All CySA+ v4 labs

Lab 7 of 17 · By Michael Stout

In this lab

Read the steps, then try them in your lab environment.

CYSA+ CS0-004 · DOMAIN I SECURITY OPERATIONS CyberCorps.uk · LAB 7
LAB 7 · DECODING AND PARSING DATA

Decode and defang artifacts with CyberChef

Chapter 3 lists decoding and parsing data and files as a core technique for determining malicious activity. GCHQ's CyberChef — nicknamed “the Cyber Swiss Army Knife” — chains dozens of those operations together in a browser tab, entirely offline once downloaded.

WHY THIS LAB

One tool, chained operations

A phishing payload or a malware config is rarely encoded once. It's often Base64, then gzipped, then hex — and unwinding that by hand in a scripting console is slow and error-prone. CyberChef lets you drag operations into a chain and watch the output update live, so you can see exactly which layer you're peeling off.

RUNS ENTIRELY OFFLINE

Because CyberChef is a single self-contained web page, you can download it once and run it with no internet connection — useful on an isolated analysis machine, and safer for handling anything actually sensitive.

BEFORE YOU START

What you'll need

SOFTWARE

Any modern browser. No account, install, or server — it's one HTML file.

MATERIALS

Nothing sensitive. Use the practice strings in this lab, not real IOCs from a live incident.

TIME

15–20 minutes.

CyberCorps.uk · Lab 7 Page 1 of 2
GET IT OFFLINE · BUILD RECIPES · SOURCES CyberCorps.uk · LAB 7
PART 1 · GET AN OFFLINE COPY

Download, don't just bookmark

  1. Try it online first. Open gchq.github.io/CyberChef to see the live version and confirm it's what you expect before downloading anything.
  2. Get the offline build. Go to github.com/gchq/CyberChef/releases, open the latest release, and download the packaged zip from its Assets — not the “Source code” zip, which needs a build step.
  3. Run it locally. Extract the zip and open index.html in your browser. Everything runs client-side — nothing you paste in ever leaves your machine.
PART 2 · BUILD A RECIPE

Chain operations, don't run them one at a time

  1. Decode a nested string. Paste VGhpcyBpcyBhIHRlc3Qgc3RyaW5nLg== into the input. Drag From Base64 from the operations list into the Recipe panel. The output updates instantly — that's the whole loop.
  2. Chain a second step. Search for To Hex and drag it below From Base64 in the recipe. Now you're seeing the same text re-encoded — this is how you'd unwind something layered twice.
  3. Defang an IOC for a report. New input: hxxp://185.220.101.5/payload.exe is how analysts usually write a URL so it can't be clicked by accident. Try the Defang URL and Defang IP Addresses operations on a live one to see them do it automatically.
  4. Let it guess. Paste in an unfamiliar-looking string and drag in the Magic operation — it tries common decodings automatically and suggests what your input might be.
PRACTICE DATA ONLY, IN THIS LAB

Once you're comfortable, treat real indicators from an active investigation the way your organization's data handling policy requires — the offline build helps, but it doesn't replace that policy.

Sources. GCHQ, CyberChef, gchq.github.io/CyberChef, releases at github.com/gchq/CyberChef/releases.

CyberCorps.uk · Lab 7 Page 2 of 2

Connect this lab to your learning