Lion Cipher Lab

Pull the indicators out of a phishing email with CyberChef (headers, links, attachments)

• Digital Forensics & IR (DFIR)
• Intermediate
• ~60 min
• Free · no account required

Why it matters

A reported phishing email is the single most common artifact handed to a junior defender, and it is not one puzzle — it is five. There is a header block that says where the message really came from, an authentication verdict that people routinely misread, a body wearing one or two layers of encoding, links with the real destination buried inside a parameter, and an attachment nobody should open. Analysts who are slow at this open six tools. Analysts who are fast do the whole thing in one browser tab, because CyberChef runs entirely on your own machine inside the page — which is exactly what…

What you'll learn

• driving CyberChef across a whole email artifact, not just a single string
• isolating the Received chain and reading it bottom-up to find the true origin
• reading SPF, DKIM and DMARC results — and what a 'pass' does not prove
• decoding MIME bodies: quoted-printable, Base64 parts, and odd character sets
• bulk IOC extraction with Extract URLs / IP addresses / email addresses
• custom pattern matching with the Regular expression and Filter operations
• using Magic as a hint generator rather than an answer
• defanging indicators as a professional reflex before anything is shared
• hashing an attachment in-browser and handing off to VirusTotal or YARA
• saving and sharing a recipe so triage becomes reusable team infrastructure

Steps in this lab

1. What this lab is — and what it deliberately is not
2. Why a browser tool is the SAFE place to handle hostile strings
3. Build your own artifact: send yourself a message engineered to be interesting
4. Load the whole message into CyberChef (and the one trick that gets you the body)
5. Isolate the Received chain — and read it BOTTOM-UP
6. SPF, DKIM, DMARC — what each one actually proves, and what a PASS does not
7. Decode the body: quoted-printable, Base64 parts, and awkward character sets
8. Bulk extraction: get every URL, IP and address out in one pass
9. Peel the layered link — and use Magic as a hint, never as an answer
10. Defang everything — the habit that separates professionals from everyone else
11. Hash the attachment in-browser — and the real cost of uploading it
12. Save the recipe — turn twenty minutes of triage into ten seconds of it
13. WHEN this is the right tool — and when to stop and write a script
14. What you actually learned

Open the full interactive lab →