CyberChef

CyberChef is a web app from GCHQ, the UK’s signals intelligence agency, for converting and analyzing data. You build a “recipe” by lining up operations such as “From Base64” and “URL Decode”, and CyberChef applies them in order to the text or file you give it.

This review is for people who want to read unreadable strings found in suspicious emails or logs. After reading it, you can do the following:

• Open the official hosted version and decode a Base64 string
• Build a recipe that chains several operations, then save and share it
• Pull a suspicious link out of a string and rewrite it so nobody can click it by accident

##What CyberChef is for

According to the README, CyberChef includes operations like these. The names are the ones shown in the operations list on the left.

It can also encrypt and decrypt with AES, DES, and other ciphers, and parse IPv6 addresses and X.509 certificates.

Magic: automatic encoding detection

Magic is an operation that tries to work out how your data is encoded. According to the official wiki, it uses regular expressions to spot encodings with a predictable shape, such as Base64 or Gzip, and then runs each matching operation speculatively. It ranks the results by how valid they look, using checks such as magic bytes, valid UTF-8, entropy, and byte frequency. It can unwrap several layers of encoding, up to the level set by the Depth argument.

Even without adding Magic, CyberChef shows a magic icon in the output box when it finds an operation that makes sense of your input. Click the icon to see the decoded result.

##Where your data is processed

The README says that neither your recipe nor your input (text or files) is ever sent to the CyberChef web server. All processing happens in your browser, on your own computer. The download dialog on the hosted version also explains that you can check this in the Network tab of your browser’s developer tools (F12): baking a recipe uploads no data.

##Try it safely: decode a Base64 string

For practice, use a harmless string you made yourself.

1. Open the official hosted version at gchq.github.io/CyberChef.

2. Paste the following string into the input box in the top right.

   aHR0cHM6Ly9leGFtcGxlLmNvbS92ZXJpZnk/dXNlcj10ZXN0

3. Type From Base64 into the search box above the operations list, then drag the operation into the recipe area in the middle.

4. The output box in the bottom right shows https://example.com/verify?user=test.

The output updates every time you change the input or the recipe (Auto Bake). If your input is large and this slows things down, you can turn Auto Bake off and run the recipe manually.

##A defensive example: check a link hidden in an email

Suspicious emails and logs sometimes contain links hidden with Base64. Add two operations to the recipe above to pull out just the link and make it unclickable.

Defang URL replaces http with hxxp, . with [.], and :// with [://]. You can paste the result into a report or chat without anyone clicking it by mistake. Do not visit the extracted link yourself.

To check each stage, set a breakpoint on an operation in the recipe. CyberChef pauses before that operation, and you can step through the recipe one operation at a time.

##Save and share recipes

• Save: Click “Save recipe” to store the recipe in your browser’s local storage. It is still there the next time you open CyberChef.
• Share: The page URL contains both your recipe and your input. Copy the URL and send it, and the other person opens the same state.

Because the URL contains the input itself, sharing it while it holds an email you are investigating or internal logs also hands over that content. Clear the input or replace it with a harmless sample before you share.

##How to run it

The README lists Google Chrome 50+ and Mozilla Firefox 38+ as supported browsers. The official wiki says building from source is supported only in bash-based environments, mainly Linux and macOS, and that Windows is not officially supported.

##Things to keep in mind

• For sensitive data such as internal emails, logs, or personal information, use a copy of CyberChef running on your own machine, either the downloaded version or Docker.
• The project warns that unofficial copies of CyberChef could be modified to send your input or recipe elsewhere. Use the hosted version at gchq.github.io/CyberChef, or the download link on that page.
• Sharing a URL that contains your input shares the input too.
• Do not open links or files you extract. When you examine a file’s contents, do not run it.
• Do not analyze other people’s data without permission from the owner or administrator.

##Read next

• cd ../wiresharkWiresharka tool that records network traffic so you can read it
• cd ../ghidraGhidraa reverse engineering tool for analyzing programs
• cat ~/guides/lab-setup.mdSetting up a safe lab