Security in 2026: Packages, Pipelines, and Provenance
  • I Ran Codex Security on a Shop API Lab: 14 Bugs, $1.64, Full Playbook
  • How I Would Hack Your Startup in 24 Hours (Real-World Pentest Guide)
Β© 2026 SecurityCipher. All rights reserved. Privacy Policies Β· Terms & Conditions