CyberChef Basics for Beginners: Learn Data Parsing & Analysis

Hello and welcome to the Cybersh and essential cyber security tools course. Cybersh is a powerful tool for simplifying service security tasks. In this course, you will learn how to use Cybershe for task like extracting emails, analyzing logs, and working with data format. We will also cover advanced topics like QR code, Wi-Fi setups, and email analysis. By the end of the course, you will know how to use Cybersh effectively in your cyber security workflow. So, let's begin. Kal Linux is a powerful operating system specifically created for cyber security experts, ethical hackers and penetration testers. It is based on Deian Linux and is packed with hundreds of tools designed to test, analyze and secure computer systems and networks. These tools includes Metas Floit for testing vulnerabilities and Matt for scanning networks, WSAR for analyzing network traffic and many more. Kalinux makes these tools accessible and ready to use without require any extra installation or configuration. One of the greatest strengths of Kali Linux is its flexibility. It can run on almost any hardware included on laptops, new desktops, and even Raspberry Pi devices. For added security and convenience, you can run it on a USB sticks or set it up in a virtual machine. This allow you to isolate your work from your primary operating system, keeping your main system safe from any potential risks. The developers of Kali Offensive Security also keep the system updated regularly, ensuring that it always includes the latest tools and improvements. Whether you're scanning for vulnerabilities, conducting forensic investigations, or just learning about cyber security, Kali Linux provides everything you need in a single userfriendly package. is a tool. It's a web tool that you can use for free and you can use it to work with data. So data comes in many different ways. Uh it can be simple text data. It can be in all kind of formats and when you want to change data easily, you can use cyberchf. It's a handy data tool. You can use it right from the web browser. Whether you use Chrome, Safari, Firefox or any other browser. Um you can access it directly. uh it's an open source application. It's a web app and there are many places where you can run it directly online. You can think of it as a Swiss army knife but for data. So a place where you can find many little tools. Um you'll see many many tools here on the left and you can use that for your data to do specific jobs. Now these specific jobs can be saved as a recipe so you can repeat or you can use it again later on. So many all these tools can be used in combination which is called a recipe. For example, it might convert something to Morse code and then maybe you want to do something else like I don't know odd line numbers and this is then called a recipe that you can save and loads and run on your data. So it can be for you might use cyersh for simple tasks like changing text formats uh or doing different encodings um but also for more complex stuff. So the the whole cybersh works with recipes and the recipes is just a series of operations. Um so for example if you think of it like making a sandwich you would put three steps here perhaps more like a pick type of bread. Uh add some fillings and put a top to the slice. So the same way that would be the recipe for a sandwich that you can then drag and drop from left to right. There's also a little search here in case that you want to search for it. Um you can pick as many steps as you want of course and you click bake and it will show the output um given some input. So what can you use Cyberche for? Well basic things like changing text format, encoding, decoding, data cleanup or maybe even some encryption based things. Now it's quite useful because it is running directly on the web. So you can do it in one tap and whenever you need to do a small data operation, you can use cyberchf because it's right there in your browser. So it's just a friendly tool that makes working with data easy. Uh you don't have to know all kind of computer commands. You can just drag and drop and do any kind of commands or any kind of operations on your data uh without learning hundreds of commands. Just load it in your browser, pick the tools, create your recipe, and Cyberchef will handle everything. So, if you're learning about data or working in cyber security, curious or how things work, Cyber Chief just makes everything a lot easier. Cyberchef is a tool you can use online. Um, if you go to the Cyberchf website on github.com, you simply search for Cyberschef, you'll be greeted with this web page. Now, you can either run CyberCh locally on your computer. So, using these Docker commands, or you can use the link here to get a live demo. So, if you this is the most easy way is just to run it online. So, if you click you'll see it will automatically open Cyberchf. Now you can also find other people who are running it online. So you can search for Cyberchef in any search engine. You'll find different URLs where you can run Cyberchef directly and just see many different instances of Cyberchf running. Not this one, sorry. Um but you can find um different ones online. So different instances of Cyberchf and um or or just use the one in the link. Uh it's the most easy one to run and then you'll be shown this kind of interface. If you want to you can run it in the command line using Docker but that requires you to have some experience with Docker or to have and to have Docker installed in your computer. Now Docker in itself would be a course in itself. Um but if you have Docker running and you want to run it locally, you can run these commands or simply run these commands in the terminal. Um but otherwise you can use this link to run Cyberechf and you'll be seeing this kind of interface. Cyberchef has four main parts. Let's dive into each one. First is the operation area on the left. In this area, you'll find many tools CyberJF can use to transfer transform data or process your data. So, some examples are about Morse code. Can convert any message to Morse code or from Morse code. You can do things like URL encoding. URL encoding. Uh you can convert to different computer formats like base 64 or hexadimal. You'll see here to B 64 from B 64 hexadimal from hexadimal to hexadimal. So all kind of computer operations you can do here. Um but you might also find things for basic text operations like to lowerase. You'll see to lowerase, uppercase, swap casing and so on. They are organized by categories. So you can open and close them. You can do encryption uh related things, arithmetic things. Um can do things with language, networking, uh daytime and all these categories here have different tools or operations inside them. Next you have the recipe area which is in the middle. This is where you choose which you in here you can choose which tools or operations you want to use and in what order. So for example uh you can put some operations in there. Let's say to uppercase any uh input text will be converted to uppercase. So we have an input uh part in Cyberchf on the top and an output at the bottom. Now in the input part you can put any uh text. You can uh type it, paste it or upload it. Uh you can open it, open your input as a folder, as a file. Um and you can also type it. Let's say we have some text and immediately you'll see in the output area uh the operation is executed. So it does this recipe. Now there's only one step in there now but we can convert it uh can be multiple steps. So let's say after this we want to convert it to Morse. So we can drag and drop the Morse code and the message is now first converted to uppercase the input message. to convert it to uppercase then to Morse code and you'll see the output here. Now you may want to save the output. You'll see there's a little save to uh output file here. So if you click on that you can select what you want to save it as. You can copy the output uh directly to the clipboard. So copy paste if you want you can also put it in full screen and you can do this with any kind of operations. So now we convert it to uppercase and morse code but it can be any operations you want any data related things. So let's say we don't change it maybe something with language and we can for example convert uh uppercase and lower case. So if this is our input, you see it does this recipe and it converts the lowerase to uppercase and uppercase to lower case because we have the swap case in our recipe. You can do all kind of operations. You can reverse it um any kind of things. Maybe you want to count uh some letter the letter uh E. See it appears only once in the text or the letter O. appears twice and so you can do all kind of operations with data using Cyberchef uh with these four areas. So there's the operation area, all the operations. There's the recipe area where you put your recipe. You can save it or load it as well. You can share them with other people. Um you have the input area where you can either write text directly. You can open the file as an input, can open it from your computer. Um, and can also clear it here with this little bin. If you don't like it, you can clear it after using it or and with output area at the bottom, you'll see output of all the operations where you can save it to a file. You can copy it. Um, and you can also maximize the window if you if you want to. So that's Cyberchf in short. Now, sometimes it might not automatically do the operations. For example, you might write something here. um but it might not automatically execute it. So at the bottom there's the bake button with the autobake. So if that is disabled uh you can type anything here but it's not changing the output. So if autobake is not selected you have to click bake manually or select the autobake and then it will uh work completely automatically. So something to keep in mind if you don't select the autobake button at the bottom it won't automatically uh run the recipe. One of the things you can do with cyberchf is to extract email addresses from some input. So let's say we have some input some text can be any text but let's say we have this text that obviously contains email addresses. Now you could manually do this but if you have very large files then it will just take forever to find all the email addresses. So what you can do with Cyber Jeff is extract things. One of the things you can extract is email addresses. So you'll see we have the top extractors here which lets you extract things from text. So if I click extractors you see we can extract all kind of things from text. We could extract uh for example domain names, website names. You'll see if I do that. Um, it extracts uh domain names from the text. But what we want here is email addresses. So, we take the extract email addresses and then drag and drop it into the recipe fields and then it extracted all the email addresses from this text uh directly into this list. Now, if you want, you can then save this output. you'll see this little save uh output to file option or you can copy it to your clipboard if you want to. Let's say we have an incident report. So we have a lot of text here from an incident report and then we want to extract data from this. Let's say what is interesting in an incident report could be IP addresses, network addresses and website addresses or URLs. So there might be one or more URLs in this text like this one. How can we extract them automatically? So we go again in Cyberf and we search for extractors. Then we drag and drop extract IP addresses. And you'll see we have a list of the IP addresses, network addresses for uh computers. Now another thing we are interested in are the URLs, the websites. So we go to extract URLs and you'll see a list of euros. Now what happens if we try both of them together? You'll see we don't get any output at all because uh first it gets the um let me remove this. First it extracts the URLs and then from the URLs there's no IP addresses. So you cannot do both of them at the same time. You have to do either one of them. Um and if you for example then try extract um IP addresses in this one you'll see there's no um output. Another thing that you might want to be interested or keep aware of is like if we extract IP addresses, you see there's some duplicates here like this is the same address. Um so there's an option here unique to get only the unique IP addresses or the unique data from that set. Uh if we do it with the other one extract URLs and the same thing applies. So there might be duplicates. And if we click unique, we get the unique ones. And you might also want to sort the data. You'll see uh they are unique, but they are very very similar. So the same domain and that's because we extract URLs and not domains. If you just want domains, so just the website names without the all the parts like /d download/lo/installer or whatever, uh we can do extract domains. And then you'll only have the domain names, but keep in mind to select unique so that you only have the unique addresses. You might want to sort them as well. So that's how you can extract uh some data from a text. You can just click on extract and then find what you want to extract. Now it can be anything. For example, maybe you want to have dates. So this case it doesn't grab any of the dates. see a date here but um extracting dates doesn't have the same or the right format. Um but yeah this is how you can uh extract things from a text. Of course whatever is here should also be in the data itself otherwise it cannot be found. So for example if I try extract files you see it doesn't have any files in this text. In computing there are many different formats. You may be familiar with the binary format where something is one or zero like a light switch. So using that format the entire computer works and that means that different characters you see in the computer like ABC will be represented using such codes. So this is actually a b and c and each of them has a different binary code. Now it can easily convert this. So I'll select from binary and you'll see these are ABC. Now computers can use many different formats, many different data formats. The binary code one and zero is only one of them. You'll see they have different formats. The hexadesimal format here which will look slightly different. So if instead of ABC instead of binary so this is the binary format. If instead of that we use the hexadimal format you'll see we get codes like these look completely different. That's because instead of counting from 0 to 1 with hexodimal it counts from 0 to 15. So many different it will look completely different. You'll see here it looks completely different and there are many other formats as well. So you'll see decimal that we humans often use is it 1 to 10. So when you count 1 to 10 ABC will have these codes in the computer and there's several others as well. So the main thing to get from this video is that computers have many different formats um and we just took a quick look at them. You might know that computers turn everything into ones and zeros or zeros and one, highs and lows called the binary format. So if we have some data like a character, we can convert that character into the binary format. Select here from data format we can select two binary and you'll see we get the binary representation of that character. Now we can do that with any character. You'll see different characters have different formats. Can also write them one by one and you'll see they have different binary codes for every uh character. Now if you have some binary codes we can also do the reverse. So if we have these binary codes by default it outputs the same but we'll take then instead of two binary we select from binary drag and drop and you'll see it turned binary into text. Now besides binary in computers many other formats are used like hexadesimo. Now if we remove this let's say we type something we can and we can convert to different format like hexadimal it's another format like binary but different and you'll see has this kind of output and if you scroll down you'll see different bases. So default with counting we use the base 10 system we count from 1 to 10. Um but there are other formats in computing like base 32 where actually count up to 32 characters. Uh base 45, base 58, base 64, even base 92. So the advantage of that is that you would need less characters to write large numbers or large sequences. So let's say we select base 64. Base 64 is often used in computing. You'll see have this kind of text. And with that text we can also convert it vice versa. So base 64 we convert it back to human readable text. So all kind of different formats exist in computing or encodings uh and given some data you can convert from one format of the data to another format uh using this tool. For example, let's say we have this text. We can convert to binary and then but this is a recipe so it doesn't just do one. Let's say we do from binary too. And you see it's converted to binary and then back um from binary. So back to human readable text. And yeah, those are different data formats that you can use. We'll see if you scroll down there's lots of different formats like you can use bry format for the blinds and you'll see this is what it looks like in blind. You might be curious to try it with your own name to see uh what does your name look like in bri. Um and it can also convert bry into human readable text. So if someday I don't know you receive some bry can convert it back to human readable text. And this format doesn't know about lower case and uppercase it seems. Um but any many different kind of formats you can convert to the format and from the format using this data format section. Websites always have a log file. So imagine you have a website. There are people interacting with that website and every action is recorded on that website typically in a log file. So a file like access.log lock. Let's open such a file and see if there's anything suspicious going on. So we open a file as input here and I select access.lo. You'll see this is the file. So you'll see every action by a user. So someone opened index.php here. On the second line you'll see someone open login. The third line someone open profile settings and so on. So that part looks normal. You'll see get and post requests. So get is when you when someone gets data from the website and post is when someone sends data to the website like a password or login information. That's why you'll see here post login they're sending data to the website like their password username and so you'll see different things uh that how people interact with the website. One thing you'll notice here though is you'll see these strange codes. So these codes and this is actually encoded and we can decode these kind of text strings and see what this actually is. So let's say we copy this and we'll try to find out what this encoding is. So we you'll see different data formats here. So you can simply try like maybe this one and you'll see just gibberish. So let's try this one base 64 and you'll see okay this was some token let's open the web the log again so the first one was some token settings PHP someone again uh some code here so let's check what that might be and you'll see actually in the output below uh we can actually see the highlighted text so for example if we select the first one you'll Okay, this looks like some gibberish. Um, and if we take the second one, you actually see evildomain.com. So, that's not good. Um, if we select the next one, see this token doesn't make any sense, but let's remove all the surrounding text. And you'll see there's also evildomain.com. So, there is something suspicious going on with this lock. And using this uh decoding, you can you might be able to find uh more information about what's going on with your website. You'll probably get lots and lots of emails of which some are suspicious, some might be fishing mails. So, let's open one of those emails and take a look. So I open one of the emails. You'll see this is random email which from this user no reply where something about payment. So this email has a link in here and this email could look legit. Um that's what they try to do with these kind of scam emails. You'll see it has a little code in there and we can actually find out what this code means. So if we just select this code, you'll see this looks like some kind of encoding. Um, and in computing most of the times they use B 64 encoding. So let's keep that code and see what's actually in there. So we go to data format, select from B 64. See it's right there from B 64 and see what is actually in there. you'll see this is a fake verification URL. So, it's another way to find out that it's a fake website as they usually have some code in there besides the domain name not being legitimate. Um you can see that this code actually was also completely fake. And so you can actually analyze further uh this kind of emails. With Cyberchef you can create many cool things. For example, let's say you have your Wi-Fi password and you want to share as a QR code. You could simply type your password any input then search for QR generate QR code and you'll see we created a QR code for Wi-Fi password. Now you can select here some options. So which image format do you want? Do you want it as PDF or uh other formats? You can change the size. might want it a bit larger so that people can scan your Wi-Fi password and you'll see you have some other options. Now if you have this we can simply uh save the image. So right click save image and it will download the uh QR code. We click right click save image. It is now saved to your computer. So if you ever wanted to share your um Wi-Fi password or anything else as a QR code, you can do it like this. So it doesn't have to be Wi-Fi password of course it can be anything and then you can uh it can automatically save it. Now if you have a QR code you can either scan it with your cell phone um or you can do it with this cyerechef. So let's say as input we select the file in the downloads directory. So QR codes, then we select uh parse QR codes and you'll see we have our Wi-Fi passwords again. But you would typically do this step of course with your cell phone and not with the computer. But it's good to know that with Cyberchf you can generate QR codes can go to QR codes and from QR codes. Let's open another suspicious email. So, we go into the open files input and we select an email. You'll see this is from suppose it's a bank my bank-secure.com and they want us to do some action and the action that they want us to do is to click this email address. So, this is a fishing mail. So, this is not a official bank website but just to um to mislead you. And so what you can uh do here, we interested in this email address. We can extract it from the email. So we're going to extract the URL that captures the URL. And we are not interested in the domain itself, but rather in what is being sent in all this parameter. So we're going to filter that out. Search for regular expression. And in here we'll paste a regular expression which looks like this. And this will allow you to filter out the parts that we are interested in. So to do that in output format, select lists capture groups and make sure to and you'll see it captured the data after the or all of this data data is you'll see this is simply still in English. is part of the URL and we're interested in what is this data being sent here. So that's the second step with it. A regular expression with this parameter to extract it. Data is and this simply means capture everything after that data is parameter. And we select list capture groups. Then this still looks encoded. You'll see it even says encoded here. So we can decode this. If we search for if we go to data data format data formats different encodings and on the web most likely they use B 64 almost always they use B 64. So we're going to drag and drop that and you'll see um they have some suspicious text here. The decoding here didn't went completely correct. So let's uh pause this step. It might be that this is actually in JSON format. So let's see JSON. Uh maybe parse JSON or from JSON. No, there's nothing like that. Um but if we decode it from base 64, you'll see it captures some text in here. So some suspicious uh text could be a link, it could be a program or anything else. So if a link looks suspicious, you can further analyze it with uh Cyberchef. And sometimes it requires a recipe that gets more complicated. It's not always one step. Sometimes there's multiple actions you need to do to extract the data that you're interested in. On the internet, you can find many more recipes. So, you don't have to write everything yourself. If you search for a cyber chef on the internet, you can find recipes that you can either paste directly in the input box or you might open it and paste it here. So, if you search for Cyberchef recipes, you can find many many websites with recipes on the internet for Cyberchef. For example, the top one I found here has many recipes. So they start with some basic encoding things like base 64 hexadesimal that they're simply uh those ones simply exist here like to base 64 but if we scroll further down you'll find many more recipes uh from character code things to uh specific computer things. So for big numbers extracting GPS coordinates with uh Google URLs um about hacking specifically about web shells that allow access into the computer you can find many many things in here uh that you might be interested in. So, there's many many recipes on the internet um that you can play around with if you're interested.