CyberChef

What CyberChef Is

CyberChef is a web-based tool developed by GCHQ for analyzing, decoding, and transforming data. It runs entirely in the browser — no data leaves your computer. It works by chaining operations (functions) into recipes (pipelines) that process data step by step.

• Every operation takes input, transforms it, and passes it to the next operation. This piped workflow mirrors how analysts think: “Decode Base64, then decompress gzip, then extract strings.”
• CyberChef has over 350 operations including encoding/decoding, compression, cryptography (encryption, hashing, HMAC), data parsing (JSON, XML, hex), extraction (regex, strings), and net-specific tools (IP format conversion, MAC parsing).
• The tool is available online (gchq.github.io/CyberChef) or can be run locally as a desktop app via a browser.

Recipe Reference — What Analysts Actually Use

Recipe 1: Decode Base64-Encoded Payloads

Malware, obfuscated PowerShell, and web shells commonly use Base64 encoding.

Recipe flow:

From Base64 → (optional) Decompress (Broil Gunzip or Raw Inflate) → View

Analyst use case: An alert shows SQLkgZQByAGUAdABhAGQAbgBhAHQAcwAgAHMAeQBzAGQAbQBpAG4A... in a PowerShell command line. Decode Base64, then decode UTF-16 to reveal the original command.

Recipe 2: XOR Brute Force / Known Key Decryption

Malware often uses single-byte XOR or multi-byte XOR to obfuscate strings.

Recipe flow:

XOR Brute Force (or XOR) → Output

Single-byte XOR find key:

Input: 1b3c120202647d15033c5c5d12797d151b0508040b3c6465
Operation: XOR Brute Force → Key length 1 → Check output for readable text

Multi-byte XOR decode:

Input (hex): a1b2c3d4e5f6a1b2c3d4e5f6
Operation: XOR → Key: <known key> → Output

Analyst use case: A sample contains data that looks like random bytes but has periodic patterns. Single-byte XOR brute force with key length 1 reveals a readable string — the malware command string.

Recipe 3: Hex Dump and Reverse

Malware samples, shellcode, and network traffic often need hex inspection.

Recipe flow:

To Hex (or From Hex) → (optional) To Hexdump → View

Analyst use case: A Wireshark PCAP extract shows bytes 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .... The 4D 5A (MZ) header confirms it is a Windows PE executable. Use From Hex to extract and analyze the binary.

Recipe 4: Hash Computation and Verification

Recipe flow:

Input data → (select hash) MD5/SHA1/SHA256/SHA512 → Output

Analyst use case: A file was downloaded from a suspicious URL. Compute its SHA256 hash and compare against known malware hashes in your threat intel platform (like MISP) or on VirusTotal.

Recipe 5: String Extraction

Recipe flow:

Input → Strings → (optional) Filter → Extract

Analyst use case: A memory dump file (analyzed with Volatility). Run Strings to extract all readable strings, then Extract URLs to find C2 endpoints, then Extract IP addresses to find all IPs in the sample.

Recipe 6: JSON / XML Prettify and Parse

Logs, API responses, and configuration files are frequently in JSON or XML format.

Recipe flow:

Input (minified JSON/XML) → JSON to CSV or Syntax highlighter → Output

Recipe 7: Entropy Calculation

Entropy measures randomness. High-entropy data is often compressed, encrypted, or encoded — characteristic of malware payloads.

Recipe flow:

Input → Entropy → Output (1-8 scale)

Entropy interpretation:

Analyst use case: You have a suspicious file with a .txt extension but entropy of 7.2. That is not plain text — it is compressed, encrypted, or encoded data.

Recipe 8: Defang URLs and Emails

When documenting findings, you need to represent malicious URLs and emails without making them clickable.

Recipe flow:

Input URL → Defang URL → Output

Quick Reference — Most Common Operations

Recipe Combinations — Common Analyst Workflows

Malware String Analysis

Input: Suspicious file/sample
1. Entropy → Check if packed/encrypted
2. Strings → Extract all strings
3. Extract URLs → Find C2 endpoints
4. Extract IP addresses → Find all IPs
5. From Base64 → Decode any Base64-encoded strings found
6. XOR Brute Force → Try single-byte XOR on obfuscated sections
7. Output: C2 domains, IPs, XOR keys, plaintext strings

Web Shell / PHP Shell Analysis

Input: Suspected web shell PHP file
1. Syntax highlighter → Check for malicious PHP code
2. From Base64 → Decode any Base64 payloads
3. Strings → Extract readable content (credentials, IPs, timestamps)
4. Defang URL → Create documentation-safe version
5. Output: Confirmation of malicious intent + IOC extraction

PCAP Payload Extraction

Input: Hex dump from packet capture
1. From Hexdump → Convert to binary
2. From Hex (if hex only) → Convert hex string to binary
3. (Optional) To Hexdump → Verify reconstruction
4. Strings → Extract readable content
5. Output: Reconstructed file or payload

Related

• Azure Sentinel — detection and response for T1654 techniques
• Elastic Security — detection and response for T1654 techniques
• Log Sources Overview — covers the log sources overview concepts

Sources

• CyberChef — GCHQ GitHub
• CyberChef Online Instance
• MITRE ATT&CK T1654