CyberChef Workflows Explained

How CyberChef Builds Workflows

CyberChef workflows are created by chaining operations together in a structured order. Each operation takes input data, processes it, and passes the output to the next step.

1. Workflow Components

• Input Section – Where raw data (text, files, hex, etc.) is provided.
• Operations Panel – Contains available operations such as encoding, encryption, and conversions.
• Recipe Panel – Where operations are added to build a processing pipeline.
• Output Section – Displays the transformed results.

2. Steps to Build a Workflow

Step 1: Provide Input

Input can be text, hex, binary, or even files.

Step 2: Add Operations

Operations are selected from the Operations Panel and dragged into the Recipe Panel.

Step 3: Configure Each Operation

Each operation has parameters that can be adjusted for customization.

Step 4: Execute and View Output

Once the recipe is complete, CyberChef processes the input step-by-step and displays the final output in the Output Section.

3. Example Workflows

Example 1: Decoding Base64 and Extracting JSON

Input:

eyJ1c2VybmFtZSI6ICJKb2huRG9lIiwgImFnZSI6IDI1fQ==

Recipe:

1. "From Base64" → Converts Base64 to plaintext.
2. "Extract JSON" → Parses JSON-formatted text.

Output:

{
  "username": "JohnDoe",
  "age": 25
}

Example 2: Decrypting ROT13 Encoded Text

Input:

Uryyb Jbeyq!

Recipe:

1. "ROT13" → Decodes ROT13 obfuscation.

Output:

Hello World!

4. Advanced Workflows

Example 3: Extracting IP Addresses from Logs

Recipe:

1. "Extract Regular Expression" → Regex: \b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b
2. "Deduplicate" → Removes duplicate IPs.
3. "Sort" → Sorts extracted IPs.

5. Exporting and Sharing Workflows

CyberChef allows users to:

• Save Recipes: Export workflow as a JSON file.
• Share Recipes: Generate a shareable URL.
• Import Recipes: Load pre-made workflows for automation.

Final Thoughts

CyberChef is an intuitive and powerful tool for performing data manipulation, automation, and forensic analysis without coding. It’s widely used in cybersecurity, digital forensics, and reverse engineering.