CyberChef Recipes Reference

Overview

CyberChef Recipes is a community-contributed collection of CyberChef operation chains (recipes) designed to solve common data transformation, malware analysis, and forensic investigation challenges. This reference guide explains how these recipes work and how they can be integrated with the CyberChef MCP Server.

Project Information

Property	Value
Project Name	cyberchef-recipes
Repository	https://github.com/mattnotmax/cyberchef-recipes
Primary Author	Matt Notmax (@mattnotmax)
Contributors	Community-contributed (see individual recipe credits)
License	Not specified (assumed open for educational use)
Total Recipes	70+ recipes (as of latest update)
Format	JSON arrays of CyberChef operations

Description

CyberChef Recipes is a curated collection of operation chains that demonstrate how to use CyberChef for real-world security and data analysis tasks. The repository serves as:

A knowledge base for malware analysts
A tutorial resource for learning CyberChef capabilities
A reference for CTF challenge solutions
A library of reusable data transformation patterns

The project emphasizes practical, battle-tested recipes used in actual incident response, malware analysis, and digital forensics investigations.

Recipe Categories

The recipes cover a broad range of security and forensics use cases:

Malware Analysis (35+ recipes)

PowerShell Deobfuscation: Invoke-Obfuscation, CharCode obfuscation, Cobalt Strike beacons, Emotet, Dridex, BazarLoader, IcedID, Qakbot, Bumblebee
PHP Webshells: gzinflate/base64 encoding, multi-stage deobfuscation, auto-visitor scripts, Magento skimmers
Office Maldocs: OOXML analysis, macro extraction, VBA deobfuscation, DOSfuscation
Binary Analysis: .NET string extraction, shellcode extraction, PE file carving, disassembly
Ransomware: REvil, JobCrypter, GoldMax/Sunshutte decryption

Data Extraction & Encoding (20+ recipes)

Base64 Variants: Standard, URL-safe, multi-stage encoding, Base-45
Character Encoding: CharCode, hexadecimal, octal, mixed encodings
Compression: gzip, zlib, raw inflate
Regex Patterns: URL extraction, hash extraction, IP addresses, encoded data

Forensics & Investigations (15+ recipes)

File Analysis: Squid proxy cache, Recycle Bin parser, MFT timestamps
Network Analysis: PCAP parsing, JA3/JA3S fingerprinting, HTTP requests
Log Analysis: Timestamp conversions (Google ei, Squid, UNIX), event log parsing
Artifact Extraction: GPS coordinates, Group Policy passwords, Windows Event IDs

Data Transformation (10+ recipes)

Cryptography: AES decryption, custom cipher schemes
Format Conversion: Hex/binary conversions, MSI ProductCode transformations, Java byte arrays
Text Processing: String reversal, character substitution, regex replacement
Utility: Password generation, WiFi QR codes, meme creation, randomization

Advanced Techniques

Control Flow: Loops and labels for iterative processing
Subsections: Nested subsections for multi-layer obfuscation
Registers: Storing and retrieving intermediate values
Conditional Jumps: Dynamic recipe branching
HTTP Requests: API lookups and external data retrieval

Recipe Format

JSON Structure

CyberChef recipes are represented as JSON arrays of operation objects. Each operation follows this structure:

[
  {
    "op": "Operation Name",
    "args": ["argument1", "argument2", true, false, ...]
  },
  {
    "op": "Next Operation",
    "args": [...]
  }
]

Example: Simple Base64 Decoding

[
  {
    "op": "Regular expression",
    "args": ["User defined", "[a-zA-Z0-9+/=]{30,}", true, true, false, false, false, false, "List matches"]
  },
  {
    "op": "From Base64",
    "args": ["A-Za-z0-9+/=", true]
  },
  {
    "op": "Raw Inflate",
    "args": [0, 0, "Adaptive", false, false]
  },
  {
    "op": "Generic Code Beautify",
    "args": []
  }
]

This recipe:

Extracts Base64 strings (30+ characters) using regex
Decodes the Base64
Decompresses using raw inflate
Beautifies the resulting code

Advanced Features

Loops and Labels

[
  {"op": "Label", "args": ["top"]},
  {"op": "Regular expression", "args": ["User defined", "[a-zA-Z0-9+/=]{30,}", ...]},
  {"op": "From Base64", "args": ["A-Za-z0-9+/=", true]},
  {"op": "Jump", "args": ["top", 28]}
]

This creates a loop that processes Base64 encoding 29 times (useful for heavily nested encodings).

Registers

[
  {"op": "Extract Data", "args": [...]},
  {"op": "Register", "args": ["$R0", false]},
  {"op": "HTTP request", "args": ["GET", "https://api.example.com/$R0", ...]},
  {"op": "Find / Replace", "args": [{"option": "Regex", "string": "$R0"}, "value", ...]}
]

Registers ($R0, $R1, etc.) store intermediate values for reuse later in the recipe.

Subsections

[
  {"op": "Subsection", "args": ["regex pattern", "\\n", true, true]},
  {"op": "From Base64", "args": [...]},
  {"op": "Merge", "args": []},
  {"op": "Generic Code Beautify", "args": []}
]

Subsections process matched sections independently, then merge results back.

Integration with CyberChef MCP

Using Recipes with cyberchef_bake

The cyberchef_bake MCP tool accepts recipes in the exact JSON format used by cyberchef-recipes:

// Example MCP tool call
{
  "name": "cyberchef_bake",
  "arguments": {
    "input": "SGVsbG8gV29ybGQh",
    "recipe": [
      {"op": "From Base64", "args": ["A-Za-z0-9+/=", true]}
    ]
  }
}

Recipe Translation

Most recipes from cyberchef-recipes can be used directly with MCP by:

Extracting the recipe JSON from the README
Passing it as the recipe argument to cyberchef_bake
Providing the appropriate input data

Important: Some operations may behave differently or be unavailable in the Node.js API compared to the web version.

Bundling Popular Recipes as Presets

Common recipes can be integrated as MCP server enhancements:

Option 1: Server-Side Recipe Library

Create a recipe library in src/node/recipes/:

src/node/recipes/
  malware/
    powershell-deobfuscation.json
    php-webshell-decode.json
    cobalt-strike-beacon.json
  forensics/
    mft-timestamp-parser.json
    squid-cache-extractor.json
  encoding/
    multi-base64-decode.json
    charcode-extract.json

Option 2: MCP Tool for Recipe Discovery

Implement a cyberchef_recipe_list tool:

{
  "name": "cyberchef_recipe_list",
  "description": "List available pre-built CyberChef recipes",
  "inputSchema": {
    "type": "object",
    "properties": {
      "category": {
        "type": "string",
        "enum": ["malware", "forensics", "encoding", "all"],
        "description": "Recipe category to list"
      }
    }
  }
}

Option 3: Recipe Templates

Create parameterized recipe templates:

{
  "name": "cyberchef_decode_powershell",
  "description": "Decode obfuscated PowerShell using common patterns",
  "inputSchema": {
    "type": "object",
    "properties": {
      "input": {"type": "string"},
      "encoding_type": {
        "type": "string",
        "enum": ["charcode", "base64", "invoke-obfuscation"]
      }
    }
  }
}

Testing Operations Against Recipe Patterns

Use cyberchef-recipes to validate MCP server operation compatibility:

Extract Common Operations: Parse all recipes to identify most-used operations
Create Test Suite: Build tests using actual recipe chains
Validate Behavior: Ensure Node.js API matches web app behavior
Document Discrepancies: Note operations that differ or are unsupported

Example test structure:

// tests/recipes/community-recipes.test.mjs
describe('CyberChef Community Recipes', () => {
  describe('Recipe 1: Extract base64, raw inflate & beautify', () => {
    it('should decode and inflate obfuscated script', async () => {
      const recipe = [
        {"op": "Regular expression", "args": [...]},
        {"op": "From Base64", "args": [...]},
        {"op": "Raw Inflate", "args": [...]},
        {"op": "Generic Code Beautify", "args": []}
      ];
      const result = await bake(testInput, recipe);
      expect(result).toContain('expected output');
    });
  });
});

Use Cases

Malware Analysis Workflows

1. PowerShell Deobfuscation Chain

Scenario: Analyze obfuscated PowerShell dropper

Recipe Sequence:

Extract CharCodes → cyberchef_from_charcode
Decode Base64 → cyberchef_from_base64
Decompress → cyberchef_raw_inflate
Extract URLs → cyberchef_extract_urls
Defang URLs → cyberchef_defang_url

MCP Implementation:

{
  "name": "cyberchef_bake",
  "arguments": {
    "input": "malicious_script.ps1",
    "recipe": [
      {"op": "Regular expression", "args": ["User defined", "([0-9]{2,3}(,\\s|))+", ...]},
      {"op": "From Charcode", "args": ["Comma", 10]},
      {"op": "From Base64", "args": ["A-Za-z0-9+/=", true]},
      {"op": "Extract URLs", "args": [false]},
      {"op": "Defang URL", "args": [true, true, true, "Valid domains and full URLs"]}
    ]
  }
}

2. PHP Webshell Analysis

Scenario: Multi-stage PHP webshell with gzinflate + Base64

Recipe Pattern:

Input → Extract Base64 → Decode → gzinflate → Extract Base64 → Decode → Beautify

Benefits:

Reveals hidden backdoor functionality
Extracts C2 server addresses
Identifies encoded payloads

CTF Challenge Solutions

1. Stacked Encoding

Challenge: Flag encoded with multiple layers (Base64 x5 + URL encoding + Hex)

Recipe: Loop-based decoder

[
  {"op": "Label", "args": ["decode_loop"]},
  {"op": "From Base64", "args": [...]},
  {"op": "Jump", "args": ["decode_loop", 4]},
  {"op": "URL Decode", "args": []},
  {"op": "From Hex", "args": ["Auto"]}
]

2. Cipher Substitution

Challenge: Custom character substitution cipher

Recipe:

[
  {"op": "Find / Replace", "args": [{"option": "Regex", "string": "pattern"}, "replacement", ...]},
  {"op": "ROT13", "args": [true, true, false, 13]},
  {"op": "Reverse", "args": ["Character"]}
]

Forensic Investigation Patterns

1. PCAP Analysis

Workflow:

Extract network streams
Identify JA3 fingerprints
Lookup threat intelligence
Extract IOCs

Recipe: PCAP → JA3 Extraction → API Lookup

2. Timeline Analysis

Workflow:

Parse MFT timestamps
Convert Squid proxy logs
Normalize to UTC
Generate timeline CSV

Recipe: Log Parser → Timestamp Converter → Format CSV

3. Registry Artifact Extraction

Workflow:

Extract registry hive
Decode obfuscated binary data
Carve PE files
Generate hash values

Recipe: From Hex → Raw Inflate → Extract PE → SHA256

Data Transformation Templates

1. Batch Processing

Use Case: Convert 1000s of encoded strings

Pattern: Subsection-based batch processing

[
  {"op": "Subsection", "args": ["\\n", "\\n", true, true]},
  {"op": "From Base64", "args": [...]},
  {"op": "Merge", "args": []}
]

2. Format Standardization

Use Case: Normalize data for SIEM ingestion

Recipe: Extract → Transform → Format JSON

3. Automated Reporting

Use Case: Generate IOC reports from malware samples

Recipe: Extract URLs/IPs → Defang → Lookup Reputation → Format Markdown

Common Patterns and Techniques

Regular Expressions

The repository includes essential regex patterns for security work:

Encoded Data Extraction

Pattern	Purpose	Example Use
`[a-zA-Z0-9+/=]{30,}`	Extract Base64 (30+ chars)	Find encoded payloads
`[a-fA-F0-9]{10,}`	Extract hexadecimal	Find hex strings
`[a-fA-F0-9]{32}`	Extract MD5 hashes	Hash identification
`[a-fA-F0-9]{40}`	Extract SHA1 hashes	Hash identification
`[a-fA-F0-9]{64}`	Extract SHA256 hashes	Hash identification
`[\d]{2,3}(,\|')`	Extract character codes	CharCode obfuscation

Lookaheads and Lookbehinds

Pattern	Purpose	Example
`(?<=foo)(.*)`	Positive lookbehind	Extract everything after 'foo'
`^.*(?=bar)`	Positive lookahead	Extract everything before 'bar'
`(?<=')(.*?)(?=')`	Combo	Extract between single quotes

Multi-Stage Processing

Many malware samples use nested obfuscation:

Layer 1: CharCode
  ↓
Layer 2: Base64
  ↓
Layer 3: gzip compression
  ↓
Layer 4: More Base64
  ↓
Payload

Recipe Strategy:

Use subsections for each layer
Apply loops for repeated encoding
Use registers to store intermediate results
Merge outputs at each stage

API Integration

Recipe 22 and 56 demonstrate HTTP Request operations:

Pattern: Extract → Register → API Call → Parse Response

Example: JA3 hash lookup

[
  {"op": "JA3 Fingerprint", "args": []},
  {"op": "Register", "args": ["$R0", false]},
  {"op": "HTTP request", "args": ["GET", "https://ja3er.com/search/$R0", ...]},
  {"op": "JSON Beautify", "args": []}
]

Note: Same-Origin Policy (SOP) restrictions apply in web browsers. Consider running CyberChef locally or using the Node.js API for unrestricted HTTP access.

Implementation Recommendations

For CyberChef MCP Server

1. Recipe Library Integration

Priority: HIGH

Implementation:

Clone cyberchef-recipes as git submodule in ref-proj/
Parse README.md to extract recipes programmatically
Store recipes in src/node/recipes/ by category
Create recipe index with metadata (author, use case, complexity)

Benefits:

Provide ready-to-use recipes via MCP
Reduce friction for common tasks
Demonstrate MCP server capabilities

2. Recipe Validation Tests

Priority: MEDIUM

Implementation:

Select 20-30 most popular recipes
Create test cases using provided samples (where available)
Validate operation chain compatibility
Document unsupported operations or behavioral differences

File: tests/recipes/community-recipes.test.mjs

Coverage Target: 80% of common operation types

3. Recipe Discovery Tool

Priority: MEDIUM

Implementation:

Add new MCP tool:

{
  "name": "cyberchef_recipe_search",
  "description": "Search community recipes by keyword, category, or operation",
  "inputSchema": {
    "type": "object",
    "properties": {
      "query": {"type": "string", "description": "Search term"},
      "category": {"type": "string", "enum": ["malware", "forensics", "encoding", "crypto", "all"]},
      "operation": {"type": "string", "description": "Filter by operation name"}
    }
  }
}

Returns:

Recipe name and number
Description
Operation chain
Use case examples

4. Recipe Templates

Priority: LOW

Implementation:

Create parameterized versions of top 10 recipes
Add dedicated MCP tools (e.g., cyberchef_decode_powershell)
Pre-configure common argument values
Reduce complexity for common tasks

Testing Strategy

Phase 1: Operation Compatibility

Extract all unique operations from 70 recipes
Test each operation in Node.js API vs web app
Document differences in docs/reference/operation-compatibility.md

Phase 2: Recipe Validation

Select 5 recipes per category (25 total)
Create test input files (or use provided samples)
Run through MCP cyberchef_bake
Validate expected outputs
Add regression tests

Phase 3: Performance Benchmarking

Test recipes on varying input sizes (1KB, 1MB, 10MB)
Measure execution time
Identify bottlenecks
Optimize critical paths

Documentation Tasks

Create Recipe Catalog: docs/guides/community-recipes.md
- Categorized recipe index
- Links to original recipes
- MCP usage examples
Operation Reference: docs/reference/operations.md
- List all 300+ operations
- Node.js API compatibility status
- Usage examples from community recipes
Migration Guide: docs/guides/web-to-mcp.md
- Convert web recipes to MCP calls
- Handle unsupported operations
- Troubleshooting common issues

Resources

CyberChef Resources

Main Project: https://gchq.github.io/CyberChef/
GitHub: https://github.com/gchq/CyberChef
Wiki: https://github.com/gchq/CyberChef/wiki