Analysis

4 tools that are not CyberChef operations. An operation is a pure run(input, args) over one input, which cannot express an analysis – scoring forty candidate key lengths, or composing several operations and comparing the results. cyberchef_bake does not help, because a recipe is a linear pipeline, not a loop.

These are exposed at every tool surface, including the default index, because they are few and each one replaces a separate command-line tool.

Cyclic pattern

Generate a De Bruijn (cyclic) pattern, or find the offset of a fragment within one. Compatible with pwntools’ cyclic/cyclic_find, so patterns and offsets are interchangeable with it. Use mode=find with the bytes recovered from a crashed register to get the overflow offset; hex input is interpreted as both big- and little-endian, because a register dump is usually reversed relative to memory.

• Tool name: cyberchef_cyclic_pattern
• Category: Analysis

Argument	Type	Default	Description
mode	enum	required	Generate a pattern, or find an offset in one.
length	number	1024	generate: how many bytes to produce. find: how long the pattern was.
fragment	string	—	find: the bytes recovered, as text or hex (e.g. “aabc” or 0x63626161).
fragment_format	enum	"Auto"	find: how to read fragment. Auto tries hex first, then text.
subsequence_length	number	4	Bytes of uniqueness: 4 for 32-bit, 8 for 64-bit. Must match the pattern.
alphabet	string	"abcdefghijklmnopqrstuvwxyz"	Symbols to build from. The default matches pwntools.

Identify hash

Identify a password hash by its structure — bcrypt, sha512crypt, argon2, PHPass, Django, LDAP, MySQL, NetNTLM and others — and report the hashcat mode and John format name for each match. Falls back to length-based candidates for a bare digest. Use this before trying to crack something: CyberChef’s Analyse hash operation reads hex length only and reports “Invalid hash” for bcrypt, sha512crypt and argon2.

• Tool name: cyberchef_hash_identify
• Category: Analysis

Argument	Type	Default	Description
input	string	required	The hash, one per call. Whitespace is trimmed.

RSA key attack

Test an RSA public key for the generation flaws that make it breakable, and recover the private key when one applies: Fermat (primes too close), shared factors between two moduli, Wiener (private exponent too small) and unpadded small-e. None of these threatens a correctly generated key — a sound 2048-bit modulus defeats all four — so a negative result is evidence the key is not weak in these specific ways. Decrypts a supplied ciphertext when the key is recovered.

• Tool name: cyberchef_rsa_attack
• Category: Analysis

Argument	Type	Default	Description
modulus	string	required	The modulus n, as decimal or hex.
public_exponent	string	"65537"	The public exponent e.
ciphertext	string	—	Optional. Decrypted if the private key is recovered.
other_modulus	string	—	A second modulus, to test for a shared prime factor. Breaks both keys if one exists.
attacks	array	—	Which attacks to try. All of them by default.
fermat_iterations	number	100000	Bound on the Fermat search. Higher finds primes that are further apart, and takes longer.

XOR key length

Recover the key length of a repeating-key XOR by index of coincidence, then guess the key and decrypt. Ranks candidate lengths with a score for each, so you can see whether the answer is clear or marginal. Use this when you have XOR-encrypted data and no key; use cyberchef_bake with the XOR operation when you already know the key. Recovers the length in 84 of 90 measured cases across prose, source code and log lines; it is least reliable on short inputs and on plaintext with its own strong period, such as fixed-width log lines.

• Tool name: cyberchef_xor_key_length
• Category: Analysis

Argument	Type	Default	Description
input	string	required	The ciphertext. At most 1 MB.
input_format	enum	"Raw"	How input is encoded. Raw treats it as latin1 bytes.
max_key_length	number	32	Longest key length to consider.
candidates	number	5	How many ranked candidates to report.
preview_bytes	number	256	How much decrypted output to return. 0 for none.