Lion Cipher Lab
Unpack obfuscated data with CyberChef: build a recipe that peels back the layers
- Digital Forensics & IR (DFIR)
- Beginner
- ~45 min
- Free · no account required
Why it matters
Sooner or later somebody hands you a string that looks like gibberish — a command line pulled out of an alert, a query parameter from a suspicious link, a blob sitting in a config file — and asks "what is this?" CyberChef is the fastest honest answer. It was built by an analyst at GCHQ, the UK's signals intelligence agency, for exactly that job, it is free and open source, and it runs entirely in a browser tab, which means it is the one serious analyst tool a total beginner can be using competently within an hour with nothing installed. The specific skill it teaches — stacking operations into…
What you'll learn
- CyberChef recipes
- chaining operations in the right order
- recognizing Base64, hex, gzip, ROT13 and URL encoding on sight
- automatic detection with the Magic operation
- single-byte XOR brute forcing
- decoding PowerShell -EncodedCommand
- unwrapping and defanging a phishing redirect
- safe handling of malware-adjacent strings
Steps in this lab
- What CyberChef is, in one breath
- The one distinction that trips up every beginner
- Open it and learn the four panes
- Your first recipe: one operation
- Let Magic guess for you
- The main event: stack three operations, in the right order
- ROT13, and the two-layer trick
- XOR with a guessed key
- For real: decode an obfuscated PowerShell command line
- For real, part two: unwrap a phishing redirect chain
- Save your recipe, and share it
- What you actually learned