Forge Chef (CyberChef)

v10.19.4GCHQ / CyberChef community

The cyber Swiss army knife. Build a recipe from encoding, cipher, hashing, parsing, extraction and analysis operations, drop data in one end and read the result out of the other — Base64, Base32, hex, hexdump, URL and HTML encoding, UTF-16LE, XOR (including single-byte brute force), RC4, ROT13/47, Atbash, Vigenère, MD5/SHA-1/SHA-256/SHA-512/HMAC/CRC-32, JWT decode, JSON/XML/CSV handling, IOC extraction and defanging, PowerShell -EncodedCommand unwrapping, entropy and file-type detection. The Magic tab suggests recipes for an unknown blob. Digests are real implementations, so a hash computed here matches the one in a vendor report.

Category: Data decoding, cryptanalysis & analysis
Package: cyberchef
Runs on: Linux · Windows
Commands: cyberchef, chefctl, forge-chef
Console: http://chef.range.local:8000

Every operation is a pure function over the data you paste or open from the simulated disk. There is no upload, no lookup service and no script execution — the recipe can only transform bytes already in the tab.

Install it

The scripts below install the real GCHQ / CyberChef community package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-cyberchef.sh

Windows installer (PowerShell)

Install-cyberchef.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install Forge Chef (CyberChef)
```
sudo apt install -y cyberchef
```

RHEL, Fedora (dnf)

Install Forge Chef (CyberChef)
```
sudo dnf install -y cyberchef
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install Forge Chef (CyberChef)
```
sudo pacman -S --noconfirm cyberchef
```

Alpine (apk)

Install Forge Chef (CyberChef)
```
sudo apk add cyberchef
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which cyberchef
```
Check the version
```
cyberchef --version
```
The range reports 10.19.4.

Remove it

Take it off again
```
sudo apt remove --purge cyberchef
```

On Windows

Windows Package Manager (winget)

Search the catalog
```
winget search cyberchef
```
Install Forge Chef (CyberChef)
```
winget install --id cyberchef -e
```
Package names drift between distributions; search first if this one misses.

Chocolatey (choco)

Install Forge Chef (CyberChef)
```
choco install cyberchef -y
```
Run the shell as administrator.

Check it worked

Confirm it resolves
```
where cyberchef
```
Check the version
```
cyberchef --version
```
The range reports 10.19.4.

Remove it

Take it off again
```
winget uninstall --id cyberchef
```

Inside the range

Tick it on the launch screen
Under Forge Chef (CyberChef)'s category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y cyberchef
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Forge Chef (CyberChef)

Campaign: From One Attachment to Data Out the DoorA finance user opens an invoice attachment on the analyst host. Follow the chain from the click through credential theft to the first byte of exfiltration.
Campaign: The Macro That Ended in RansomwareA macro-enabled document on the analyst host disables defenses, destroys recovery points and encrypts the share on the file server.
Campaign: Living Off the Land Across the EstateNo malware family to hunt: signed Windows binaries move the intruder from the analyst host to a second asset and back out with the data.
Campaign: The Account That Was Never Stolen TwicePassword spraying lands one identity, and the intruder makes it permanent — MFA re-enrolled, a forwarding rule set, the repository drained.
Campaign: Kerberoast to Domain DominanceFrom a foothold on the analyst host to replicating the directory from the domain controller — the identity plane campaign for senior analysts.
Campaign: Edge Application to Crown JewelsAn internet-facing app in a DMZ segment is exploited, a web shell lands, and the intruder walks the Linux estate to the database.
Campaign: The Update That Shipped an ImplantA trusted build artifact carries an implant into the Linux fleet: obfuscated payload, shell profile persistence, and DNS as the channel.
Campaign: Out of the Container, Into the NodeA workload deployed into the cluster reads its own service-account token, escapes to the node and mines on a second asset.
Campaign: A Quiet Hour in the Cloud ConsoleNo malware at all — an over-permissioned cloud identity enumerates, adds its own key, and copies a bucket into an account you do not own.
Campaign: Somebody Is Mapping UsDetection from the network only: scanning across the local subnet, a sniffing host, and a tunnel out through the edge firewall.
Campaign: The Leaver Who Took the KeysAn employee under notice builds themselves a way back in, empties the browser vault, and deletes what they cannot take.
Campaign: The Assistant That Was Told to Help the AttackerA SOC copilot is prompt-injected through ticket content, and its tooling is used to inject into a process and open a support tunnel.
Campaign: The Printer Nobody OwnedA multifunction printer on the IoT VLAN answers to its factory password. Follow the chain from an SNMP sweep through the stored scan-to-folder credential to documents leaving over a print port.
Campaign: The Cameras Started Talking BackA building camera exposed to the internet is taken over, made resident in firmware, and used to scan the corporate segment before the fleet is turned on an outside target.
Campaign: A Vendor Login into the Production CellA maintenance vendor's remote access is reused to reach the operator HMI, change a controller setpoint and stop a safety service. Reconstruct the path from IT into the plant cell.
Reps: Unwrap the PayloadFive obfuscated artifacts from one intrusion: a Base64 callback host, a UTF-16LE PowerShell -EncodedCommand, a hex-encoded marker, a single-byte XOR account name and a ROT13 note. Build the recipe in Forge Chef and report the plaintext.
Campaign: Decrypt the ChainA hijacked invoice thread turns into a loader, a beacon and an exfil note — and every stage hides its key field behind a different wrapper. Unwrap six artifacts in Forge Chef (Base64, -EncodedCommand, RC4, hex, XOR, ROT13) and report what the chain was actually doing.
Campaign: Decrypt the Meridian Freight ChainThe appliance exploit, the scheduled task on the file server and the exfil manifest — one artifact per stage of the Meridian Freight breach. Peel each in Forge Chef and report what you find.
Campaign: Decrypt the Northwind Health ChainPhish, loader, beacon, ransomware, leak site — the Northwind Health double extortion in four artifacts. Unwrap each in Forge Chef and report the C2, the mutex and the leak-site contact.
Campaign: Decrypt the Halcyon Bio ChainThe hidden kernel module, the leaver's bastion transcript and the sudoers grant behind them — the Halcyon Bio insider chain in three artifacts. Unwrap each in Forge Chef and report what left, and how.
Campaign: Decrypt the PayLumen Supplier ChainThe provider status page, the SFTP transfer log they will not send you, and the leak sample — the payroll-supplier breach in three artifacts. Peel each in Forge Chef and report what your data actually included.
Campaign: Decrypt the Halyard Pay ChainThe query the intruder ran, the RMM tool they launched and the service they left behind — the Halyard Pay disclosure chain in three artifacts. Peel each in Forge Chef and settle the materiality question with evidence.
Reps: Triage the DropperFive files, one intrusion. Hash and type each artifact, carve its strings, run the YARA starter pack, and write a rule that catches the packed dropper without flagging the two known-good controls.
Reps: Sudo, ActuallyYou have an ordinary shell on a metrics server. A root-run systemd unit executes a script your group can write, and you may restart that unit without a password. Turn two harmless permissions into root, then remove the misconfiguration.
Reps: Range Targets — swing at the piñataA per-run virtual estate of intentionally-weak boxes. Use nmap, curl, sqlmap, nikto and hydra against the range's own hosts; the target names, credentials, tables and flags change every run, so the walkthrough has to be earned, not memorised.
Reps: Range Targets — swing at the piñata (Windows)The Range Targets estate, worked from a Windows analyst box. Same per-run virtual targets, driven with PowerShell, nmap, sqlmap, nikto and hydra from a Windows console — the names, credentials, tables and flags still change every run.
Hunt: Write the Phishing Chain SearchA finance user opened an attachment. Write the searches that follow the document from mail delivery to the first downloaded payload, then report what they returned.
Hunt: Write the Ransomware End-Game SearchBackups went first, then the services, then the files. Write the searches that reconstruct the last hour, then report what they returned.
Haunted: All Hallows' PayrollThe midnight payroll run on 31 October paid four employees who left the company in 2019, and the finance share came back the next morning renamed and unreadable. Reconstruct the run, find the scheduled task that resurrected the leavers, and recover the share from the snapshot that survived.
Pentest: Authorized Phishing SimulationClone the customer's SSO portal, send a hundred lures against a pre-agreed roster, watch clicks and credentials land in the C2, and file a template-plus-training finding without ever holding a real password.