cyberchef/sample_recipe.md

Ready-To-Go Sample Recipe

tcpdump (no ASCII) Daily Use

1. tcpdump (no ASCII) convert to plaintext (e.g. 0x0000: 0020 0A0D)

2. URL decode loop (e.g. %3d to =)

3. From HTML Entity (e.g. & to &)

4. From 0x[Hex] (e.g. 0x33 to !)

5. From Char(Hex) (e.g. char(33) to !)

    [{"op":"From nTcpdump","args":[]},
    {"op":"URL Decode","args":[]},
    {"op":"Conditional Jump","args":["\\%([0-9a-fA-F]{2,})","-1","45"]},
    {"op":"From HTML Entity","args":[]},
    {"op":"From 0x[Hex]","args":[]},
    {"op":"From Char(Hex)","args":[]}]