Skip to content

Security analysis

Offline inspection and reporting workflows for tokens, indicators, scripts, hashes, and message authentication.

Security analysis

Beginner1 stepsDecode a JWTInspect a JSON Web Token header and payload without treating it as verified.Intermediate3 stepsDecode a deflated SAML responseDecode Base64, inflate the raw DEFLATE stream, and format the XML.Intermediate4 stepsDecode a PowerShell EncodedCommandExtract, decode, interpret, and format a PowerShell EncodedCommand without executing it.Intermediate2 stepsDecode Base64 and XORReverse a common two-layer obfuscation pattern with an explicit XOR key.Beginner2 stepsExtract and defang URLsPull unique URLs from prose and make them safer to copy into reports.Beginner2 stepsExtract and defang IP addressesCollect IPv4 and IPv6 indicators, deduplicate them, and neutralize the notation.Beginner1 stepsRestore a defanged URLTurn a report-safe indicator back into a syntactically valid URL for controlled analysis.Beginner1 stepsIdentify a hash formatList hash algorithms that match a digest's length and character set.Beginner1 stepsCalculate a SHA-256 digestCompute a deterministic SHA-256 integrity value for text or bytes.Intermediate1 stepsCalculate HMAC-SHA256Authenticate a message with a shared demonstration key and SHA-256.Advanced4 stepsExtract, inflate, and beautify embedded codeRecover a Base64-wrapped raw-DEFLATE code fragment from surrounding text and format it for review.Advanced5 stepsReverse, decode, and defang a hidden URLUndo character reversal and substitution, decode Base64, extract the URL, and neutralize it for reporting.Advanced7 stepsDecode a CharCode-to-Base64 script chainTurn decimal character codes into a wrapper, extract its Base64 payload, decode the script, and list its URL safely.Advanced7 stepsDecode a compressed blob and report its URLDecode Base64, decompress Gzip, extract printable strings, isolate URLs, defang them, and remove duplicates.
Navigation

Type to search…

↑↓ navigate↵ selectEsc close