CyberChef

Details

ID	`CyberChef`
Provider	Open Source
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/cyberchef:1.0.0.10133006`
Supported Modules	Agentix XSIAM

README

CyberChef is a web-application developed by GCHQ that’s been called the “Cyber Swiss Army Knife”.

Configure CyberChef in Cortex

Parameter	Description	Required
Server URL (e.g. https://prod.apifor.io/)	URL or your CyberChef server or https://prod.apifor.io/	True
API Key	API key if you use https://prod.apifor.io/	False
Trust any certificate (not secure)		False
Use system proxy settings		False
Local execution	Uses the cyberchef node package for local execution of your commands	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyberchef-bake

Bake you recipe!

Base Command

cyberchef-bake

Input

Argument Name	Description	Required
input	input data to be used in baking.	Required
recipe	recipe how to bake. use JSON formatting. For example: { “op”: “to decimal”, “args”: { “delimiter”: “Colon” } }.	Required
outputType	Optional argument to define outputType. .	Optional

Context Output

Path	Type	Description
CyberChef.Bake	string	Output of the bake

Command Example

!cyberchef-bake input="One, two, three, four." recipe="{\"op\": \"to decimal\"}"

!cyberchef-bake input="79 110 101 44 32 116 119 111 44 32 116 104 114 101 101 44 32 102 111 117 114 46" recipe="{\"op\": \"from decimal\"}" outputType=string

Human Readable Output

cyberchef-magic

CyberChef Magic function

Base Command

cyberchef-magic

Input

Argument Name	Description	Required
input	The input data for the recipe. Currently accepts strings.	Required
args	Arguments for the magic operation.	Optional

Context Output

Path	Type	Description
CyberChef.Magic	string	Output of the Magic operation

Command Example

!cyberchef-magic input="79 110 101 44 32 116 119 111 44 32 116 104 114 101 101 44 32 102 111 117 114 46"

Human Readable Output

Configuration parameters

local_execution — Local execution
url — Server URL (e.g. https://prod.apifor.io/)
apikey — API Key
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (2)

cyberchef-bake
Bake you recipe!
cyberchef-magic
CyberChef Magic function.

Source

CyberChef.py CyberChef.yml CyberChef_description.md

Download History Raw

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401
import json
from subprocess import run


def build_params(data: dict) -> list[str]:
    params: list[str] = []
    for value in data.values():
        params.append(f"{json.dumps(value)}")
    return params


def test_module(client: BaseClient | None, local_execution: bool):
    data = {"input": "One, two, three, four.", "recipe": "to decimal"}
    if not local_execution and client:
        result = client._http_request("POST", "/bake", json_data=data)
    else:
        params = build_params(data)

        cmd = ["node", "/bake.js"]
        cmd.extend(params)
        process = run(cmd, capture_output=True, text=True)
        result = process.stdout
    if result:
        return "ok"
    else:
        return "Test failed: " + str(result)


def run_command(client: BaseClient | None, data: dict, endpoint: str, local_execution: bool):
    if not local_execution and client:
        response = client._http_request("POST", endpoint, json_data=data)
    else:
        params = build_params(data)
        cmd = ["node", "/bake.js"]
        cmd.extend(params)
        process = run(cmd, capture_output=True, text=True)
        response = process.stdout
    return response


def create_output(results, endpoint: str):
    output = CommandResults(outputs_prefix=f"CyberChef.{endpoint}", outputs_key_field="", outputs=results)
    return output


def main():
    apikey = demisto.params().get("apikey")
    local_execution = argToBoolean(demisto.params().get("local_execution", "false"))

    # get the service API url
    if not local_execution:
        base_url = urljoin(demisto.params()["url"], "/cyberchef")
        verify_certificate = not demisto.params().get("insecure", False)
        proxy = demisto.params().get("proxy", False)
        headers = {"Content-Type": "application/json", "x-api-key": apikey}

    demisto.info(f"Command being called is {demisto.command()}")
    try:
        if not local_execution:
            client = BaseClient(base_url=base_url, verify=verify_certificate, headers=headers, proxy=proxy)
        else:
            client = None

        if demisto.command() == "test-module":
            # This is the call made when pressing the integration Test button.
            result = test_module(client, local_execution)
            demisto.results(result)
        elif demisto.command() == "cyberchef-bake":
            data = {
                "input": demisto.args().get("input"),
                "recipe": json.loads(demisto.args().get("recipe")),
                "outputType": demisto.args().get("outputType"),
            }
            data = remove_empty_elements(data)
            results = run_command(client, data, "/bake", local_execution)
            return_results(create_output(results, "Bake"))
        elif demisto.command() == "cyberchef-magic":
            data = {"input": demisto.args().get("input"), "args": demisto.args().get("args")}
            data = remove_empty_elements(data)
            results = run_command(client, data, "/magic", local_execution)
            return_results(create_output(results, "Magic"))
    # Log exceptions
    except Exception as e:
        return_error(f"Failed to execute {demisto.command()} command. Error: {str(e)}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()