cyberchef 11.1.0 → 11.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (148) hide show
  1. package/AGENTS.md +75 -0
  2. package/CHANGELOG.md +173 -2
  3. package/Dockerfile +2 -2
  4. package/Gruntfile.js +1 -0
  5. package/README.md +7 -6
  6. package/SECURITY.md +3 -1
  7. package/package.json +22 -21
  8. package/src/core/Chef.mjs +2 -0
  9. package/src/core/Dish.mjs +1 -5
  10. package/src/core/Ingredient.mjs +92 -0
  11. package/src/core/Operation.mjs +19 -0
  12. package/src/core/Recipe.mjs +4 -0
  13. package/src/core/Utils.mjs +48 -0
  14. package/src/core/config/Categories.json +22 -6
  15. package/src/core/config/OperationConfig.json +4774 -1228
  16. package/src/core/config/modules/Ciphers.mjs +20 -0
  17. package/src/core/config/modules/Crypto.mjs +10 -0
  18. package/src/core/config/modules/Default.mjs +8 -0
  19. package/src/core/config/modules/File.mjs +16 -0
  20. package/src/core/config/modules/OpModules.mjs +2 -0
  21. package/src/core/config/scripts/generateHTMLEntities.mjs +139 -0
  22. package/src/core/config/scripts/htmlEntityOverrides.mjs +86 -0
  23. package/src/core/dishTypes/DishType.mjs +1 -1
  24. package/src/core/errors/ExcludedOperationError.mjs +1 -1
  25. package/src/core/lib/Arithmetic.mjs +21 -5
  26. package/src/core/lib/BigIntUtils.mjs +0 -1
  27. package/src/core/lib/COBS.mjs +86 -0
  28. package/src/core/lib/Charts.mjs +3 -3
  29. package/src/core/lib/Decimal.mjs +5 -5
  30. package/src/core/lib/HTMLEntities.mjs +2068 -0
  31. package/src/core/lib/Present.mjs +422 -0
  32. package/src/core/lib/Protocol.mjs +8 -6
  33. package/src/core/lib/TEA.mjs +494 -0
  34. package/src/core/lib/TLVParser.mjs +16 -7
  35. package/src/core/lib/Twofish.mjs +608 -0
  36. package/src/core/operations/AsconDecrypt.mjs +112 -0
  37. package/src/core/operations/AsconEncrypt.mjs +108 -0
  38. package/src/core/operations/AsconHash.mjs +49 -0
  39. package/src/core/operations/AsconMAC.mjs +68 -0
  40. package/src/core/operations/AutomatedValidationTestOp.mjs +84 -0
  41. package/src/core/operations/AvroToJSON.mjs +1 -1
  42. package/src/core/operations/BLAKE3.mjs +5 -1
  43. package/src/core/operations/BcryptCompare.mjs +11 -5
  44. package/src/core/operations/BitShiftLeft.mjs +4 -1
  45. package/src/core/operations/Bzip2Compress.mjs +1 -1
  46. package/src/core/operations/DechunkHTTPResponse.mjs +4 -1
  47. package/src/core/operations/ExtendedGCD.mjs +101 -0
  48. package/src/core/operations/FromBase.mjs +2 -1
  49. package/src/core/operations/FromCOBS.mjs +38 -0
  50. package/src/core/operations/FromDecimal.mjs +6 -1
  51. package/src/core/operations/FromHTMLEntity.mjs +2 -1458
  52. package/src/core/operations/GenerateDeBruijnSequence.mjs +8 -0
  53. package/src/core/operations/GenerateHOTP.mjs +21 -6
  54. package/src/core/operations/GenerateImage.mjs +22 -10
  55. package/src/core/operations/GeneratePrime.mjs +154 -0
  56. package/src/core/operations/GenerateTOTP.mjs +24 -7
  57. package/src/core/operations/Gzip.mjs +1 -3
  58. package/src/core/operations/Jsonata.mjs +12 -0
  59. package/src/core/operations/MIMEDecoding.mjs +1 -1
  60. package/src/core/operations/MOD.mjs +62 -0
  61. package/src/core/operations/ModularInverse.mjs +107 -0
  62. package/src/core/operations/PRESENTDecrypt.mjs +94 -0
  63. package/src/core/operations/PRESENTEncrypt.mjs +94 -0
  64. package/src/core/operations/ParityBit.mjs +1 -1
  65. package/src/core/operations/ParseIPv4Header.mjs +1 -1
  66. package/src/core/operations/ParseURI.mjs +18 -5
  67. package/src/core/operations/PseudoRandomNumberGenerator.mjs +2 -1
  68. package/src/core/operations/RandomPrime.mjs +154 -0
  69. package/src/core/operations/RenderPDF.mjs +100 -0
  70. package/src/core/operations/SHA2.mjs +1 -1
  71. package/src/core/operations/SM4Encrypt.mjs +1 -1
  72. package/src/core/operations/SetDifference.mjs +8 -1
  73. package/src/core/operations/SetIntersection.mjs +8 -1
  74. package/src/core/operations/ShowOnMap.mjs +14 -2
  75. package/src/core/operations/TEADecrypt.mjs +98 -0
  76. package/src/core/operations/TEAEncrypt.mjs +98 -0
  77. package/src/core/operations/ToBase.mjs +4 -4
  78. package/src/core/operations/ToBase32.mjs +20 -4
  79. package/src/core/operations/ToBinary.mjs +4 -1
  80. package/src/core/operations/ToCOBS.mjs +38 -0
  81. package/src/core/operations/ToHTMLEntity.mjs +7 -1430
  82. package/src/core/operations/ToHexdump.mjs +7 -1
  83. package/src/core/operations/TwofishDecrypt.mjs +94 -0
  84. package/src/core/operations/TwofishEncrypt.mjs +94 -0
  85. package/src/core/operations/URLEncode.mjs +22 -18
  86. package/src/core/operations/UnescapeUnicodeCharacters.mjs +2 -1
  87. package/src/core/operations/ViewBitPlane.mjs +9 -3
  88. package/src/core/operations/Wrap.mjs +5 -0
  89. package/src/core/operations/XORBruteForce.mjs +4 -1
  90. package/src/core/operations/XORChecksum.mjs +10 -3
  91. package/src/core/operations/XTEADecrypt.mjs +110 -0
  92. package/src/core/operations/XTEAEncrypt.mjs +110 -0
  93. package/src/core/operations/index.mjs +42 -0
  94. package/src/core/vendor/ascon.mjs +162 -0
  95. package/src/core/vendor/htmlEntities/entity.json +2233 -0
  96. package/src/core/vendor/htmlEntities/entity.txt +14 -0
  97. package/src/node/api.mjs +4 -1
  98. package/src/node/index.mjs +105 -0
  99. package/src/web/HTMLOperation.mjs +2 -1
  100. package/src/web/stylesheets/layout/_io.css +8 -0
  101. package/tests/browser/00_nightwatch.js +26 -0
  102. package/tests/browser/02_ops.js +20 -4
  103. package/tests/node/index.mjs +2 -0
  104. package/tests/node/tests/Dish.mjs +19 -0
  105. package/tests/node/tests/NodeDish.mjs +36 -0
  106. package/tests/node/tests/ToHTMLEntity.mjs +82 -0
  107. package/tests/node/tests/Utils.mjs +77 -0
  108. package/tests/node/tests/lib/ChartsProtocolPrototypePollution.mjs +90 -0
  109. package/tests/node/tests/nodeApi.mjs +33 -1
  110. package/tests/node/tests/operations.mjs +26 -1
  111. package/tests/operations/index.mjs +17 -0
  112. package/tests/operations/tests/Arithmetic.mjs +33 -0
  113. package/tests/operations/tests/Ascon.mjs +501 -0
  114. package/tests/operations/tests/AutomatedValidation.mjs +154 -0
  115. package/tests/operations/tests/BLAKE3.mjs +39 -1
  116. package/tests/operations/tests/Base32.mjs +22 -0
  117. package/tests/operations/tests/COBS.mjs +476 -0
  118. package/tests/operations/tests/CharEnc.mjs +2 -2
  119. package/tests/operations/tests/DechunkHTTPResponse.mjs +66 -0
  120. package/tests/operations/tests/ExtendedGCD.mjs +78 -0
  121. package/tests/operations/tests/FromBase.mjs +66 -0
  122. package/tests/operations/tests/FromDecimal.mjs +55 -0
  123. package/tests/operations/tests/GenerateLoremIpsum.mjs +2 -2
  124. package/tests/operations/tests/Gzip.mjs +60 -0
  125. package/tests/operations/tests/HTMLEntity.mjs +126 -0
  126. package/tests/operations/tests/Hash.mjs +44 -0
  127. package/tests/operations/tests/Hexdump.mjs +11 -0
  128. package/tests/operations/tests/Image.mjs +26 -0
  129. package/tests/operations/tests/Jsonata.mjs +23 -0
  130. package/tests/operations/tests/MIMEDecoding.mjs +33 -0
  131. package/tests/operations/tests/MOD.mjs +208 -0
  132. package/tests/operations/tests/Median.mjs +33 -0
  133. package/tests/operations/tests/ModularInverse.mjs +78 -0
  134. package/tests/operations/tests/OTP.mjs +167 -2
  135. package/tests/operations/tests/PRESENT.mjs +465 -0
  136. package/tests/operations/tests/ParseIPv4Header.mjs +11 -0
  137. package/tests/operations/tests/ParseTLV.mjs +41 -0
  138. package/tests/operations/tests/RenderPDF.mjs +55 -0
  139. package/tests/operations/tests/SM2.mjs +1 -1
  140. package/tests/operations/tests/SetDifference.mjs +22 -0
  141. package/tests/operations/tests/SetIntersection.mjs +23 -1
  142. package/tests/operations/tests/ShowOnMap.mjs +61 -0
  143. package/tests/operations/tests/TEA.mjs +566 -0
  144. package/tests/operations/tests/Twofish.mjs +486 -0
  145. package/tests/operations/tests/URLEncodeDecode.mjs +26 -0
  146. package/tests/operations/tests/UnescapeUnicodeCharacters.mjs +88 -0
  147. package/tests/operations/tests/Wrap.mjs +44 -0
  148. package/webpack.config.js +3 -3
@@ -0,0 +1,98 @@
1
+ /**
2
+ * @author Medjedtxm
3
+ * @copyright Crown Copyright 2026
4
+ * @license Apache-2.0
5
+ */
6
+
7
+ import Operation from "../Operation.mjs";
8
+ import Utils from "../Utils.mjs";
9
+ import OperationError from "../errors/OperationError.mjs";
10
+ import { toHex } from "../lib/Hex.mjs";
11
+ import { decryptTEA, TEA_BLOCK_SIZE } from "../lib/TEA.mjs";
12
+
13
+ /**
14
+ * TEA Decrypt operation
15
+ */
16
+ class TEADecrypt extends Operation {
17
+
18
+ /**
19
+ * TEADecrypt constructor
20
+ */
21
+ constructor() {
22
+ super();
23
+
24
+ this.name = "TEA Decrypt";
25
+ this.module = "Ciphers";
26
+ this.description = "TEA (Tiny Encryption Algorithm) is a block cipher designed by David Wheeler and Roger Needham in 1994. It operates on 64-bit blocks using a 128-bit key and performs 32 cycles (64 Feistel rounds) with the DELTA constant 0x9E3779B9 derived from the golden ratio.<br><br>TEA is notable for its simplicity and compact implementation, making it frequently encountered in malware analysis and CTF challenges. Despite its elegance, TEA has known weaknesses including equivalent keys and susceptibility to related-key attacks, leading to successors XTEA and XXTEA.<br><br><b>Key:</b> Must be exactly 16 bytes (128 bits).<br><br><b>IV:</b> The Initialisation Vector should be 8 bytes (64 bits). If not entered, it will default to null bytes.<br><br><b>Padding:</b> In CBC and ECB mode, the PKCS#5 padding scheme is used.";
27
+ this.infoURL = "https://wikipedia.org/wiki/Tiny_Encryption_Algorithm";
28
+ this.inputType = "string";
29
+ this.outputType = "string";
30
+ this.args = [
31
+ {
32
+ "name": "Key",
33
+ "type": "toggleString",
34
+ "value": "",
35
+ "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
36
+ },
37
+ {
38
+ "name": "IV",
39
+ "type": "toggleString",
40
+ "value": "",
41
+ "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
42
+ },
43
+ {
44
+ "name": "Mode",
45
+ "type": "option",
46
+ "value": ["CBC", "CFB", "OFB", "CTR", "ECB"]
47
+ },
48
+ {
49
+ "name": "Input",
50
+ "type": "option",
51
+ "value": ["Hex", "Raw"]
52
+ },
53
+ {
54
+ "name": "Output",
55
+ "type": "option",
56
+ "value": ["Raw", "Hex"]
57
+ },
58
+ {
59
+ "name": "Padding",
60
+ "type": "option",
61
+ "value": ["PKCS5", "NO", "ZERO", "RANDOM", "BIT"]
62
+ }
63
+ ];
64
+ }
65
+
66
+ /**
67
+ * @param {string} input
68
+ * @param {Object[]} args
69
+ * @returns {string}
70
+ */
71
+ run(input, args) {
72
+ const key = Utils.convertToByteArray(args[0].string, args[0].option),
73
+ iv = Utils.convertToByteArray(args[1].string, args[1].option),
74
+ [,, mode, inputType, outputType, padding] = args;
75
+
76
+ if (key.length !== 16)
77
+ throw new OperationError(`Invalid key length: ${key.length} bytes
78
+
79
+ TEA requires a key length of 16 bytes (128 bits).
80
+ Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);
81
+
82
+ if (iv.length !== TEA_BLOCK_SIZE && iv.length !== 0 && mode !== "ECB")
83
+ throw new OperationError(`Invalid IV length: ${iv.length} bytes
84
+
85
+ TEA uses an IV length of ${TEA_BLOCK_SIZE} bytes (${TEA_BLOCK_SIZE * 8} bits).
86
+ Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);
87
+
88
+ // Default IV to null bytes if empty (like AES)
89
+ const actualIv = iv.length === 0 ? new Array(TEA_BLOCK_SIZE).fill(0) : iv;
90
+
91
+ input = Utils.convertToByteArray(input, inputType);
92
+ const output = decryptTEA(input, key, actualIv, mode, padding);
93
+ return outputType === "Hex" ? toHex(output, "") : Utils.byteArrayToUtf8(output);
94
+ }
95
+
96
+ }
97
+
98
+ export default TEADecrypt;
@@ -0,0 +1,98 @@
1
+ /**
2
+ * @author Medjedtxm
3
+ * @copyright Crown Copyright 2026
4
+ * @license Apache-2.0
5
+ */
6
+
7
+ import Operation from "../Operation.mjs";
8
+ import Utils from "../Utils.mjs";
9
+ import OperationError from "../errors/OperationError.mjs";
10
+ import { toHex } from "../lib/Hex.mjs";
11
+ import { encryptTEA, TEA_BLOCK_SIZE } from "../lib/TEA.mjs";
12
+
13
+ /**
14
+ * TEA Encrypt operation
15
+ */
16
+ class TEAEncrypt extends Operation {
17
+
18
+ /**
19
+ * TEAEncrypt constructor
20
+ */
21
+ constructor() {
22
+ super();
23
+
24
+ this.name = "TEA Encrypt";
25
+ this.module = "Ciphers";
26
+ this.description = "TEA (Tiny Encryption Algorithm) is a block cipher designed by David Wheeler and Roger Needham in 1994. It operates on 64-bit blocks using a 128-bit key and performs 32 cycles (64 Feistel rounds) with the DELTA constant 0x9E3779B9 derived from the golden ratio.<br><br>TEA is notable for its simplicity and compact implementation, making it frequently encountered in malware analysis and CTF challenges. Despite its elegance, TEA has known weaknesses including equivalent keys and susceptibility to related-key attacks, leading to successors XTEA and XXTEA.<br><br><b>Key:</b> Must be exactly 16 bytes (128 bits).<br><br><b>IV:</b> The Initialisation Vector should be 8 bytes (64 bits). If not entered, it will default to null bytes.<br><br><b>Padding:</b> In CBC and ECB mode, the PKCS#5 padding scheme is used.";
27
+ this.infoURL = "https://wikipedia.org/wiki/Tiny_Encryption_Algorithm";
28
+ this.inputType = "string";
29
+ this.outputType = "string";
30
+ this.args = [
31
+ {
32
+ "name": "Key",
33
+ "type": "toggleString",
34
+ "value": "",
35
+ "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
36
+ },
37
+ {
38
+ "name": "IV",
39
+ "type": "toggleString",
40
+ "value": "",
41
+ "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
42
+ },
43
+ {
44
+ "name": "Mode",
45
+ "type": "option",
46
+ "value": ["CBC", "CFB", "OFB", "CTR", "ECB"]
47
+ },
48
+ {
49
+ "name": "Input",
50
+ "type": "option",
51
+ "value": ["Raw", "Hex"]
52
+ },
53
+ {
54
+ "name": "Output",
55
+ "type": "option",
56
+ "value": ["Hex", "Raw"]
57
+ },
58
+ {
59
+ "name": "Padding",
60
+ "type": "option",
61
+ "value": ["PKCS5", "NO", "ZERO", "RANDOM", "BIT"]
62
+ }
63
+ ];
64
+ }
65
+
66
+ /**
67
+ * @param {string} input
68
+ * @param {Object[]} args
69
+ * @returns {string}
70
+ */
71
+ run(input, args) {
72
+ const key = Utils.convertToByteArray(args[0].string, args[0].option),
73
+ iv = Utils.convertToByteArray(args[1].string, args[1].option),
74
+ [,, mode, inputType, outputType, padding] = args;
75
+
76
+ if (key.length !== 16)
77
+ throw new OperationError(`Invalid key length: ${key.length} bytes
78
+
79
+ TEA requires a key length of 16 bytes (128 bits).
80
+ Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);
81
+
82
+ if (iv.length !== TEA_BLOCK_SIZE && iv.length !== 0 && mode !== "ECB")
83
+ throw new OperationError(`Invalid IV length: ${iv.length} bytes
84
+
85
+ TEA uses an IV length of ${TEA_BLOCK_SIZE} bytes (${TEA_BLOCK_SIZE * 8} bits).
86
+ Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);
87
+
88
+ // Default IV to null bytes if empty (like AES)
89
+ const actualIv = iv.length === 0 ? new Array(TEA_BLOCK_SIZE).fill(0) : iv;
90
+
91
+ input = Utils.convertToByteArray(input, inputType);
92
+ const output = encryptTEA(input, key, actualIv, mode, padding);
93
+ return outputType === "Hex" ? toHex(output, "") : Utils.byteArrayToUtf8(output);
94
+ }
95
+
96
+ }
97
+
98
+ export default TEAEncrypt;
@@ -28,7 +28,10 @@ class ToBase extends Operation {
28
28
  {
29
29
  "name": "Radix",
30
30
  "type": "number",
31
- "value": 36
31
+ "value": 36,
32
+ "min": 2,
33
+ "max": 36,
34
+ "integer": true,
32
35
  }
33
36
  ];
34
37
  }
@@ -43,9 +46,6 @@ class ToBase extends Operation {
43
46
  throw new OperationError("Error: Input must be a number");
44
47
  }
45
48
  const radix = args[0];
46
- if (radix < 2 || radix > 36) {
47
- throw new OperationError("Error: Radix argument must be between 2 and 36");
48
- }
49
49
  return input.toString(radix);
50
50
  }
51
51
 
@@ -43,7 +43,14 @@ class ToBase32 extends Operation {
43
43
  if (!input) return "";
44
44
  input = new Uint8Array(input);
45
45
 
46
- const alphabet = args[0] ? Utils.expandAlphRange(args[0]).join("") : "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=";
46
+ const alphabet = args[0] ?
47
+ Utils.expandAlphRange(args[0]).join("") :
48
+ "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=";
49
+
50
+ // Unicode-safe alphabet handling
51
+ // Supports BMP + non-BMP characters (emoji, Mahjong tiles, etc.)
52
+ const alphabetChars = Array.from(alphabet);
53
+
47
54
  let output = "",
48
55
  chr1, chr2, chr3, chr4, chr5,
49
56
  enc1, enc2, enc3, enc4, enc5, enc6, enc7, enc8,
@@ -74,10 +81,19 @@ class ToBase32 extends Operation {
74
81
  enc8 = 32;
75
82
  }
76
83
 
77
- output += alphabet.charAt(enc1) + alphabet.charAt(enc2) + alphabet.charAt(enc3) +
78
- alphabet.charAt(enc4) + alphabet.charAt(enc5) + alphabet.charAt(enc6) +
79
- alphabet.charAt(enc7) + alphabet.charAt(enc8);
84
+ // Preserve original charAt() behavior:
85
+ // out-of-range indexes return ""
86
+ output +=
87
+ (alphabetChars[enc1] || "") +
88
+ (alphabetChars[enc2] || "") +
89
+ (alphabetChars[enc3] || "") +
90
+ (alphabetChars[enc4] || "") +
91
+ (alphabetChars[enc5] || "") +
92
+ (alphabetChars[enc6] || "") +
93
+ (alphabetChars[enc7] || "") +
94
+ (alphabetChars[enc8] || "");
80
95
  }
96
+
81
97
  return output;
82
98
  }
83
99
 
@@ -35,7 +35,10 @@ class ToBinary extends Operation {
35
35
  {
36
36
  "name": "Byte Length",
37
37
  "type": "number",
38
- "value": 8
38
+ "value": 8,
39
+ "min": 1,
40
+ "max": 256, // arbitrary - significantly larger than word size for any known machine ("640k ought to be enough for anybody")
41
+ "integer": true
39
42
  }
40
43
  ];
41
44
  }
@@ -0,0 +1,38 @@
1
+ /**
2
+ * @author Imantas Lukenskas [imantas@lukenskas.dev]
3
+ * @copyright Imantas Lukenskas 2026
4
+ * @license Apache-2.0
5
+ */
6
+
7
+ import Operation from "../Operation.mjs";
8
+ import {toCobs} from "../lib/COBS.mjs";
9
+
10
+ /**
11
+ * To COBS operation
12
+ */
13
+ class ToCOBS extends Operation {
14
+ /**
15
+ * ToCOBS constructor
16
+ */
17
+ constructor() {
18
+ super();
19
+
20
+ this.name = "To COBS";
21
+ this.module = "Default";
22
+ this.description = "Encodes bytes in COBS format";
23
+ this.infoURL = "https://wikipedia.org/wiki/Consistent_Overhead_Byte_Stuffing";
24
+ this.inputType = "byteArray";
25
+ this.outputType = "byteArray";
26
+ }
27
+
28
+ /**
29
+ * @param {byteArray} input
30
+ * @param {Object[]} args
31
+ * @returns {byteArray}
32
+ */
33
+ run(input, args) {
34
+ return toCobs(input);
35
+ }
36
+ }
37
+
38
+ export default ToCOBS;