CyberChef 11.2.0

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick CyberChef 11.2.0 on Ubuntu 24.04 as the software version, choose your Region, then choose Launch through EC2.

Choose m5.large, your key pair and a security group as described above. The server itself needs very little, because the work happens in your users' browsers.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=cyberchef}]'

Version SSH user

CyberChef 11.2.0 on Ubuntu 24.04 ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot generates the certificate and the password, then starts nginx. Check the first-boot and nginx units:

systemctl is-active nginx cyberchef-firstboot
sudo test -f /var/lib/sac/data/cyberchef-firstboot.done && echo FIRSTBOOT_DONE

Both units are active, and the first-boot marker is present:

active active FIRSTBOOT_DONE

Only SSH and nginx listen on the network. The local DNS resolver listens on loopback only:

sudo ss -lntp | awk 'NR>1 {print $4, $6}' | sed -E 's/pid=[0-9]+,fd=[0-9]+/.../g' | sort

0.0.0.0:22 users:(("sshd",...),("systemd",...)) 0.0.0.0:443 users:(("nginx",...),("nginx",...),("nginx",...)) 0.0.0.0:80 users:(("nginx",...),("nginx",...),("nginx",...)) 127.0.0.53%lo:53 users:(("systemd-resolve",...)) 127.0.0.54:53 users:(("systemd-resolve",...)) [::]:22 users:(("sshd",...),("systemd",...)) [::]:443 users:(("nginx",...),("nginx",...),("nginx",...)) [::]:80 users:(("nginx",...),("nginx",...),("nginx",...))

sudo cat /root/cyberchef-credentials.txt

The credentials file is readable by root only. It holds the URL, the user name and this instance's password:

CYBERCHEF_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ CYBERCHEF_USERNAME=admin CYBERCHEF_PASSWORD=<CYBERCHEF_PASSWORD>

The URL uses the instance's public DNS name from EC2 instance metadata. The certificate also names the public and private IP addresses, so https://<public-ip>/ works too. To serve CyberChef under your own DNS name, see Step 8.

Open the CYBERCHEF_URL in your browser. The certificate is self-signed, so your browser asks you to confirm it the first time. You can also install your own certificate (Step 8).

Sign in as admin with the password from Step 4. The browser remembers the login for the session.

CyberChef has four areas. The Operations list on the left is searchable, and you can open a category such as Encryption / Encoding, Public Key, Networking or Data format. You build the Recipe by dragging operations into it. The Input and Output panes hold your data and the result.

With Auto Bake ticked, the output updates as you type. In this example, From Base64 decodes a Base64 string.

Extract and defang indicators. Paste a suspicious email or log excerpt, then chain Extract URLs and Defang URL. CyberChef pulls out every link and rewrites it (hxxps[://]...[.]com), so you can paste it into a ticket or a chat without it becoming clickable. Extract IP addresses, Extract domains and Extract email addresses work the same way.

Hashes and checksums. Add SHA2 (size 256) and type into the Input pane. The digest is computed in your browser. Here the SHA-256 of hello is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, as expected. MD5, SHA1, SHA3, BLAKE2, CRC, HMAC and many others are in the Hashing category.

Encryption. AES Encrypt and AES Decrypt take a key and IV in hex, UTF-8, Latin1 or Base64, and support CBC, CTR, GCM, ECB and other modes. DES, Triple DES, Blowfish, RC4 and ChaCha are next to them.

Save and share recipes. Use the save icon above the recipe to store a recipe in your browser. You can also copy the page address. CyberChef keeps the recipe and input in the URL, so you can bookmark a recipe or share it with a colleague. They sign in with the same password, or with their own (Step 9).

Run these checks to confirm the security posture. Without a login, CyberChef is refused. Port 80 redirects to HTTPS, and the health check stays open for load balancers. A request for a host name the instance does not serve is dropped without an answer:

H=$(sudo grep '^CYBERCHEF_URL=' /root/cyberchef-credentials.txt | sed -E 's#^CYBERCHEF_URL=https://([^/]+)/.*#\1#')
curl -s -o /dev/null -w 'http:// -> %{http_code} %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/"
curl -sk -o /dev/null -w 'no login -> HTTP %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/"
curl -sk -o /dev/null -w 'health -> HTTP %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/healthz"
curl -sk -o /dev/null -w 'unknown host -> %{http_code}\n' --resolve "evil.example:443:127.0.0.1" "https://evil.example/" || true

http:// -> 301 https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ no login -> HTTP 401 health -> HTTP 200 unknown host -> 000

000 means nginx closed the connection without answering, which is how it treats any host name it does not serve.

With the password, CyberChef is served together with its Content Security Policy. The password is passed to curl on standard input, so it never appears in the process list or your shell history:

sudo bash -c ' F=/root/cyberchef-credentials.txt P=$(grep "^CYBERCHEF_PASSWORD=" $F | cut -d= -f2-) H=$(grep "^CYBERCHEF_URL=" $F | sed -E "s#^CYBERCHEF_URL=https://([^/]+)/.*#\1#") auth() { printf "user = \"admin:%s\"\n" "$P"; } auth | curl -K - -sk --resolve "$H:443:127.0.0.1" -o /dev/null -w "with login -> HTTP %{http_code}\n" "https://$H/" auth | curl -K - -sk --compressed --resolve "$H:443:127.0.0.1" "https://$H/" | grep -o "<title>[^<]*</title>" auth | curl -K - -sk --resolve "$H:443:127.0.0.1" -o /dev/null -D - "https://$H/" | tr -d "\r" | grep -i "^content-security-policy:" | tr ";" "\n" | sed "s/^ *//" | grep -E "^(content-security-policy: default-src|script-src|connect-src|object-src|frame-ancestors)" | sed -E "s/sha256-[A-Za-z0-9+\/=]+/sha256-.../g" '

with login -> HTTP 200 <title>CyberChef</title> content-security-policy: default-src 'self' script-src 'self' 'sha256-...' 'sha256-...' 'unsafe-eval' 'wasm-unsafe-eval' connect-src 'self' data: blob: object-src 'none' frame-ancestors 'none'

script-src allows only scripts from your instance and the two inline scripts of the CyberChef page (by their SHA-256 hashes). 'unsafe-eval' and 'wasm-unsafe-eval' are needed by operations such as Bzip2, Argon2 and OCR, whose libraries generate code or run WebAssembly in the browser.

connect-src 'self' stops the page from sending anything to another site. This also means the HTTP request operation can only reach your own instance.

CyberChef shows a small animation while a long operation runs. The policy disables plugins, so that animation is not shown. Nothing else changes.

nginx keeps only a SHA-512 crypt hash of the password. The plain text is in the root-only credentials file:

sudo sed -E 's/^(admin:\$6\$).*/\1<sha512-crypt-hash>/' /etc/nginx/.cyberchef-htpasswd
sudo stat -c '%a %U:%G %n' /etc/nginx/.cyberchef-htpasswd /root/cyberchef-credentials.txt

admin:$6$<sha512-crypt-hash> 640 root:www-data /etc/nginx/.cyberchef-htpasswd 600 root:root /root/cyberchef-credentials.txt

The certificate is generated on your instance and names its own addresses:

H=$(sudo grep '^CYBERCHEF_URL=' /root/cyberchef-credentials.txt | sed -E 's#^CYBERCHEF_URL=https://([^/]+)/.*#\1#')
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

nginx cannot reach the instance metadata service. It will not start until first boot has finished and a per-instance password is in place:

systemctl show nginx -p IPAddressDeny | grep 169.254.169.254
systemctl cat nginx | grep -E '^ExecStartPre=/usr/(bin/test|local/sbin)'

IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 ExecStartPre=/usr/bin/test -f /var/lib/sac/data/cyberchef-firstboot.done ExecStartPre=/usr/local/sbin/cyberchef-auth-guard

nginx also refuses a request whose Origin is another website (HTTP 403), because browsers resend Basic Auth credentials on cross-site requests:

H=$(sudo grep '^CYBERCHEF_URL=' /root/cyberchef-credentials.txt | sed -E 's#^CYBERCHEF_URL=https://([^/]+)/.*#\1#')
curl -sk --resolve "$H:443:127.0.0.1" -H 'Origin: https://evil.example' -d x=1 "https://$H/" | grep -o '403 Forbidden' | head -1

403 Forbidden

Point a DNS record at the instance, then set the name CyberChef is served as. The command creates a new self-signed certificate for the name, updates nginx and the URL in the credentials file, and keeps the name across reboots:

sudo cyberchef-set-hostname <your-domain>

To use a certificate from your own certificate authority instead, copy it over the generated pair and reload nginx. Running cyberchef-set-hostname again replaces it with a self-signed certificate:

sudo install -m 0644 <your-domain>.crt /etc/ssl/cyberchef/cyberchef.crt
sudo install -m 0600 <your-domain>.key /etc/ssl/cyberchef/cyberchef.key
sudo nginx -t && sudo systemctl reload nginx

Use cyberchef-set-password to manage the Basic Auth file. Run it with no arguments to generate a new random password for admin. The password is written to /root/cyberchef-credentials.txt.

To choose the password yourself, pass it on standard input. printf is a shell builtin, so the password never appears in the process list. Start the line with a space so most shells keep it out of your history:

printf '%s\n' '<new-password>' | sudo cyberchef-set-password --stdin

To give a colleague their own login, add --user <name>. Remove it again with --delete <name>. Passwords are 12 to 128 printable characters without spaces or :. nginx reads the file on every request, so no reload is needed:

printf '%s\n' '<new-password>' | sudo cyberchef-set-password --user alice --stdin sudo cyberchef-set-password --delete alice

Component Path

CyberChef static release /var/www/cyberchef

Licence and source note /usr/share/doc/cyberchef/

nginx site /etc/nginx/sites-available/sac-cyberchef

Content Security Policy /etc/nginx/cyberchef-csp.conf (created by cyberchef-csp)

Basic Auth file /etc/nginx/.cyberchef-htpasswd (SHA-512 crypt)

Certificate and key /etc/ssl/cyberchef/

First boot script /usr/local/sbin/cyberchef-firstboot.sh

Host name and password helpers /usr/local/sbin/cyberchef-set-hostname, /usr/local/sbin/cyberchef-set-password

Credentials /root/cyberchef-credentials.txt (mode 0600)

ls -1 /var/www/cyberchef du -sh /var/www/cyberchef
ls -l /usr/share/doc/cyberchef | awk 'NR>1{print $1,$5,$9}' nginx -v 2>&1

ChefWorker.js.LICENSE.txt CyberChef_v11.2.0.html DishWorker.js.LICENSE.txt InputWorker.js.LICENSE.txt LoaderWorker.js.LICENSE.txt ZipWorker.js.LICENSE.txt assets images index.html index.html.br index.html.gz modules 72M /var/www/cyberchef -rw-r--r-- 11357 LICENSE -rw-r--r-- 434 README.sac.txt nginx version: nginx/1.24.0 (Ubuntu)

CyberChef keeps no data on the server, so there is nothing to back up.

To move to a newer release, download the official release zip from the CyberChef releases page and check its checksum. Extract it into /var/www/cyberchef and copy its CyberChef_v<version>.html to index.html. Then regenerate the Content Security Policy, because the page's inline script hashes change with each release, and reload nginx:

sudo cyberchef-csp --write sudo nginx -t && sudo systemctl reload nginx

• Allow ports 22, 80 and 443 in the security group from your own networks only.
• Keep the per-instance password secret, rotate it if it may have been shared, and give each colleague their own login (Step 9).
• Use your own DNS name and a certificate your clients trust (Step 8).
• Keep the operating system patched. Unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else.