Google Cloud Setup Guide for CyberChef

To use Google Cloud capabilities (like Google Translate, Speech-to-Text, or Cloud Storage) within CyberChef, you need to configure a Google Cloud Project and obtain an authentication string. We strongly recommend using OAuth 2.0 (Web Application: PKCE) as it is the most secure method for browser-based applications like CyberChef.

By setting up a personal Cloud Project, your CyberChef instance communicates directly with your Google Cloud without a middleman.

Method 1: OAuth 2.0 (Web Application: PKCE) - Highly Recommended

This method uses your Google account and Google Identity Services to grant CyberChef temporary, secure access to your Google Cloud Project. Because CyberChef is a client-side architecture web app without a backend server, we use the Authorization Code Flow with Proof Key for Code Exchange (PKCE).

Step 1: Create a Project

Go to the Google Cloud Console.
Click on the project dropdown at the top and select New Project.
Name your project (e.g., cyberchef-personal) and click Create.

Step 2: Enable Required APIs

You must enable the APIs for any operation you intend to use.

In the Cloud Console search bar, type the name of the API and select it, then click Enable.
- For Google Translate: Enable "Cloud Translation API" (requires billing enabled).
- For Speech-to-Text: Enable "Cloud Speech-to-Text API".
- For Read/List Bucket: Enable "Cloud Storage JSON API" (usually enabled by default).

Navigate to APIs & Services > OAuth consent screen in the left sidebar.
Select External user type and click Create.
Fill in the required fields (App Name, User Support Email, Developer Contact Info). You can use your own email for all of these. Click Save and Continue.
Skip the Scopes section by clicking Save and Continue.
CRITICAL STEP: Configure Test Users.
- Navigate to APIs & Services > OAuth consent screen > Audience > Test Users > Add Users
- Type your own Google email address here (the one you use to login to the Cloud Console).
- (Since we will leave the app in "Testing" state forever, only users listed here can authenticate).
- WARNING: Do NOT click "Publish App". Leave the publishing status as "Testing". If you publish it, Google will require your app to undergo a verification process.

Step 4: Create OAuth Client ID

Navigate to APIs & Services > Credentials in the left sidebar.
Click + CREATE CREDENTIALS at the top and select OAuth client ID.
For Application type, select Web application.
Name it something like "CyberChef PKCE Client".
Under Authorized JavaScript origins, click ADD URI.
- For local testing, add: http://localhost:8080
- For production, add your deployed CyberChef URL (e.g., https://gchq.github.io).
Click Create.
A box will appear with your Client ID. Copy this string. (Note: You do not need the Client Secret).

Step 5: Authenticate in CyberChef

In CyberChef, add the Authenticate Google Cloud operation to the TOP of your recipe.
Set "Auth Type" to OAuth 2.0 (Web Application: PKCE).
Paste your Client ID into the "Credentials" box.
Click Bake. CyberChef will popup a secure Google Login window. Your session token is now securely stored in your browser's Session Storage for the duration of the tab being open.

Method 2: Temporary Personal Access Token (PAT)

If you have the Google Cloud SDK (gcloud) installed locally and you are authorized in your project, you can generate a short-lived token to use. This is secure because the token expires automatically.

Ensure you are logged into your gcloud CLI:
```
gcloud auth login
```
Generate an access token:
```
gcloud auth print-access-token
```
In CyberChef's Authenticate Google Cloud operation, set "Auth Type" to Personal Access Token (PAT) and paste the token output into the Credentials box.

Method 3: API Key (For Simple APIs only)

Warning: API Keys are not recommended for operations that access private data like Cloud Storage. They are best suited for simple APIs like Translation.

Create the API Key:
- Navigate to APIs & Services > Credentials in the left sidebar.
- Click + CREATE CREDENTIALS at the top and select API Key.
- Your API Key will be generated. Copy this key.
Secure the API Key (CRITICAL):
- Since CyberChef runs entirely in your browser, your API Key will be visible to anyone you share your CyberChef recipe with or who inspects the network traffic. you MUST restrict it.
- Click on the newly created API Key to edit its settings.
- Under Application restrictions, select Websites.
- Under Website restrictions, click ADD.
- Enter the URLs where your CyberChef instance is hosted (e.g., https://gchq.github.io/CyberChef/* or http://localhost:8080/* for local testing).
- Under API restrictions, select Restrict key and check the relevant API (e.g., Cloud Translation API).
- Click SAVE.
In CyberChef's Authenticate Google Cloud operation, set "Auth Type" to API Key and paste the key into the Credentials box.

5.3 KiB Raw Blame History