Regex

13 operations. Call any of them with cyberchef_bake, or pre-load them with CYBERCHEF_TOOL_SURFACE=all.

Extract dates

Extracts dates in the following formatsyyyy-mm-dddd/mm/yyyymm/dd/yyyyDividers can be any of /, -, . or space

• Tool name: cyberchef_extract_dates
• Input / output: string → string

Argument	Type	Default
display_total	boolean	false

Extract domains

Extracts fully qualified domain names.Note that this will not include paths. Use Extract URLs to find entire URLs.

• Tool name: cyberchef_extract_domains
• Input / output: string → string

Argument	Type	Default
display_total	boolean	false
sort	boolean	false
unique	boolean	false
underscore_dmarc_dkim_etc	boolean	false

Extract email addresses

Extracts all email addresses from the input.

• Tool name: cyberchef_extract_email_addresses
• Input / output: string → string

Argument	Type	Default
display_total	boolean	false
sort	boolean	false
unique	boolean	false

Extract file paths

Extracts anything that looks like a Windows or UNIX file path.Note that if UNIX is selected, there will likely be a lot of false positives.

• Tool name: cyberchef_extract_file_paths
• Input / output: string → string

Argument	Type	Default
windows	boolean	true
unix	boolean	true
display_total	boolean	false
sort	boolean	false
unique	boolean	false

Extract hashes

Extracts potential hashes based on hash character length

• Tool name: cyberchef_extract_hashes
• Input / output: string → string

Argument	Type	Default
hash_character_length	number	40
all_hashes	boolean	false
display_total	boolean	false

Extract IP addresses

Extracts all IPv4 and IPv6 addresses.Warning: Given a string 1.2.3.4.5.6.7.8, this will match 1.2.3.4 and 5.6.7.8 so always check the original input!

• Tool name: cyberchef_extract_ip_addresses
• Input / output: string → string

Argument	Type	Default
ipv4	boolean	true
ipv6	boolean	false
remove_local_ipv4_addresses	boolean	false
display_total	boolean	false
sort	boolean	false
unique	boolean	false

Extract MAC addresses

Extracts all Media Access Control (MAC) addresses from the input.

• Tool name: cyberchef_extract_mac_addresses
• Input / output: string → string

Argument	Type	Default
display_total	boolean	false
sort	boolean	false
unique	boolean	false

Extract URLs

Extracts Uniform Resource Locators (URLs) from the input. The protocol (http, ftp etc.) is required otherwise there will be far too many false positives.

• Tool name: cyberchef_extract_urls
• Input / output: string → string

Argument	Type	Default
display_total	boolean	false
sort	boolean	false
unique	boolean	false

Filter

Splits up the input using the specified delimiter and then filters each branch based on a regular expression.

• Tool name: cyberchef_filter
• Input / output: string → string

Argument	Type	Default
delimiter	option	Line feed
regex	string	—
invert_condition	boolean	false

Find / Replace

Replaces all occurrences of the first string with the second.Includes support for regular expressions (regex), simple strings and extended strings (which support \n, \r, \t, \b, \f and escaped hex bytes using \x notation, e.g. \x00 for a null byte).

• Tool name: cyberchef_find_replace
• Input / output: string → string

Argument	Type	Default
find	toggleString	{"option":"Regex","string":""}
replace	binaryString	—
global_match	boolean	true
case_insensitive	boolean	false
multiline_matching	boolean	true
dot_matches_all	boolean	false

Register

Extract data from the input and store it in registers which can then be passed into subsequent operations as arguments. Regular expression capture groups are used to select the data to extract.To use registers in arguments, refer to them using the notation $Rn where n is the register number, starting at 0.For example:Input: TestExtractor: (.*)Argument: $R0 becomes TestRegisters can be escaped in arguments using a backslash. e.g. $R0 would become $R0 rather than Test.

• Tool name: cyberchef_register
• Input / output: string → string
• Flow control: yes

Argument	Type	Default
extractor	binaryString	([\s\S]*)
case_insensitive	boolean	true
multiline_matching	boolean	false
dot_matches_all	boolean	false

Regular expression

Define your own regular expression (regex) to search the input data with, optionally choosing from a list of pre-defined patterns.Supports extended regex syntax including the ‘dot matches all’ flag, named capture groups, full unicode coverage (including \p{} categories and scripts as well as astral codes) and recursive matching.

• Tool name: cyberchef_regular_expression
• Input / output: string → html

Argument	Type	Default
built_in_regexes	populateOption	—
regex	text	—
case_insensitive	boolean	true
and_match_at_newlines	boolean	true
dot_matches_all	boolean	false
unicode_support	boolean	false
astral_support	boolean	false
display_total	boolean	false
output_format	option	Highlight matches

Strings

Extracts all strings from the input.

• Tool name: cyberchef_strings
• Input / output: string → string

Argument	Type	Default
encoding	option	Single byte
minimum_length	number	4
match	option	[ASCII]
display_total	boolean	false
sort	boolean	false
unique	boolean	false