← All cheat sheets

CYBERCHEF RECIPES

Plain-text reference · 5 KB. Read it, search it (Ctrl-F) or print it.

CyberChef (the "Cyber Swiss Army Knife", by GCHQ) is a browser-based tool for
transforming data: decode, decrypt, extract, and analyze. A "recipe" is an
ordered list of operations. This is a defender's reference of the operations
and recipes most used in SOC/DFIR triage. Prefer an OFFLINE/self-hosted copy
when handling sensitive data -- everything runs client-side in the browser.

HOW IT WORKS#

- Input pane (data) -> Recipe (operations in order) -> Output pane.
- Drag operations from the left list into the recipe; they run top to bottom.
- "Magic" operation auto-detects likely encodings and suggests recipes.
- Save/share a recipe via the "Save recipe" / URL (the recipe is encoded in
  the link -- avoid putting sensitive data in a shared URL).

ESSENTIAL OPERATIONS#

Magic                         auto-detect encoding; great first step
From Base64 / To Base64       base64 decode/encode
URL Decode / URL Encode       percent-decoding
From Hex / To Hex             hex <-> bytes
From Charcode                 decimal/char-code sequences to text
Gunzip / Zlib Inflate / Raw Inflate   decompress gzip/zlib/deflate
From Hexdump                  parse a hexdump back to bytes
XOR / XOR Brute Force         single/multi-byte XOR (common malware obfusc.)
From Base32                   base32 decode
Decode text                   change character encoding (UTF-8, UTF-16LE...)
Remove null bytes             clean UTF-16 remnants
Extract IP addresses          pull IPv4/IPv6 from blobs
Extract URLs                  pull URLs
Extract email addresses       pull emails
Extract domains               pull domains/hostnames
Defang URL / Defang IP Address   make IOCs non-clickable (hxxp, [.])
Fang URL                      reverse defang for tooling input
Regular expression            find/extract with regex + highlight
Find / Replace                substitution
JavaScript / HTML Beautify    pretty-print obfuscated script/markup
Syntax highlighter            readability
Entropy                       Shannon entropy (detect packed/encrypted data)
Detect File Type              identify by magic bytes
Extract strings               like `strings`, with min length + charset
JWT Decode                    decode a JSON Web Token (header/payload)
MD5 / SHA1 / SHA256           hashing (compute IOC hashes)
Take bytes / Drop bytes       slice payloads

COMMON RECIPES (ordered operations)#

1) Decode a PowerShell -EncodedCommand (base64 UTF-16LE)
   From Base64
   Decode text ('UTF-16LE (1200)')
   (then read the recovered command)

2) "I don't know what this is" -- let CyberChef guess
   Magic
   (optionally tick "Intensive mode"; follow the suggested recipe link)

3) Extract and defang IOCs from a report/log
   Extract URLs            (or Extract IP addresses / Extract domains)
   Defang URL
   (produces hxxp://evil[.]com for safe pasting into tickets)

4) Refang IOCs before feeding a scanner/API
   Fang URL

5) Decode a base64 blob that is gzip-compressed
   From Base64
   Gunzip
   (common for compressed payloads/config)

6) Nested / double-encoded data
   From Base64
   URL Decode
   From Base64
   (peel layers until Magic/output is readable; reorder as needed)

7) Single-byte XOR deobfuscation (unknown key)
   XOR Brute Force   (set key length 1; scan for printable output / crib)
   -- then apply: XOR with the discovered key

8) Analyze a suspicious string's randomness (packing/encryption)
   Entropy
   (high, flat entropy ~7.9+/8 suggests encrypted/compressed content)

9) Carve strings from a binary blob
   Extract strings  (min length 5; filter charset)
   then Regular expression to pull URLs/paths/registry keys

10) Decode a JWT from an auth log
    JWT Decode
    (inspect alg, iss, sub, exp -- never trust the signature without verify)

11) Hexdump back to a file/bytes
    From Hexdump
    Detect File Type
    (identify what a dumped payload actually is)

12) Clean URL-encoded, chunked web-attack payload from a WAF/proxy log
    URL Decode
    (repeat if double-encoded)
    Syntax highlighter / Find & Replace to read it

DFIR / SOC TIPS#

- Start with Magic; it often names the encoding and links a ready recipe.
- Chain Extract* -> Defang* to safely lift IOCs from emails, notes, and logs.
- Use Entropy + Detect File Type to triage unknown blobs before deeper work.
- For malicious content, use a LOCAL/offline CyberChef build; do not paste
  sensitive data into shared recipe URLs (the data/recipe rides in the link).
- CyberChef transforms data; it does not detonate it -- pair with a sandbox
  for actual execution analysis.

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.