Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CyberChef from GCHQ: Cyber Swiss Army Knife

gchq.github.io

Post reply on HN
Print view View original

51–60 of 61 posts

Re: CyberChef from GCHQ: Cyber Swiss Army Knife

#51

Post by JetSetIlly »

defrost wrote: post #41
wrboyce wrote: post #36

Earlier quoted context omitted.

What did GC&CS stand for? (Yes I could search for this but I feel like curious conversation is almost a lost art these days.)

I'd have to check my notes from a 40 year old interview with a former Bletchley Park code breaker .. as I recall ... The official legit name of GC&CS was Government Code and Cypher School .. but IIRC at the time (1919 post WWI) the official name was coined it was putting out letterheads and contracts as G Copper & Cable Services. That's a dim recollection of what may have been one of many inside jokes | chuckles from…

I've always been amused by these boring sounding cover names. In the USSR, nuclear related work was administered by the "Ministry of Medium Machine Building".

And The Manhattan Project was originally the "Manhattan Engineering District". Although that sounds a little bit exotic, at least to my ears.

Re: CyberChef from GCHQ: Cyber Swiss Army Knife

#52

Post by softblush »

2024throwaway wrote: post #28
softblush wrote: post #20

Too bad there hasn't been any development at all since July 2023

Is there a feature you're missing?

Me personally? No. But there are a lot of open bug reports, feature requests and PRs. None of them seem to get any response at all.

Maybe it's deemed complete but then I'd wish they just add a message saying so.

Re: CyberChef from GCHQ: Cyber Swiss Army Knife

#53

Post by RF_Savage »

anyoneamous wrote: post #44
nailer wrote: post #10

Earlier quoted context omitted.

> you never have to send your sensitive data to some random server anymore If you live in the UK you are already sending one entire month of your full personal communications, and three months of your communications metadata, to this government organisation. Pardon the off-topic rant.

You say "police state", I say "government subsidized backups".

Unfortunately write only backups from one's own perspective.

Re: CyberChef from GCHQ: Cyber Swiss Army Knife

#54

Post by sprremix »

tamimio wrote: post #29

I use Ciphey instead in any reverse engineering stuff, far better. https://github.com/ciphey/ciphey

I also discovered Ciphey. Neat little tool indeed, but I just found out it's being deprecated. It's mentioned in this issue[1] and being replaced with Ares[2]. Neither could decipher this strange encryption[3] I used it on unfortunately.

[1] https://github.com/Ciphey/Ciphey/issues/764

[2] https://github.com/bee-san/Ares

[3] "dEFLWWFKQWxRQW16RnkvbTZML0lsdz09" original text is "hacker". But it is unknown how it's being encrypted.

Re: CyberChef from GCHQ: Cyber Swiss Army Knife

#55

Post by billy99k »

hermitcrab wrote: post #37
billy99k wrote: post #23

I use this a lot. Especially for base64 and urlencoding.

You might be interested in trying our Easy Data Transform software. It is general purpose data wrangling software, rather than security specific. But it can do base64 and url encoding (in the 'Decode' transform) as well as 65 other transforms (join, dedupe etc) and it can handle multi-million row datasets. Plus in my (biased) opinion, it has a much nicer UI. Not free though.

I use it for security/pentesting, so I don't really need multi-million row datasets.

Re: CyberChef from GCHQ: Cyber Swiss Army Knife

#56

Post by hermitcrab »

billy99k wrote: post #55
hermitcrab wrote: post #37

Earlier quoted context omitted.

You might be interested in trying our Easy Data Transform software. It is general purpose data wrangling software, rather than security specific. But it can do base64 and url encoding (in the 'Decode' transform) as well as 65 other transforms (join, dedupe etc) and it can handle multi-million row datasets. Plus in my (biased) opinion, it has a much nicer UI. Not free though.

I use it for security/pentesting, so I don't really need multi-million row datasets.

It will also work with 10 rows. ;0)

If you need to wire together a pipeline of transforms (e.g. merge 2 datasets->remove empty rows->dedupe rows->filter rows) then the visual data flow approach is very powerful. But if you are only doing 1 transform (e.g. base64 encoding) then it doesn't have any real advantages.

Re: CyberChef from GCHQ: Cyber Swiss Army Knife

#57

Post by spydum »

declaredapple wrote: post #14
spydum wrote: post #12

Earlier quoted context omitted.

Literally one of my favorite tools for years. The recipe idea and chaining, plus the crazy list of ingredients is super useful if anybody does CTFs.. much faster than throwing together some bits of Python

What use cases are you using it for? I haven't used it a ton, but I've found the UI to be clunkly and somewhat difficult to figure out compared to using the shell with jq

others have commented, but it's really pretty varied.

- literally yesterday used it for building a payload for a vuln that used a java deserialization vulnerability against a known private key for AES encryption. I built the serialized payload using ysoserial as per normal, but then b64 encoded that, then encrypted with the known key and urlencoded the final output.. then I can simply hand that off to curl or burp or whatever.

- sometimes it's as simple as other said, encode/decode chains of various formats -- it's just faster especially if I'm not sure how it was encoded, but I recognize particular patterns (e.g.: url encode, b64 super easy to recognize visually, so plug and play of recipes makes it fast to try stuff out and tune).

Re: CyberChef from GCHQ: Cyber Swiss Army Knife

#58

Post by gchq-7703 »

Hnrobert42 wrote: post #45
saagarjha wrote: post #2

CyberChef is really useful, and it runs locally, so you never have to send your sensitive data to some random server anymore. The “recipes” feature is quite powerful, too, but I think my favorite thing about it is that I can often just paste random data in and run the “Magic” script and it’ll try to guess the data format for me.

Is the Magic function anything like running `file` on a Linux/Mac?

It uses a combination of magic bytes (like the `file` command), entropy analysis and character frequency detection to determine whether an output is likely to be of interest to the user.

The file type mechanism is written here[0]. There's a list of all signatures we detect here[1]. The magic implementation is here[2].

[0] https://github.com/gchq/CyberChef/blob/master/src/core/lib/F... [1] https://github.com/gchq/CyberChef/blob/master/src/core/lib/F... [2] https://github.com/gchq/CyberChef/blob/master/src/core/lib/M...

Re: CyberChef from GCHQ: Cyber Swiss Army Knife

#59

Post by pretty_dumm_guy »

baconhigh wrote: post #24

From the last time; protip: Open the JS console (F12 / inspect) and start the CyberChef challenges! 43 6f 6e 67 72 61 74 75 6c 61 74 69 6f 6e 73 2c 20 79 6f 75 20 68 61 76 65 20 63 6f 6d 70 6c 65 74 65 64 20 43 79 62 65 72 43 68 65 66 20 63 68 61 6c 6c 65 6e 67 65 20 23 31 21 0a 0a 54 68 69 73 20 63 68 61 6c 6c 65 6e 67 65 20 65 78 70 6c 6f 72 65 64 20 68 65 78 61 64 65 63 69 6d 61 6c 20 65 6e 63 6f 64 69 6e 67 2e 20…

Neat!

  str.trim().split(" ").map(hex => String.fromCharCode("0x" + hex)).join()
seems to give the answer.

Re: CyberChef from GCHQ: Cyber Swiss Army Knife

#60

Post by wrboyce »

defrost wrote: post #41
wrboyce wrote: post #36

Earlier quoted context omitted.

What did GC&CS stand for? (Yes I could search for this but I feel like curious conversation is almost a lost art these days.)

I'd have to check my notes from a 40 year old interview with a former Bletchley Park code breaker .. as I recall ... The official legit name of GC&CS was Government Code and Cypher School .. but IIRC at the time (1919 post WWI) the official name was coined it was putting out letterheads and contracts as G Copper & Cable Services. That's a dim recollection of what may have been one of many inside jokes | chuckles from…

Fantastic, I’m glad I asked! Thanks for the insight.
Post reply on HN