What it can do
- Extract numeric character data
- Recover a wrapper script
- Decode its inner Base64 payload
- Extract and defang an endpoint
How the recipe works
Regular expression
Select the comma-separated decimal sequence.
From Charcode
Convert character codes to the wrapper text.
Regular expression
Extract the wrapper's long Base64 value.
From Base64
Decode the inner script.
Generic Code Beautify
Format code boundaries for review.
Extract URLs
List the embedded URL.
Defang URL
Defang the result for a report.
Demonstration
Sample input
118,97,114,32,98,108,111,98,61,39,100,109,70,121,73,71,86,117,90,72,66,118,97,87,53,48,80,83,74,111,100,72,82,119,99,122,111,118,76,50,70,119,97,83,53,108,101,71,70,116,99,71,120,108,76,110,82,108,99,51,81,118,100,106,69,105,79,119,61,61,39,59Expected result
hxxps[://]api[.]example[.]test/v1When to use it
- Multi-layer decoding exercises
- Script triage
- Explaining evidence-driven operation selection
Adapt it
Change the numeric delimiter or radix before changing later stages; validate every boundary before proceeding.
Source and verification
Adapted from kraven-security CyberChef recipes. The explanation and sample are written for Serialize, use synthetic or documentation-safe data, and are checked against the current operation catalogue. The workflow runs locally without an external API call.