Format Apache HTTP access log
Extract EXIF information
Extract compile time from an executable file
Extract URLs and email addresses from files
Extract URLs from .url files
Filter out disposable mail addresses
Request information about email addresses
Convert INI file to HTML table
Convert text to HTML
Convert TSV file to HTML table
Extract time from Google ei parameter
On this page you can find ready to use CyberChef recipes. CyberChef is a web application for analyzing and decoding data.
Read more about CyberChef, including a description of the main features.
Tips:
Did you like my page, one of my freeware applications or online tools?
Then, please donate via PayPal in order to help keeping its content free - each amount is welcome!
This CyberChef recipe extracts information from one or more lines of an Apache HTTP access log (combined log format) and outputs it formatted with labels.
The date is converted to ISO format and the time zone is changed to UTC.
[{"op":"Find / Replace","args":[{"option":"Regex","string":"^\\s*([^\\s].*[^\\s])\\s*$"},"$1",false,true,false,true]},{"op":"Fork","args":["\\n","\\n",false]},{"op":"Subsection","args":[" \\[([^\\]]+)\\] ",true,true,false]},{"op":"Translate DateTime Format","args":["Automatic","DD/MMM/YYYY:HH:mm:ss","UTC","YYYY-MM-DD HH:mm:ss ZZ","UTC"]},{"op":"Merge","args":[false]},{"op":"Register","args":["^(\\S+) (\\S+) (\\S+) \\[([^\\]]+)\\] \"(\\S+) (.*?) (\\S+)\" (\\S+) (\\S+) \"([^\"]*)\" \"([^\"]*)\"",true,false,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":".*"},"Client Request:\\n Host: $R0\\n Date/Time: $R3\\n Method: $R4\\n File/Path: $R5\\nWebserver Response:\\n Status Code: $R7\\n Bytes Sent: $R8\\nInformation from Client:\\n Referrer: $R9\\n User-Agent: $R10\\n",false,false,false,true]}]
Input:
198.51.100.1 - - [03/Apr/2023:10:36:08 +0200] "GET /en/software/ HTTP/1.1" 404 1527 "https://www.gaijin.at/en/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0"
Output:
Client Request: Host: 198.51.100.1 Date/Time: 2023-04-03 08:36:08 +0000 Method: GET File/Path: /en/software/ Webserver Response: Status Code: 404 Bytes Sent: 1527 Information from Client: Referrer: https://www.gaijin.at/en/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
This CyberChef recipe extracts EXIF information from a picture file and removes unnecessary information and formats the UNIX timestamps to an ISO date.
[{"op":"Extract EXIF","args":[]},{"op":"Find / Replace","args":[{"option":"Regex","string":"Found \\d+ tags.\\n\\n"},"",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"\\n(StripOffsets|StripByteCounts): [^\\n]+"},"",true,false,true,false]},{"op":"Subsection","args":["\\n(?:ModifyDate|DateTimeOriginal): (\\d+)",true,true,false]},{"op":"Translate DateTime Format","args":["UNIX timestamp (seconds)","X","UTC","YYYY-MM-DD HH:mm:ss z","UTC"]}]
Example output:
Make: NIKON CORPORATION Model: NIKON D70 Orientation: 1 XResolution: 240 YResolution: 240 ResolutionUnit: 2 Software: GIMP 2.4.5 ModifyDate: 2008-06-22 06:17:32 UTC ExposureTime: 0.005 FNumber: 9 ExposureProgram: 1 ISO: 200 DateTimeOriginal: 2008-04-10 19:42:08 UTC ShutterSpeedValue: 7.591430 ApertureValue: 6.75239 ExposureCompensation: -1 MaxApertureValue: 3.3 MeteringMode: 2 Flash: 0 FocalLength: 100 ColorSpace: 1 ExifImageWidth: 100 ExifImageHeight: 66 FocalLengthIn35mmFormat: 150
Outputs the compile time from a Microsoft Portable Executable image file (.exe, .dll etc.).
Note: Most applications from Microsoft itself do not contain a correct date.
[{"op":"Comment","args":["Extract EXE Compile Time\n\nOutputs the compile time from a Microsoft Portable Executable image file (.exe, .dll etc.).\n\nNote: Does not show a correct date for most applications from Microsoft itself.\n\nFind more recipes at https://www.gaijin.at"]},{"op":"Take bytes","args":[0,1024,false]},{"op":"Store / Restore Input","args":["Store","orig"]},{"op":"Take bytes","args":[60,4,false]},{"op":"Swap endianness","args":["Raw",4,true]},{"op":"To Hex","args":["Space",0]},{"op":"From Base","args":[16]},{"op":"Register","args":["([\\s\\S]*)",true,false,false]},{"op":"Store / Restore Input","args":["Restore","orig"]},{"op":"Find / Replace","args":[{"option":"Regex","string":".{8}.{$R0}(.{4}).*"},"$1",false,true,false,true]},{"op":"Swap endianness","args":["Raw",4,true]},{"op":"To Hex","args":["Space",0]},{"op":"From Base","args":[16]},{"op":"From UNIX Timestamp","args":["Seconds (s)"]}]
Or the 10 operations shorter recipe for the Gaijin.at version:
[{"op":"Comment","args":["Extract EXE Compile Time\n(Gaijin.at Version only)\n\nOutputs the compile time from a Microsoft Portable Executable image file (.exe, .dll etc.).\n\nNote: Does not show a correct date for most applications from Microsoft itself.\n\nFind more recipes at https://www.gaijin.at"]},{"op":"Take bytes by position","args":[60,"4 (DWord)","Little Endian (Intel)",12]},{"op":"Bytes to Decimal","args":[8,"4 (DWord)","Little Endian (Intel)"]},{"op":"From UNIX Timestamp","args":["Seconds (s)"]}]
Input:
An .exe file, e.g. per drag und drop.
Example output:
Mon 24 October 2022 18:14:55 UTC
CyberChef can extract URLs and e-mail addresses from a text. To read URLs and e-mail addresses from files - even recursively - you can use console commands.
The Windows console command
findstr /S "://" *.txt > urls.txt
oder under Linux the command
grep -Ihr --include="*.txt" "://" * > urls.txt
writes the lines from all text files that may contain a URL to the output file "urls.txt". The parameter "/S" or "-r" causes the recursive search in subdirectories. The output file is now loaded into CyberChef via drag and drop or with the open function as input. The following recipe outputs the URLs without duplicates and sorted.
Extract_URLs(false,true,true)
For e-mail addresses the procedure is very similar. The console command is called with a short regular expression:
findstr /S /R ".+@[a-z0-9]" *.txt > emails.txt
Oder unter Linux:
grep -EIihr --include="*.txt" ".+@[a-z0-9]" * > emails.txt
The output file is loaded into CyberChef. The recipe below outputs all email addresses without duplicates and sorted.
Extract_URLs(false,true,true)
With the Windows console command "type *.url > urls.txt" the contents of all .url files will be written to the file "urls.txt". After that load the following recipe in CyberChef:
[{"op":"Regular expression","args":["User defined","(?:^|[\\r\\n])\\[InternetShortcut\\][^\\[]*[\\r\\n]URL=([^\\r\\n]*)(?:[\\r\\n]|$)",true,true,false,false,false,false,"List capture groups"]}]
Move the file "urls.txt" via drag and drop onto the input field in CyberChef. In the output only those data are contained, which are entered in the line "URL" of the section "InternetShortcut".
Another method would be to extract all URLs with "Extract_URLs(false,true,true)". The output of the addresses is sorted and without duplicates.
From a list of email addresses, this recipe filters out those that are so-called disposable email addresses or temporary email addresses.
[{"op":"Fork","args":["\\n","\\n",false]},{"op":"Register","args":["([\\s\\S]*)",true,false,false]},{"op":"HTTP request","args":["GET","https://open.kickbox.com/v1/disposable/$R0","","Cross-Origin Resource Sharing",false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(\\{\"disposable\":true\\})$"},"$R0",true,false,true,false]},{"op":"Merge","args":[true]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"{\"disposable\":false}"},"",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(\\s+)"},"\\n",true,false,true,false]}]
Input:
test1@byom.de test@test.tld test2@byom.de
Output:
test1@byom.de test2@byom.de
This CyberChef recipe retrieves information about one or more mail addresses via the disify.com service and formats the result.
[{"op":"Fork","args":["\\n","\\n",false]},{"op":"Register","args":["([\\s\\S]*)",true,false,false]},{"op":"HTTP request","args":["GET","https://www.disify.com/api/email/$R0","","Cross-Origin Resource Sharing",false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"{"},"$R0:\\n{",true,false,true,false]},{"op":"Merge","args":[true]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(\\{\\n|\\}|\"|,)"},"",true,false,true,false]}]
Input:
test1@byom.de test@test.tld test2@byom.de
Output:
test1@byom.de:
format: true
domain: byom.de
disposable: true
test@test.tld:
format: true
domain: test.tld
disposable: false
dns: false
test2@byom.de:
format: true
domain: byom.de
disposable: true
This CyberChef recipe queries information about one or more mail addresses via the mailcheck.ai service and formats the result.
[{"op":"Fork","args":["\\n","\\n",false]},{"op":"Register","args":["([\\s\\S]*)",true,false,false]},{"op":"HTTP request","args":["GET","https://api.mailcheck.ai/email/$R0","","Cross-Origin Resource Sharing",false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"{"},"$R0:\\n{",true,false,true,false]},{"op":"Merge","args":[true]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"\""},"",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":":"},": ",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"{"}," ",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"}"},"\\n",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":","},"\\n ",true,false,true,false]}]
Input:
test1@byom.de test@test.tld test2@byom.de
Output:
test1@byom.de:
status: 200
email: test1@byom.de
domain: byom.de
mx: true
disposable: true
alias: false
did_you_mean: null
test@test.tld:
status: 200
email: test@test.tld
domain: test.tld
mx: false
disposable: false
alias: false
did_you_mean: null
test2@byom.de:
status: 200
email: test2@byom.de
domain: byom.de
mx: true
disposable: true
alias: false
did_you_mean: null
With this CyberChef recipe an INI file can be converted to a HTML table.
[{"op":"Find / Replace","args":[{"option":"Regex","string":"(.+)\\["},"$1</table>\\n[",true,false,false,true]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(.*)$"},"$1\\n</table>",false,false,false,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^\\[([^\\]]*)\\]"},"<h3>$1</h3>\\n<table>",true,false,true,false]},{"op":"Fork","args":["\\n","\\n",false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^([^\\=]*)=(.*)$"},"<tr><th>$1</th><td>$2</td></tr>",false,false,false,false]},{"op":"Merge","args":[true]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"<table>"},"<table border=\"1\">",true,false,false,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(.*)$"},"<!DOCTYPE html>\\n<html>\\n<body>\\n$1\\n</body>\\n</html>\\n",true,false,true,true]}]
Input:
[Section1] Key1=Value1 Key2=Value2 [Section2] Key3=Value3
Output:
<!DOCTYPE html> <html> <body> <h3>Section1</h3> <table border="1"> <tr><th>Key1</th><td>Value1</td></tr> <tr><th>Key2</th><td>Value2</td></tr> </table> <h3>Section2</h3> <table border="1"> <tr><th>Key3</th><td>Value3</td></tr> </table> </body> </html>
This recipe converts a text with paragraphs to a HTML document.
[{"op":"Find / Replace","args":[{"option":"Regex","string":"&"},"&",true,false,false,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"<"},"<",true,false,false,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":">"},">",true,false,false,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^\\s*(.*?)\\s*$"},"$1",true,true,false,true]},{"op":"Find / Replace","args":[{"option":"Regex","string":"\\s*[\\r\\n]+\\s*"},"</p>\\n<p>",true,true,false,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(.*)$"},"<!DOCTYPE html>\\n<html lang=\"en\">\\n<body>\\n<p>$1</p>\\n</body>\\n</html>\\n",true,true,false,true]}]
Alternatively, the text in the following recipe is taken unchanged and surrounded with pre tags so that the formatting is preserved when displayed.
[{"op":"Find / Replace","args":[{"option":"Regex","string":"&"},"&",true,false,false,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"<"},"<",true,false,false,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":">"},">",true,false,false,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(.*)$"},"<!DOCTYPE html>\\n<html lang=\"en\">\\n<body>\\n<pre>$1</pre>\\n</body>\\n</html>\\n",true,true,false,true]}]
Input:
111
222
333
Output (with paragraphs):
<!DOCTYPE html> <html lang="en"> <body> <p>111</p> <p>222</p> <p>333</p> </body> </html>
Output (preformatted):
<!DOCTYPE html>
<html lang="en">
<body>
<pre> 111
222
333 </pre>
</body>
</html>
With this CyberChef recipe a TSV file can be converted to a HTML table.
[{"op":"Find / Replace","args":[{"option":"Extended (\\n, \\t, \\x...)","string":"\\t"},"</td><td>",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"^(.*)$"},"<tr><td>$1</td></tr>",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(.*)"},"<!DOCTYPE html>\\n<html lang=\"en\">\\n<body>\\n<table border=\"1\">\\n$1\\n</table>\\n</body>\\n</html>\\n",false,false,true,true]}]
This recipe extracts the time of the search query from the data structure of the ei parameter of a Google URL. The recipe accepts the value itself or the entire URL as input.
The ei parameter is encoded with Base64 and contains in the first 4 bytes an unsigned integer in little-endian. This is a UNIX timestamp that coincides with the time of the search query. There is no verified description of this value from Google.
[{"op":"Conditional Jump","args":["&ei=[A-Za-z0-9+/=]+",true,"decode",10]},{"op":"Regular expression","args":["User defined","&ei=([A-Za-z0-9+/=]+)",false,false,false,false,false,false,"List capture groups"]},{"op":"Label","args":["decode"]},{"op":"From Base64","args":["A-Za-z0-9+/=",true,false]},{"op":"Take bytes","args":[0,4,false]},{"op":"Swap endianness","args":["Raw",4,true]},{"op":"To Hex","args":["None",0]},{"op":"From Base","args":[16]},{"op":"Translate DateTime Format","args":["UNIX timestamp (seconds)","X","UTC","YYYY-MM-DD HH:mm:ss z","UTC"]}]
Input:
qeQ4ZPvBOvmE9u8PrqmyiAM
Output:
2023-04-14 05:29:13 UTC
Did you like my page, one of my freeware applications or online tools?
Then, please donate via PayPal in order to help keeping its content free - each amount is welcome!