
CyberChef – Cyber Swiss Army Knife - onion2k
https://gchq.github.io/CyberChef/
======
octosphere
It's funny looking at some of the contributors to this. Some of the accounts
seem to be vague, single-duty accounts made for the express purpose of
contributing code to CyberChef and nothing else. I admire their OPSEC

(From:
[https://github.com/gchq/CyberChef/graphs/contributors](https://github.com/gchq/CyberChef/graphs/contributors))

[https://github.com/n1474335](https://github.com/n1474335)

[https://github.com/j433866](https://github.com/j433866)

[https://github.com/d98762625](https://github.com/d98762625)

[https://github.com/s2224834](https://github.com/s2224834)

[https://github.com/GCHQ77703](https://github.com/GCHQ77703)

~~~
Fnoord
Makes me wonder what GitHub can see (e-mail addresses, IP addresses). I also
wonder if it is possible to use code analysis to figure out who these people
are. Not that it is relevant for me, just curious...

~~~
TAForObvReasons
GitHub can see what you send it. If you're concerned about leaking IP data,
use a VPN and a remote box for git operations.

~~~
justanotherhn
Perhaps OP is referring to traking based on the coding? I.E. if you had all
the code repos from an individual and ran some sort of pattern reconition
software to cross refrence thigs like folder structure, layout of the code,
frequency and time of uploads, function & variable naming techniques, etc.
This reminds me of a technique called eBiomentrics[0]

[0] [https://medium.com/datadriveninvestor/keystroke-dynamics-
wha...](https://medium.com/datadriveninvestor/keystroke-dynamics-what-is-it-
be396a263bf2)

~~~
Fnoord
Yes that is what I was referring to. I forgot the exact name for it. It is
akin to (hand)writing analysis, but for code.

~~~
justanotherhn
Certainly an interesting idea, I suppose most of the things I listed can in
fact be mitigated quite easily. Compilers and obfuscators exist even now that
would totally destroy most distinguishable patterns. If anyone knows any case
studies on this, please drop a link here.

~~~
aspenmayer
[https://psal.cs.drexel.edu/index.php/JStylo-
Anonymouth](https://psal.cs.drexel.edu/index.php/JStylo-Anonymouth)

Edit: The main page of above site has a lot more publications referenced.
Worth a look.

[https://psal.cs.drexel.edu/index.php/Main_Page](https://psal.cs.drexel.edu/index.php/Main_Page)

[https://evllabs.com/](https://evllabs.com/)

------
boarnoah
Its a brilliant tool, has replaced visiting 3 or 4 different mini sites to do
some basic conversions etc..

EDIT: Other thing to note, is you can define, a set of operations, ex:
[https://gchq.github.io/CyberChef/#recipe=ROT13(true,true,13)](https://gchq.github.io/CyberChef/#recipe=ROT13\(true,true,13\))

and get a shareable link

------
motohagiography
So much fun!

At first glance, only feature requests I might have added when I did this sort
of work would be in for audio spectrographs in the multimedia section. Useful
for finding stego, embedded thumbnails, hidden channels etc, and a generalized
malicious ZIP parser that deals with the myriad of nasties packers can use.

The demand to scale this capability within an agency like that makes it worth
while to build tools like this, wonder whatother easter eggs are in there
beyond alert msgs.

Brits, so cheeky.

------
nyxxie
Wow I actually thought of building a tool similar to this for CTFs,
specifically this feature:

[https://github.com/gchq/CyberChef/wiki/Automatic-
detection-o...](https://github.com/gchq/CyberChef/wiki/Automatic-detection-of-
encoded-data-using-CyberChef-Magic)

This is REALLY cool. Basically given an unknown string or file from something
CTF-y you can run this tool on it to look for low-hanging fruit like it being
e.g. base64 encoded.

~~~
tptacek
This is a really old reversing trick, for what it's worth; for instance,
pulling gzips out of firmware images, or spotting zipped Java images. You can
also often identify cryptography primitives from their ASN.1 OID strings.
There are a bunch of tools that do stuff like this.

~~~
virtualmic
Yes, I use this one regularly:
[https://github.com/ReFirmLabs/binwalk](https://github.com/ReFirmLabs/binwalk)

(Binwalk is a fast, easy to use tool for analyzing, reverse engineering, and
extracting firmware images)

------
downtown_
[https://github.com/usdAG/cstc](https://github.com/usdAG/cstc) this implements
This as a burp plugin. A few Colleagues developed this and released it two
weeks ago at defcon

------
integricho
It reminds me of SnD Reverser Tool[1], although compared to this, SnD RT has a
bit more constrained scope in what it does, but it's also a standalone exe of
just ~150KB. such a shame it's no longer being developed...

[1] [https://tuts4you.com/download/1923/](https://tuts4you.com/download/1923/)

------
weinzierl
Cryptool is similar and I think older. At least I remember that I have used
the desktop version in the 90s.

While I appreciate that they made a web version I think they scattered their
efforts to create different versions too much so that the project suffered
regarding features and quality.

[1] [https://www.cryptool.org/en](https://www.cryptool.org/en)

------
xwdv
What’s the CLI version of this? It’s too cumbersome to click around in a GUI.

~~~
ken
It's fascinating to me (as someone who has written a similar system) that
everybody, almost without exception, makes this leap.

If the problem is that clicking is too cumbersome, then add better keyboard
support. That's the solution to the problem as stated. You don't need to throw
out the whole UI for that, and there's lots of things a GUI can do that a CLI
can't.

I haven't been able to determine if this is the common reaction because people
simply assume a GUI can't have good keyboard support, or because they're
making an excuse for some unstated other reason.

~~~
stjohnswarts
a lot of people want to make things scriptable.

~~~
ken
That's an interesting point (and a possible hidden agenda), but again, the
scriptability of something is orthogonal to whether it's graphical or not.

Web browsers are as GUI as they come, and arguably have far better scripting
support than any CLI program.

------
ken
This looks kind of neat (and not too dissimilar to my own software -- see
bio), though I can't seem to make it work (or "Bake"?).

It also reminds me of OpenRefine, another very cool online data processing
tool with a slightly different focus.

~~~
kim031
You need to drag specific operation(s) from Operations and drop them into
Recipe. And then supply input(s) in Input tab. You can also check the Auto
Bake icon in the bottom.

~~~
ken
Ah, that's it! I discovered that I could add operations by double-clicking
them, but I was so intent on trying to find a "type some raw input" operation
that I completely missed the "Input tab".

------
jdrosenthal
Some great operations in there. Especially [Other > XKCD Random Number]

[https://gchq.github.io/CyberChef/#recipe=XKCD_Random_Number(...](https://gchq.github.io/CyberChef/#recipe=XKCD_Random_Number\(\)&input=SW5wdXQ)
"RFC 1149.5 specifies 4 as the standard IEEE-vetted random number."

~~~
flixic
There’s also Numberwang function.

------
anewguy9000
nice!

so is any of the input feeding back to GCHQ?

~~~
rtempaccount1
shouldn't be it's purely client-side. And of course, if you don't trust them,
just stick a proxy in-line and watch for traffic.

~~~
Fnoord
If you don't trust it you can use it in a VM without network access, or
something like Qubes (essentially the same). Personally, I use Opensnitch (a
personal firewall like Little Snitch) on Kali Linux, but it isn't foolproof.

------
rtempaccount1
I use this a lot for basic things like base64 decoding. Of course, nothing you
can't do with A.N. programming language, but handy for quick checks.

------
NikolaeVarius
This tool is great. Very useful for CTFs

------
lukifer
This is just about the greatest thing ever, thanks for sharing.

------
sdinsn
Really nice, thanks for sharing

------
ixtli
Extremely cool.

------
yeahdef
great site, been using it for years

------
rglover
This is awesome! Not sure if OP put this together, but thank you.

------
marctrem
This has been posted many times to HN [0]. Is there something making it
newsworthy this time?

[0]
[https://hn.algolia.com/?query=cyberchef&sort=byPopularity&pr...](https://hn.algolia.com/?query=cyberchef&sort=byPopularity&prefix&page=0&dateRange=all&type=story)

~~~
myroon5
[https://xkcd.com/1053/](https://xkcd.com/1053/)

~~~
marctrem
It's definitely not about making fun of people – It's about expecting novelty
and not finding any. After all, `news` is in the url!

I am wondering why people don't do the due diligence of searching if a
tool/article has not already been posted before submitting a duplicate item.

I am sorry if you did interpret this as `trying to make fun of people` – This
is not my intention.

I still would like to know why duplicate entries are welcomed/accepted on a
news aggregator (honest question)!

~~~
PhasmaFelis
In this particular case, it's been posted only three times this year, and the
first two had only 2 or 3 points, meaning that hardly anyone saw them--I know
I didn't. I wouldn't have learned about this if not for the repost.

I don't see anything wrong with reposting perennially useful stuff at
reasonable intervals. Maybe twice in as many months is too much in general,
but it seems to have worked out all right.

------
floki999
Why would anyone use a third-party web service to carry out cyber analysis?
These tasks are easy enough to do/code.

~~~
invokestatic
I may be just naive, but I trust and regularly use both Cyberchef and NSA’s
Ghidra. I think it’s very unlikely that these tools are backdoored (and
Cyberchef runs completely in-browser).

~~~
buildzr
If you've ever looked at the way the NSA treats exploits, remote access
software and such, they're very careful about deploying them against people
who may be able to detect and analyze them themselves.

Putting such things in public code like that which would both directly point
the finger at them and possibly turning secrets into widespread knowledge in
the security community would be... incredibly stupid.

