Lion Cipher Lab
Recognize and decode unknown artifacts in CyberChef: Base64, hex, URL-encoding, and hashes
- Digital Forensics & IR (DFIR)
- Beginner
- ~30 min
- Free · no account required
Why it matters
The unglamorous truth of DFIR and malware triage is that most of the day is spent staring at short, ugly, unexplained strings — a value pulled from a registry key, a chunk of a PowerShell command line, a field in a proxy log, an attachment blob — and the very first decision is 'what am I even looking at?' Get that wrong and you waste an hour trying to Base64-decode a hex string, or worse, try to 'decrypt' a hash that was never reversible in the first place. The professional skill is reading the shape first: length, alphabet, padding, the %XX pattern, the fixed 32/40/64-character hash. Once…
What you'll learn
- recognizing an encoding from the SHAPE of the string (the tells)
- distinguishing Base64, hex, URL/percent-encoding, and simple-substitution on sight
- decoding each in CyberChef with the right operation
- spotting and peeling a layered encoding (Base64 -> gzip -> text) one layer at a time
- identifying a hash by its fixed length and knowing it is NOT reversible
- the judgment of when to decode, when to peel, and when to look up instead
- using CyberChef's Magic auto-detection and knowing its limits
Steps in this lab
- What this drill is — recognition before decoding
- The tells — how to read an encoding from its shape
- Open CyberChef
- Artifact 1 — name it, then decode it (Base64)
- Artifact 2 — name it, then decode it (hex)
- Artifact 3 — name it, then decode it (URL / percent-encoding)
- Artifact 4 — name it, then decode it (a substitution cipher)
- Artifact 5 — a LAYERED encoding: peel it one layer at a time
- Artifact 6 — the one you must NOT try to decode (a hash)
- The Magic wand — and its limits
- The judgment: decode vs peel vs look up (and never confuse the three)