CyberChef Cheat Sheet

CyberChef ist eine Webanwendung für Verschlüsselung, Codierung, Kompression und Datenanalyse. Bekannt als “Das Cyber Schweizer Taschenmesser”, ermöglicht es Sicherheitsanalysten, komplexe Datentransformationen durch eine einfache Drag-and-Drop-Oberfläche durchzuführen, was es für Malware-Analyse, Forensik und CTF-Herausforderungen unerlässlich macht.

Installation und Einrichtung

Webanwendung

Online-Zugriff:

# Official hosted version
https://gchq.github.io/CyberChef/

# Alternative mirrors
https://cyberchef.org/
https://icyberchef.com/

Lokale Installation

Docker-Installation:

# Pull official Docker image
docker pull mpepping/cyberchef

# Run CyberChef locally
docker run -d -p 8080:8080 mpepping/cyberchef

# Access at http://localhost:8080

Node.js-Installation:

# Clone repository
git clone https://github.com/gchq/CyberChef.git
cd CyberChef

# Install dependencies
npm install

# Build application
npm run build

# Start development server
npm start

# Access at http://localhost:8080

Eigenständige Ausführbare Datei:

# Download pre-built releases
wget https://github.com/gchq/CyberChef/releases/download/v9.55.0/CyberChef_v9.55.0.zip

# Extract and run
unzip CyberChef_v9.55.0.zip
cd CyberChef_v9.55.0
python3 -m http.server 8080

Schnittstellenübersicht

Hauptkomponenten

Rezept-Panel:

Operationen aus der Operationsliste ziehen
Operationsparameter konfigurieren
Operationen durch Ziehen neu anordnen
Rezepte speichern und laden

Eingabe-Panel:

Eingabedaten einfügen oder eingeben
Dateien hochladen (Drag and Drop)
Daten von URLs laden
Eingabeformatoptionen (Text, Hex, Base64)

Ausgabe-Panel:

Transformationsergebnisse anzeigen
Ausgabe als Datei herunterladen
In Zwischenablage kopieren
Mehrere Ausgabeformatoptionen

Operationsliste:

Operationen nach Namen suchen
Nach Kategorie durchsuchen
Favoriten für schnellen Zugriff
Verlauf der letzten Operationen

Codierung und Decodierung

Base64-Operationen

Base64 Encode:

Operation: To Base64
Input: Hello World
Output: SGVsbG8gV29ybGQ=

# With custom alphabet
Operation: To Base64
Alphabet: Custom
Input: sensitive data

Base64 Decode:

Operation: From Base64
Input: SGVsbG8gV29ybGQ=
Output: Hello World

# Handle invalid characters
Operation: From Base64
Remove non-alphabet chars: true

Base64-Varianten:

# Base32 encoding
Operation: To Base32
Input: Hello World
Output: JBSWY3DPEBLW64TMMQ======

# Base58 encoding (Bitcoin)
Operation: To Base58
Input: Hello World
Output: JxF12TrwUP45BMd

# Base85 encoding
Operation: To Base85
Input: Hello World
Output: 87cURD]j7BEbo80

URL-Codierung

URL Encode:

Operation: URL Encode
Input: hello world!@#$%
Output: hello%20world%21%40%23%24%25

# Encode all characters
Operation: URL Encode
Encode all chars: true

URL Decode:

Operation: URL Decode
Input: hello%20world%21%40%23%24%25
Output: hello world!@#$%

HTML-Codierung

HTML-Entität Encode:

Operation: To HTML Entity
Input: <script>alert('XSS')</script>
Output: &lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;

# Named entities only
Operation: To HTML Entity
Named entities: true

HTML-Entität Decode:

Operation: From HTML Entity
Input: &lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;
Output: <script>alert('XSS')</script>

Verschlüsselung und Entschlüsselung

Symmetrische Verschlüsselung

AES-Verschlüsselung:

Operation: AES Encrypt
Mode: CBC
Key: 16-byte key here
IV: 16-byte IV here
Input: Secret message
Output: Encrypted data

# Different modes
Mode: ECB, CBC, CFB, OFB, GCM
Key format: Hex, UTF8, Latin1, Base64

AES-Entschlüsselung:

Operation: AES Decrypt
Mode: CBC
Key: 16-byte key here
IV: 16-byte IV here
Input: Encrypted data
Output: Secret message

DES/3DES:

Operation: DES Encrypt
Mode: CBC
Key: 8-byte key
IV: 8-byte IV
Input: Data to encrypt

Operation: Triple DES Encrypt
Mode: CBC
Key: 24-byte key
IV: 8-byte IV

Hash-Funktionen

Gängige Hashes:

# MD5 Hash
Operation: MD5
Input: Hello World
Output: b10a8db164e0754105b7a99be72e3fe5

# SHA-1 Hash
Operation: SHA1
Input: Hello World
Output: 0a4d55a8d778e5022fab701977c5d840bbc486d0

# SHA-256 Hash
Operation: SHA2
Size: 256
Input: Hello World
Output: a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e

HMAC:

Operation: HMAC
Hash function: SHA256
Key: secret-key
Input: message to authenticate
Output: HMAC value

Passwort-Cracking

Hash-Analyse:

Operation: Analyse hash
Input: 5d41402abc4b2a76b9719d911017c592
Output: Possible hash types: MD5, NTLM

# Hash identifier
Operation: Hash identifier
Input: $2b$12$...
Output: bcrypt hash detected

Wörterbuch-Angriff:

# Generate wordlist
Operation: Generate wordlist
Type: Bruteforce
Charset: abcdefghijklmnopqrstuvwxyz
Min length: 4
Max length: 8

# Compare with hash
Operation: Compare hashes
Hash type: MD5
Target hash: 5d41402abc4b2a76b9719d911017c592

Datenanalyse

Textanalyse

Häufigkeitsanalyse:

Would you like me to continue with the remaining sections or placeholders?``` Operation: Frequency distribution Input: ATTACKATDAWN Output: Character frequency chart

Letter frequency analysis

Operation: Chi squared Input: Encrypted text Output: Chi-squared values for different shifts


**Entropy Analysis:**

Operation: Entropy Input: Random data vs compressed data Output: Entropy value (0-8 bits)

Detect compression/encryption

High entropy (>7): Likely encrypted/compressed Low entropy (“<4): Likely plain text


**String Extraction:**

Operation: Strings Min length: 4 Input: Binary file data Output: Printable strings

Extract specific patterns

Operation: Regular expression Pattern: [a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+.[a-zA-Z]\{2,\} Input: Text with email addresses


### Binary Analysis

**Hex Operations:**

Operation: To Hex Delimiter: Space Input: Hello World Output: 48 65 6c 6c 6f 20 57 6f 72 6c 64

Operation: From Hex Delimiter: Auto Input: 48656c6c6f20576f726c64 Output: Hello World


**Binary Operations:**

Operation: To Binary Delimiter: Space Input: Hello Output: 01001000 01100101 01101100 01101100 01101111

XOR operations

Operation: XOR Key: secret Key format: UTF8 Input: Data to XOR


**File Analysis:**

Operation: File type Input: File header bytes Output: Detected file type

Extract file signatures

Operation: Extract file paths Input: Binary data Output: Embedded file paths

Detect embedded files

Operation: Binwalk Input: Firmware or binary file Output: Embedded file locations


## Forensics and Malware Analysis

### Network Analysis

**IP Address Operations:**

Operation: Parse IP range Input: 192.168.1.0/24 Output: List of IP addresses

GeoIP lookup

Operation: GeoIP lookup Input: 8.8.8.8 Output: Location information

DNS operations

Operation: DNS over HTTPS Query type: A Domain: example.com


**URL Analysis:**

Operation: URL decode Input: Encoded URL Output: Decoded URL

Parse URL components

Operation: Parse URI Input: https://example.com:8080/path?param=value Output: Protocol, host, port, path, query

Defang URLs

Operation: Defang URL Input: http://malicious-site.com Output: hxxp://malicious-site[.]com


### Log Analysis

**Log Parsing:**

Operation: Parse log file Format: Apache Common Log Input: 127.0.0.1 - - [10/Oct/2000:13:55:36 -0700] “GET /apache_pb.gif HTTP/1.0” 200 2326

Extract timestamps

Operation: Extract dates Input: Log entries with various date formats Output: Standardized timestamps

Parse Windows Event Logs

Operation: Parse Windows Event Log Input: XML event log data Output: Structured event information


**Timeline Analysis:**

Operation: Sort Sort by: Timestamp Input: Multiple log entries Output: Chronologically sorted events

Time zone conversion

Operation: Change datetime format Input format: DD/MM/YYYY HH:mm:ss Output format: ISO 8601 Timezone: UTC


### Steganography

**Image Steganography:**

Operation: Extract LSB Input: Image file Bit plane: 0 (LSB) Output: Hidden data

Extract EXIF data

Operation: Extract EXIF Input: JPEG image Output: Metadata information

Image analysis

Operation: View Bit Plane Bit: 0 Input: Suspicious image Output: LSB visualization


**Text Steganography:**

Operation: Detect hidden text Method: Zero-width characters Input: Text with hidden content Output: Extracted hidden message

Whitespace steganography

Operation: Whitespace Action: Decode Input: Text with hidden whitespace patterns


## Cryptanalysis

### Classical Ciphers

**Caesar Cipher:**

Operation: ROT13 Input: HELLO WORLD Output: URYYB JBEYQ

Variable rotation

Operation: Caesar cipher Amount: 7 Direction: Encrypt Input: ATTACK AT DAWN Output: HAAHJR HA KHDV


**Substitution Ciphers:**

Operation: Substitution cipher Plaintext alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZ Ciphertext alphabet: ZYXWVUTSRQPONMLKJIHGFEDCBA Input: HELLO Output: SVOOL

Atbash cipher

Operation: Atbash cipher Input: HELLO WORLD Output: SVOOL DLIOW


**Vigenère Cipher:**

Operation: Vigenère encode Key: SECRET Input: HELLO WORLD Output: ZINCS AIDVN

Vigenère decode

Operation: Vigenère decode Key: SECRET Input: ZINCS AIDVN Output: HELLO WORLD


### Modern Cryptanalysis

**Frequency Analysis:**

Operation: Frequency distribution Show percentages: true Input: Encrypted text Output: Character frequency analysis

Index of Coincidence

Operation: Index of Coincidence Input: Ciphertext Output: IC value (indicates monoalphabetic vs polyalphabetic)


**Key Recovery:**

Operation: Kasiski examination Input: Vigenère ciphertext Output: Probable key lengths

Brute force Caesar

Operation: ROT13 brute force Input: Encrypted text Output: All possible rotations


## Automation and Scripting

### Recipe Creation

**Save Recipes:**

Create reusable recipes

Build operation chain
Click “Save recipe”
Name and describe recipe
Share recipe link

Example: Malware deobfuscation recipe

Operations:

From Base64
Gunzip
From Hex
AES Decrypt (key: known_key)


**Recipe Sharing:**

Recipe URL contains encoded operations Example: https://gchq.github.io/CyberChef/#recipe=To_Base64(‘A-Za-z0-9%2B/%3D’)

Export/Import recipes

File format: JSON Contains: Operations, parameters, input/output


### Batch Processing

**Multiple Inputs:**

Process multiple files

Upload multiple files
Apply recipe to all
Download results as ZIP

Batch text processing

Input: Multiple lines of data Recipe: Applied to each line Output: Processed results


**Automation Scripts:**
```javascript
// CyberChef API usage (Node.js)
const chef = require("cyberchef");

// Create recipe
const recipe = new chef.Recipe(
    new chef.operations.ToBase64(),
    new chef.operations.MD5()
);

// Process data
const result = chef.bake("Hello World", recipe);
console.log(result.toString());
```## Fortgeschrittene Techniken

Operation: Magic Input: Unknown encoded data Output: Automatically detected and decoded

Intensive mode

Intensive: true Extensive language support: true Depth: 3 (number of operations to try)

Operation: Fork Split on: \n (newline) Merge: true Input: Multiple lines of data Recipe: Applied to each line separately Output: Combined results

Operation: Scatter chart X values: Column 1 Y values: Column 2 Input: CSV data Output: Interactive scatter plot

Hex dump visualization

Operation: To Hexdump Width: 16 Upper case: true Include ASCII: true

Operation: Generate network diagram Input: Network connection logs Output: Visual network topology

Timeline visualization

Operation: Timeline Date field: timestamp Event field: event_type Input: Log data with timestamps

```bash
# Use CyberChef for data preprocessing
# Example: Decode base64 logs before indexing

# Splunk search command
|eval decoded_data = base64decode(encoded_field)
|eval hash_value = md5(decoded_data)

# CyberChef recipe equivalent:
# 1. From Base64
# 2. MD5
```## Integrationsbeispiele
```json
\\\{
  "processors": [
    \\\{
      "script": \\\{
        "source": "ctx.decoded = Base64.getDecoder().decode(ctx.encoded_field)"
      \\\}
    \\\}
  ]
\\\}
```### SIEM-Integration

Extract indicators from reports

Recipe:

Regular expression (IP addresses)
Regular expression (Domain names)
Regular expression (File hashes)
Defang URLs
Format as CSV

Input: Threat intelligence report Output: Structured IOC list

Deobfuscate malware samples

Recipe:

From Base64
Gunzip
From Hex
XOR (key: 0x42)
Extract strings
Regular expression (URLs/IPs)

Input: Obfuscated malware Output: Deobfuscated code with IOCs

Multi-layer encoding

Recipe:

From Base64
URL Decode
From Hex
ROT13
Atbash cipher

Steganography analysis

Recipe:

Extract LSB
From Binary
Gunzip
From Base64

Cryptanalysis chain

Recipe:

Frequency distribution
Index of Coincidence
Kasiski examination
Vigenère decode (guessed key)

Large file processing

Use “Drop bytes” to reduce size
Process in chunks using “Split”
Disable auto-bake for large operations

Memory issues

Clear input/output regularly
Use streaming operations when available
Restart browser if memory usage high

Character encoding problems

Check input encoding (UTF-8, Latin1, etc.)
Use “Detect encoding” operation
Convert between encodings as needed

Binary data handling

Use hex input for binary data
Check byte order (little/big endian)
Verify file headers and signatures

Debug failed recipes

Check each operation individually
Verify input format matches expected
Use “To Hex” to inspect intermediate results
Check operation parameters

Error messages

“Invalid input”: Check data format
“Key length”: Verify encryption key size
“Parse error”: Check syntax for regex/JSON

Start simple

Test each operation individually
Build recipe step by step
Verify intermediate outputs
Document recipe purpose

Error handling

Use “Drop bytes” to handle extra data
Add “Try” operations for uncertain steps
Include fallback operations

Sensitive data handling

Use local installation for sensitive data
Clear browser cache after use
Avoid cloud-hosted instances for secrets
Use HTTPS for web access

Data validation

Verify output makes sense
Cross-check with other tools
Test with known good data
Document assumptions and limitations

CyberChef Cheat Sheet

Installation und Einrichtung

Webanwendung

Lokale Installation

Schnittstellenübersicht

Hauptkomponenten

Codierung und Decodierung

Base64-Operationen

URL-Codierung

HTML-Codierung

Verschlüsselung und Entschlüsselung

Symmetrische Verschlüsselung

Hash-Funktionen

Passwort-Cracking

Datenanalyse

Textanalyse

Letter frequency analysis

Detect compression/encryption

Extract specific patterns

XOR operations

Extract file signatures

Detect embedded files

GeoIP lookup

DNS operations

Parse URL components

Defang URLs

Extract timestamps

Parse Windows Event Logs

Time zone conversion

Extract EXIF data

Image analysis

Whitespace steganography

Variable rotation

Atbash cipher

Vigenère decode

Index of Coincidence

Brute force Caesar

Create reusable recipes

Example: Malware deobfuscation recipe

Share via URL

Export/Import recipes

Process multiple files

Batch text processing

Intensive mode

Hex dump visualization

Timeline visualization

Extract indicators from reports

Deobfuscate malware samples

Multi-layer encoding

Steganography analysis

Cryptanalysis chain

Large file processing

Memory issues

Character encoding problems

Binary data handling

Debug failed recipes

Error messages

Start simple

Error handling

Sensitive data handling

Data validation