geek-cookbook/manuscript/recipes/cyberchef.md

CyberChef

Are you a l33t h@x0r? Do you need the right tools at your fingertips to support your #masterhacker skillz? Look no further than CyberChef, lovingly baked for you by your friends at GHCQ¹ !

CyberChef is a simple, intuitive web app for carrying out all manner of "cyber" operations within a web browser. These operations include simple encoding like XOR or Base64, more complex encryption like AES, DES and Blowfish, creating binary and hexdumps, compression and decompression of data, calculating hashes and checksums, IPv6 and X.509 parsing, changing character encodings, and much more.

Here are some examples of fancy hax0r tricks you can do with CyberChef:

• Decode a Base64-encoded string
• Decrypt and disassemble shellcode
• Perform AES decryption, extracting the IV from the beginning of the cipher stream
• Automagically detect several layers of nested encoding

Here's a live demo!

--8<-- "recipe-standard-ingredients.md"

Preparation

Setup Docker Swarm

CyberChef doesn't require any persistent storage, or fancy configuration, so simply create a docker swarm config file in docker-compose syntax (v3), something like this:

--8<-- "premix-cta.md"

version: "3.2" # https://docs.docker.com/compose/compose-file/compose-versioning/#version-3

services:
  cyberchef:
    image: mpepping/cyberchef
    deploy:
      labels:
        # traefik
        - traefik.enable=true
        - traefik.docker.network=traefik_public

        # traefikv1
        - traefik.frontend.rule=Host:cyberchef.example.com
        - traefik.port=8000     

        # traefikv2
        - "traefik.http.routers.cyberchef.rule=Host(`cyberchef.example.com`)"
        - "traefik.http.routers.cyberchef.entrypoints=https"
        - "traefik.http.services.cyberchef.loadbalancer.server.port=8000"           
    networks:
      - traefik_public

networks:
  traefik_public:
    external: true

Serving

Cyber the Chef!

Launch your CyberChef stack by running docker stack deploy cyberchef -c <path -to-docker-compose.yml>, and then visit the URL you chose to begin the hackery!

--8<-- "recipe-footer.md"

---

1. Government Communications Headquarters, commonly known as GCHQ, is an intelligence and security organisation responsible for providing signals intelligence and information assurance to the government and armed forces of the United Kingdom ↩︎