CyberChef Recipes: The Open-Source In-Browser Swiss Army Knife

When transforming data payloads, formatting unreadable JSON, or inspecting obfuscated command snippets, CyberChef operates as a completely client-side, zero-telemetry open-source powerhouse.

Here are three reusable recipe chains I keep pinned for immediate payload extraction.

1. PowerShell EncodedCommand Extraction

Attackers frequently launch child processes using the -enc / -EncodedCommand flag, which expects UTF-16LE Base64 strings.

The Pipeline:

1. From Base64 (Standard alphabet)
2. Decode text (Encoding: UTF-16LE (1200))
3. Regular expression (User regex: https?://[^\s"']+)

Input:
dwBhAHIAaQBhAGIAbABlACAAZQBtAGEAaQBsACAAPQAgACcAaAB0AHQAcABzADoALwAvAG0AYQBsAGkAYwBpAG8AdQBzAC0AZABvAG0AYQBpAG4ALgBsAGEAbgAvAHAAaQBuAGcAJwA=

Output:
https://malicious-domain.lan/ping

2. Multi-Stage XOR Brute Force

Command-and-control shellcode payloads commonly mask strings with a single-byte XOR key. Rather than guessing, CyberChef's XOR Brute Force operation iterates through all 256 keys and displays the highest entropy matches.

• Add operation: XOR Brute Force
• Key length: 1
• Sample search string: http or kernel32

3. Extracting IOCs from Raw Headers

When handling raw MIME email headers, use Extract IP Addresses and Defang URL in sequence to instantly compile an indicator-of-compromise report ready for threat intelligence lookups on VirusTotal or AbuseIPDB.