Gaijin.at

CyberChef Recipes

On this page you can find ready to use CyberChef recipes. CyberChef is a web application for analyzing and decoding data.

Read more about CyberChef, including a description of the main features.

Contents


Tips:
  • You can drag and drop a linked title of a recipe to the bookmark area of your browser.
  • You can select a recipe with a triple click on the text. Copy the recipe and load it in CyberChef.

Were the free content on my website helpful for you?
Support the further free publication with a donation via PayPal.

Read more about support options...

Format Apache HTTP access log

This CyberChef recipe extracts information from one or more lines of an Apache HTTP access log (combined log format) and outputs it formatted with labels.

The date is converted to ISO format and the time zone is changed to UTC.

Recipe Format Apache HTTP access log
[{"op":"Find / Replace","args":[{"option":"Regex","string":"^\\s*([^\\s].*[^\\s])\\s*$"},"$1",false,true,false,true]},{"op":"Fork","args":["\\n","\\n",false]},{"op":"Subsection","args":[" \\[([^\\]]+)\\] ",true,true,false]},{"op":"Translate DateTime Format","args":["Automatic","DD/MMM/YYYY:HH:mm:ss","UTC","YYYY-MM-DD HH:mm:ss ZZ","UTC"]},{"op":"Merge","args":[false]},{"op":"Register","args":["^(\\S+) (\\S+) (\\S+) \\[([^\\]]+)\\] \"(\\S+) (.*?) (\\S+)\" (\\S+) (\\S+) \"([^\"]*)\" \"([^\"]*)\"",true,false,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":".*"},"Client Request:\\n  Host:      $R0\\n  Date/Time: $R3\\n  Method:    $R4\\n  File/Path: $R5\\nWebserver Response:\\n  Status Code: $R7\\n  Bytes Sent:  $R8\\nInformation from Client:\\n  Referrer:   $R9\\n  User-Agent: $R10\\n",false,false,false,true]}]

Try recipe with example

Input:
198.51.100.1 - - [03/Apr/2023:10:36:08 +0200] "GET /en/software/ HTTP/1.1" 404 1527 "https://www.gaijin.at/en/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0"
Output:
Client Request:
  Host:      198.51.100.1
  Date/Time: 2023-04-03 08:36:08 +0000
  Method:    GET
  File/Path: /en/software/
Webserver Response:
  Status Code: 404
  Bytes Sent:  1527
Information from Client:
  Referrer:   https://www.gaijin.at/en/
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0

Extract EXIF information

This CyberChef recipe extracts EXIF information from a picture file and removes unnecessary information and formats the UNIX timestamps to an ISO date.

Recipe Extract EXIF information
[{"op":"Extract EXIF","args":[]},{"op":"Find / Replace","args":[{"option":"Regex","string":"Found \\d+ tags.\\n\\n"},"",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"\\n(StripOffsets|StripByteCounts): [^\\n]+"},"",true,false,true,false]},{"op":"Subsection","args":["\\n(?:ModifyDate|DateTimeOriginal): (\\d+)",true,true,false]},{"op":"Translate DateTime Format","args":["UNIX timestamp (seconds)","X","UTC","YYYY-MM-DD HH:mm:ss z","UTC"]}]
Example output:
Make: NIKON CORPORATION
Model: NIKON D70
Orientation: 1
XResolution: 240
YResolution: 240
ResolutionUnit: 2
Software: GIMP 2.4.5
ModifyDate: 2008-06-22 06:17:32 UTC
ExposureTime: 0.005
FNumber: 9
ExposureProgram: 1
ISO: 200
DateTimeOriginal: 2008-04-10 19:42:08 UTC
ShutterSpeedValue: 7.591430
ApertureValue: 6.75239
ExposureCompensation: -1
MaxApertureValue: 3.3
MeteringMode: 2
Flash: 0
FocalLength: 100
ColorSpace: 1
ExifImageWidth: 100
ExifImageHeight: 66
FocalLengthIn35mmFormat: 150

Extract URLs and e-mail addresses from files

CyberChef can extract URLs and e-mail addresses from a text. To read URLs and e-mail addresses from files - even recursively - you can use console commands.

The Windows console command

findstr /S "://" *.txt > urls.txt

or under Linux the command

grep -Ihr --include="*.txt" "://" * > urls.txt

writes the lines from all text files that may contain a URL to the output file "urls.txt". The parameter "/S" or "-r" causes the recursive search in subdirectories. The output file is now loaded into CyberChef via drag and drop or with the open function as input. The following recipe outputs the URLs without duplicates and sorted.

Extract_URLs(false,true,true)

For e-mail addresses the procedure is very similar. The console command is called with a short regular expression:

findstr /S /R ".+@[a-z0-9]" *.txt > emails.txt

Oder unter Linux:

grep -EIihr --include="*.txt" ".+@[a-z0-9]" * > emails.txt

The output file is loaded into CyberChef. The recipe below outputs all e-mail addresses without duplicates and sorted.

Extract_URLs(false,true,true)

Extract URLs from .url files

With the Windows console command "type *.url > urls.txt" the contents of all .url files will be written to the file "urls.txt". After that load the following recipe in CyberChef:

Recipe Extract URLs from .url files
[{"op":"Regular expression","args":["User defined","(?:^|[\\r\\n])\\[InternetShortcut\\][^\\[]*[\\r\\n]URL=([^\\r\\n]*)(?:[\\r\\n]|$)",true,true,false,false,false,false,"List capture groups"]}]

Move the file "urls.txt" via drag and drop onto the input field in CyberChef. In the output only those data are contained, which are entered in the line "URL" of the section "InternetShortcut".

Another method would be to extract all URLs with "Extract_URLs(false,true,true)". The output of the addresses is sorted and without duplicates.

Filter out disposable mail addresses

From a list of e-mail addresses, this recipe filters out those that are so-called disposable e-mail addresses or temporary e-mail addresses.

Recipe Wegwerf-Mailadressen herausfiltern
[{"op":"Fork","args":["\\n","\\n",false]},{"op":"Register","args":["([\\s\\S]*)",true,false,false]},{"op":"HTTP request","args":["GET","https://open.kickbox.com/v1/disposable/$R0","","Cross-Origin Resource Sharing",false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(\\{\"disposable\":true\\})$"},"$R0",true,false,true,false]},{"op":"Merge","args":[true]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"{\"disposable\":false}"},"",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(\\s+)"},"\\n",true,false,true,false]}]

Try recipe with example

Input:
test1@byom.de
test@test.tld
test2@byom.de
Output:
test1@byom.de
test2@byom.de

Request information about e-mail addresses

disify.com

This CyberChef recipe retrieves information about one or more mail addresses via the disify.com service and formats the result.

Recipe Request information about e-mail addresses with disify.com
[{"op":"Fork","args":["\\n","\\n",false]},{"op":"Register","args":["([\\s\\S]*)",true,false,false]},{"op":"HTTP request","args":["GET","https://www.disify.com/api/email/$R0","","Cross-Origin Resource Sharing",false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"{"},"$R0:\\n{",true,false,true,false]},{"op":"Merge","args":[true]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(\\{\\n|\\}|\"|,)"},"",true,false,true,false]}]

Try recipe with example

Input:
test1@byom.de
test@test.tld
test2@byom.de
Output:
test1@byom.de:
    format: true
    domain: byom.de
    disposable: true

test@test.tld:
    format: true
    domain: test.tld
    disposable: false
    dns: false

test2@byom.de:
    format: true
    domain: byom.de
    disposable: true

mailcheck.ai

This CyberChef recipe queries information about one or more mail addresses via the mailcheck.ai service and formats the result.

Recipe Request information about email addresses with mailcheck.ai
[{"op":"Fork","args":["\\n","\\n",false]},{"op":"Register","args":["([\\s\\S]*)",true,false,false]},{"op":"HTTP request","args":["GET","https://api.mailcheck.ai/email/$R0","","Cross-Origin Resource Sharing",false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"{"},"$R0:\\n{",true,false,true,false]},{"op":"Merge","args":[true]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"\""},"",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":":"},": ",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"{"},"    ",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"}"},"\\n",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":","},"\\n    ",true,false,true,false]}]

Try recipe with example

Input:
test1@byom.de
test@test.tld
test2@byom.de
Output:
test1@byom.de: 
    status: 200
    email: test1@byom.de
    domain: byom.de
    mx: true
    disposable: true
    alias: false
    did_you_mean: null

test@test.tld: 
    status: 200
    email: test@test.tld
    domain: test.tld
    mx: false
    disposable: false
    alias: false
    did_you_mean: null

test2@byom.de: 
    status: 200
    email: test2@byom.de
    domain: byom.de
    mx: true
    disposable: true
    alias: false
    did_you_mean: null

Convert INI file to HTML table

With this CyberChef recipe an INI file can be converted to a HTML table.

Recipe Convert INI file to HTML table
[{"op":"Find / Replace","args":[{"option":"Regex","string":"(.+)\\["},"$1</table>\\n[",true,false,false,true]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(.*)$"},"$1\\n</table>",false,false,false,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^\\[([^\\]]*)\\]"},"<h3>$1</h3>\\n<table>",true,false,true,false]},{"op":"Fork","args":["\\n","\\n",false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^([^\\=]*)=(.*)$"},"<tr><th>$1</th><td>$2</td></tr>",false,false,false,false]},{"op":"Merge","args":[true]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"<table>"},"<table border=\"1\">",true,false,false,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(.*)$"},"<!DOCTYPE html>\\n<html>\\n<body>\\n$1\\n</body>\\n</html>\\n",true,false,true,true]}]

Try recipe with example

Input:
[Section1]
Key1=Value1
Key2=Value2
[Section2]
Key3=Value3
Output:
<!DOCTYPE html>
<html>
<body>
<h3>Section1</h3>
<table border="1">
<tr><th>Key1</th><td>Value1</td></tr>
<tr><th>Key2</th><td>Value2</td></tr>
</table>
<h3>Section2</h3>
<table border="1">
<tr><th>Key3</th><td>Value3</td></tr>
</table>
</body>
</html>

Convert text to HTML

This recipe converts a text with paragraphs to a HTML document.

Recipe Convert text to HTML
[{"op":"Find / Replace","args":[{"option":"Regex","string":"&"},"&amp;",true,false,false,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"<"},"&lt;",true,false,false,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":">"},"&gt;",true,false,false,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^\\s*(.*?)\\s*$"},"$1",true,true,false,true]},{"op":"Find / Replace","args":[{"option":"Regex","string":"\\s*[\\r\\n]+\\s*"},"</p>\\n<p>",true,true,false,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(.*)$"},"<!DOCTYPE html>\\n<html lang=\"en\">\\n<body>\\n<p>$1</p>\\n</body>\\n</html>\\n",true,true,false,true]}]

Try recipe with example

Alternatively, the text in the following recipe is taken unchanged and surrounded with pre tags so that the formatting is preserved when displayed.

Recipe Convert text to HTML (preformatted)
[{"op":"Find / Replace","args":[{"option":"Regex","string":"&"},"&amp;",true,false,false,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"<"},"&lt;",true,false,false,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":">"},"&gt;",true,false,false,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(.*)$"},"<!DOCTYPE html>\\n<html lang=\"en\">\\n<body>\\n<pre>$1</pre>\\n</body>\\n</html>\\n",true,true,false,true]}]

Try recipe with example

Input:
 111
    222 
  333
Output (with paragraphs):
<!DOCTYPE html>
<html lang="en">
<body>
<p>111</p>
<p>222</p>
<p>333</p>
</body>
</html>
Output (preformatted):
<!DOCTYPE html>
<html lang="en">
<body>
<pre> 111
    222 
  333   </pre>
</body>
</html>

Convert TSV file to HTML table

With this CyberChef recipe a TSV file can be converted to a HTML table.

Recipe Convert TSV file to HTML table
[{"op":"Find / Replace","args":[{"option":"Extended (\\n, \\t, \\x...)","string":"\\t"},"</td><td>",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(.*)$"},"<tr><td>$1</td></tr>",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(.*)"},"<!DOCTYPE html>\\n<html lang=\"en\">\\n<body>\\n<table border=\"1\">\\n$1\\n</table>\\n</body>\\n</html>\\n",false,false,true,true]}]

Extract time from Google ei parameter

This recipe extracts the time of the search query from the data structure of the ei parameter of a Google URL. The recipe accepts the value itself or the entire URL as input.

The ei parameter is encoded with Base64 and contains in the first 4 bytes an unsigned integer in little-endian. This is a UNIX timestamp that coincides with the time of the search query. There is no verified description of this value from Google.

Recipe Extract time from Google ei parameter
[{"op":"Conditional Jump","args":["&ei=[A-Za-z0-9+/=]+",true,"decode",10]},{"op":"Regular expression","args":["User defined","&ei=([A-Za-z0-9+/=]+)",false,false,false,false,false,false,"List capture groups"]},{"op":"Label","args":["decode"]},{"op":"From Base64","args":["A-Za-z0-9+/=",true,false]},{"op":"Take bytes","args":[0,4,false]},{"op":"Swap endianness","args":["Raw",4,true]},{"op":"To Hex","args":["None",0]},{"op":"From Base","args":[16]},{"op":"Translate DateTime Format","args":["UNIX timestamp (seconds)","X","UTC","YYYY-MM-DD HH:mm:ss z","UTC"]}]

Try recipe with example

Input:
qeQ4ZPvBOvmE9u8PrqmyiAM
Output:
2023-04-14 05:29:13 UTC

Tip: The online tool URL Parser finds and decodes this value in an URL automatically too.

Embed PNG image inline in HTML

This recipe can be used to include a PNG image file inline in an HTML page. To do this, the PNG file from the input is encoded with Base64 and the corresponding HTML tag (IMG SRC) is output.

Recipe Embed PNG image inline in HTML
[{"op":"To Base64","args":["A-Za-z0-9+/="]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(.*)$"},"<img src=\"data:image/png;base64,$1\" width=\"\" height=\"\" alt=\"Image\">",true,false,false,true]}]
Input:

A PNG image file

Example output:
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAAYdEVYdFNvZnR3YXJlAHBhaW50Lm5ldCA0LjEuNv1OCegAAAF2SURBVDhPfZM7SwNBFIVHEbSItqKC2ooIVr5AtFJBbIRVZMlz1WIhvyHoj0ih2GlnZ2MREfwJFmJlY2dhF3yFxO/u3pjJZPDCYWbuOefO4+4aX4RhOJbP57fBUaFQiHO53CHjTjabnVSJPzDMI6yBJmh50ERzC6bV0gnIXfBlif/DaxRFo2o1hqPNkPxwRLLbI+M947vDtchdqD3Z/doh69x7Q2kTx3GG3J3Fv4EbqD55sBEW33YBzCeptROlUmkKblMeWFNpFIvFNdusBRaUNpVKZaBcLg/6ANcvx993C7DbuPqFPwPSlR5w8nXDbnssugqQm1C/tPbc5dtICjBZdQmutah+KVAlJx0SNNoaQVKA4w4z6XpEcKr+rkB3ZeuSAhIsetoIthJSg/wKuWdHlxbgzrMsPm1S8URe+v/i5BP8FZBgEYIfn9CDBtpqEAQZtafBJ70M8YBA2tRjhKszXoI5tfjD+p0jOnLMFQ+YL4EhlWgY8wvWmmR3RmM/WgAAAABJRU5ErkJggg==" width="" height="" alt="Image">

Were the free content on my website helpful for you?
Support the further free publication with a donation via PayPal.

Read more about support options...