cyberchef 9.37.1 → 9.38.0

package/src/core/operations/ExtractDates.mjs

@@ -44,7 +44,13 @@ class ExtractDates extends Operation {
             date3 = "(?:0[1-9]|1[012])[- /.](?:0[1-9]|[12][0-9]|3[01])[- /.](?:19|20)\\d\\d", // mm/dd/yyyy
             regex = new RegExp(date1 + "|" + date2 + "|" + date3, "ig");
 
-        return search(input, regex, null, displayTotal);
+        const results = search(input, regex);
+
+        if (displayTotal) {
+            return `Total found: ${results.length}\n\n${results.join("\n")}`;
+        } else {
+            return results.join("\n");
+        }
     }
 
 }

package/src/core/operations/ExtractDomains.mjs

@@ -6,6 +6,7 @@
 
 import Operation from "../Operation.mjs";
 import { search, DOMAIN_REGEX } from "../lib/Extract.mjs";
+import { caseInsensitiveSort } from "../lib/Sort.mjs";
 
 /**
  * Extract domains operation
@@ -25,9 +26,19 @@ class ExtractDomains extends Operation {
         this.outputType = "string";
         this.args = [
             {
-                "name": "Display total",
-                "type": "boolean",
-                "value": true
+                name: "Display total",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Sort",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Unique",
+                type: "boolean",
+                value: false
             }
         ];
     }
@@ -38,8 +49,21 @@ class ExtractDomains extends Operation {
      * @returns {string}
      */
     run(input, args) {
-        const displayTotal = args[0];
-        return search(input, DOMAIN_REGEX, null, displayTotal);
+        const [displayTotal, sort, unique] = args;
+
+        const results = search(
+            input,
+            DOMAIN_REGEX,
+            null,
+            sort ? caseInsensitiveSort : null,
+            unique
+        );
+
+        if (displayTotal) {
+            return `Total found: ${results.length}\n\n${results.join("\n")}`;
+        } else {
+            return results.join("\n");
+        }
     }
 
 }

package/src/core/operations/ExtractEmailAddresses.mjs

@@ -6,6 +6,7 @@
 
 import Operation from "../Operation.mjs";
 import { search } from "../lib/Extract.mjs";
+import { caseInsensitiveSort } from "../lib/Sort.mjs";
 
 /**
  * Extract email addresses operation
@@ -25,9 +26,19 @@ class ExtractEmailAddresses extends Operation {
         this.outputType = "string";
         this.args = [
             {
-                "name": "Display total",
-                "type": "boolean",
-                "value": false
+                name: "Display total",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Sort",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Unique",
+                type: "boolean",
+                value: false
             }
         ];
     }
@@ -38,10 +49,23 @@ class ExtractEmailAddresses extends Operation {
      * @returns {string}
      */
     run(input, args) {
-        const displayTotal = args[0],
+        const [displayTotal, sort, unique] = args,
             // email regex from: https://www.regextester.com/98066
             regex = /(?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9](?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9-]*[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9])?\.)+[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9](?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9-]*[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9])?|\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\.){3}\])/ig;
-        return search(input, regex, null, displayTotal);
+
+        const results = search(
+            input,
+            regex,
+            null,
+            sort ? caseInsensitiveSort : null,
+            unique
+        );
+
+        if (displayTotal) {
+            return `Total found: ${results.length}\n\n${results.join("\n")}`;
+        } else {
+            return results.join("\n");
+        }
     }
 
 }

package/src/core/operations/ExtractFilePaths.mjs

@@ -6,6 +6,7 @@
 
 import Operation from "../Operation.mjs";
 import { search } from "../lib/Extract.mjs";
+import { caseInsensitiveSort } from "../lib/Sort.mjs";
 
 /**
  * Extract file paths operation
@@ -25,19 +26,29 @@ class ExtractFilePaths extends Operation {
         this.outputType = "string";
         this.args = [
             {
-                "name": "Windows",
-                "type": "boolean",
-                "value": true
+                name: "Windows",
+                type: "boolean",
+                value: true
             },
             {
-                "name": "UNIX",
-                "type": "boolean",
-                "value": true
+                name: "UNIX",
+                type: "boolean",
+                value: true
             },
             {
-                "name": "Display total",
-                "type": "boolean",
-                "value": false
+                name: "Display total",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Sort",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Unique",
+                type: "boolean",
+                value: false
             }
         ];
     }
@@ -48,7 +59,7 @@ class ExtractFilePaths extends Operation {
      * @returns {string}
      */
     run(input, args) {
-        const [includeWinPath, includeUnixPath, displayTotal] = args,
+        const [includeWinPath, includeUnixPath, displayTotal, sort, unique] = args,
             winDrive = "[A-Z]:\\\\",
             winName = "[A-Z\\d][A-Z\\d\\- '_\\(\\)~]{0,61}",
             winExt = "[A-Z\\d]{1,6}",
@@ -65,12 +76,25 @@ class ExtractFilePaths extends Operation {
             filePaths = unixPath;
         }
 
-        if (filePaths) {
-            const regex = new RegExp(filePaths, "ig");
-            return search(input, regex, null, displayTotal);
-        } else {
+        if (!filePaths) {
             return "";
         }
+
+        const regex = new RegExp(filePaths, "ig");
+        const results = search(
+            input,
+            regex,
+            null,
+            sort ? caseInsensitiveSort : null,
+            unique
+        );
+
+        if (displayTotal) {
+            return `Total found: ${results.length}\n\n${results.join("\n")}`;
+        } else {
+            return results.join("\n");
+        }
+
     }
 
 }

package/src/core/operations/ExtractIPAddresses.mjs

@@ -6,6 +6,7 @@
 
 import Operation from "../Operation.mjs";
 import { search } from "../lib/Extract.mjs";
+import { ipSort } from "../lib/Sort.mjs";
 
 /**
  * Extract IP addresses operation
@@ -25,24 +26,34 @@ class ExtractIPAddresses extends Operation {
         this.outputType = "string";
         this.args = [
             {
-                "name": "IPv4",
-                "type": "boolean",
-                "value": true
+                name: "IPv4",
+                type: "boolean",
+                value: true
             },
             {
-                "name": "IPv6",
-                "type": "boolean",
-                "value": false
+                name: "IPv6",
+                type: "boolean",
+                value: false
             },
             {
-                "name": "Remove local IPv4 addresses",
-                "type": "boolean",
-                "value": false
+                name: "Remove local IPv4 addresses",
+                type: "boolean",
+                value: false
             },
             {
-                "name": "Display total",
-                "type": "boolean",
-                "value": false
+                name: "Display total",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Sort",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Unique",
+                type: "boolean",
+                value: false
             }
         ];
     }
@@ -53,7 +64,7 @@ class ExtractIPAddresses extends Operation {
      * @returns {string}
      */
     run(input, args) {
-        const [includeIpv4, includeIpv6, removeLocal, displayTotal] = args,
+        const [includeIpv4, includeIpv6, removeLocal, displayTotal, sort, unique] = args,
             ipv4 = "(?:(?:\\d|[01]?\\d\\d|2[0-4]\\d|25[0-5])\\.){3}(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d|\\d)(?:\\/\\d{1,2})?",
             ipv6 = "((?=.*::)(?!.*::.+::)(::)?([\\dA-F]{1,4}:(:|\\b)|){5}|([\\dA-F]{1,4}:){6})((([\\dA-F]{1,4}((?!\\3)::|:\\b|(?![\\dA-F])))|(?!\\2\\3)){2}|(((2[0-4]|1\\d|[1-9])?\\d|25[0-5])\\.?\\b){4})";
         let ips  = "";
@@ -66,23 +77,29 @@ class ExtractIPAddresses extends Operation {
             ips = ipv6;
         }
 
-        if (ips) {
-            const regex = new RegExp(ips, "ig");
+        if (!ips) return "";
 
-            if (removeLocal) {
-                const ten = "10\\..+",
-                    oneninetwo = "192\\.168\\..+",
-                    oneseventwo = "172\\.(?:1[6-9]|2\\d|3[01])\\..+",
-                    onetwoseven = "127\\..+",
-                    removeRegex = new RegExp("^(?:" + ten + "|" + oneninetwo +
-                        "|" + oneseventwo + "|" + onetwoseven + ")");
+        const regex = new RegExp(ips, "ig");
 
-                return search(input, regex, removeRegex, displayTotal);
-            } else {
-                return search(input, regex, null, displayTotal);
-            }
+        const ten = "10\\..+",
+            oneninetwo = "192\\.168\\..+",
+            oneseventwo = "172\\.(?:1[6-9]|2\\d|3[01])\\..+",
+            onetwoseven = "127\\..+",
+            removeRegex = new RegExp("^(?:" + ten + "|" + oneninetwo +
+                "|" + oneseventwo + "|" + onetwoseven + ")");
+
+        const results = search(
+            input,
+            regex,
+            removeLocal ? removeRegex : null,
+            sort ? ipSort : null,
+            unique
+        );
+
+        if (displayTotal) {
+            return `Total found: ${results.length}\n\n${results.join("\n")}`;
         } else {
-            return "";
+            return results.join("\n");
         }
     }
 

package/src/core/operations/ExtractMACAddresses.mjs

@@ -6,6 +6,7 @@
 
 import Operation from "../Operation.mjs";
 import { search } from "../lib/Extract.mjs";
+import { hexadecimalSort } from "../lib/Sort.mjs";
 
 /**
  * Extract MAC addresses operation
@@ -25,9 +26,19 @@ class ExtractMACAddresses extends Operation {
         this.outputType = "string";
         this.args = [
             {
-                "name": "Display total",
-                "type": "boolean",
-                "value": false
+                name: "Display total",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Sort",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Unique",
+                type: "boolean",
+                value: false
             }
         ];
     }
@@ -38,10 +49,21 @@ class ExtractMACAddresses extends Operation {
      * @returns {string}
      */
     run(input, args) {
-        const displayTotal = args[0],
-            regex = /[A-F\d]{2}(?:[:-][A-F\d]{2}){5}/ig;
+        const [displayTotal, sort, unique] = args,
+            regex = /[A-F\d]{2}(?:[:-][A-F\d]{2}){5}/ig,
+            results = search(
+                input,
+                regex,
+                null,
+                sort ? hexadecimalSort : null,
+                unique
+            );
 
-        return search(input, regex, null, displayTotal);
+        if (displayTotal) {
+            return `Total found: ${results.length}\n\n${results.join("\n")}`;
+        } else {
+            return results.join("\n");
+        }
     }
 
 }

package/src/core/operations/ExtractURLs.mjs

@@ -6,6 +6,7 @@
 
 import Operation from "../Operation.mjs";
 import { search, URL_REGEX } from "../lib/Extract.mjs";
+import { caseInsensitiveSort } from "../lib/Sort.mjs";
 
 /**
  * Extract URLs operation
@@ -25,9 +26,19 @@ class ExtractURLs extends Operation {
         this.outputType = "string";
         this.args = [
             {
-                "name": "Display total",
-                "type": "boolean",
-                "value": false
+                name: "Display total",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Sort",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Unique",
+                type: "boolean",
+                value: false
             }
         ];
     }
@@ -38,8 +49,20 @@ class ExtractURLs extends Operation {
      * @returns {string}
      */
     run(input, args) {
-        const displayTotal = args[0];
-        return search(input, URL_REGEX, null, displayTotal);
+        const [displayTotal, sort, unique] = args;
+        const results = search(
+            input,
+            URL_REGEX,
+            null,
+            sort ? caseInsensitiveSort : null,
+            unique
+        );
+
+        if (displayTotal) {
+            return `Total found: ${results.length}\n\n${results.join("\n")}`;
+        } else {
+            return results.join("\n");
+        }
     }
 
 }

package/src/core/operations/ParseTCP.mjs

@@ -0,0 +1,245 @@
+/**
+ * @author n1474335 [n1474335@gmail.com]
+ * @copyright Crown Copyright 2022
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import Stream from "../lib/Stream.mjs";
+import {toHexFast, fromHex} from "../lib/Hex.mjs";
+import {toBinary} from "../lib/Binary.mjs";
+import {objToTable, bytesToLargeNumber} from "../lib/Protocol.mjs";
+import Utils from "../Utils.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import BigNumber from "bignumber.js";
+
+/**
+ * Parse TCP operation
+ */
+class ParseTCP extends Operation {
+
+    /**
+     * ParseTCP constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Parse TCP";
+        this.module = "Default";
+        this.description = "Parses a TCP header and payload (if present).";
+        this.infoURL = "https://wikipedia.org/wiki/Transmission_Control_Protocol";
+        this.inputType = "string";
+        this.outputType = "json";
+        this.presentType = "html";
+        this.args = [
+            {
+                name: "Input format",
+                type: "option",
+                value: ["Hex", "Raw"]
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {html}
+     */
+    run(input, args) {
+        const format = args[0];
+
+        if (format === "Hex") {
+            input = fromHex(input);
+        } else if (format === "Raw") {
+            input = Utils.strToArrayBuffer(input);
+        } else {
+            throw new OperationError("Unrecognised input format.");
+        }
+
+        const s = new Stream(new Uint8Array(input));
+        if (s.length < 20) {
+            throw new OperationError("Need at least 20 bytes for a TCP Header");
+        }
+
+        // Parse Header
+        const TCPPacket = {
+            "Source port": s.readInt(2),
+            "Destination port": s.readInt(2),
+            "Sequence number": bytesToLargeNumber(s.getBytes(4)),
+            "Acknowledgement number": s.readInt(4),
+            "Data offset": s.readBits(4),
+            "Flags": {
+                "Reserved": toBinary(s.readBits(3), "", 3),
+                "NS": s.readBits(1),
+                "CWR": s.readBits(1),
+                "ECE": s.readBits(1),
+                "URG": s.readBits(1),
+                "ACK": s.readBits(1),
+                "PSH": s.readBits(1),
+                "RST": s.readBits(1),
+                "SYN": s.readBits(1),
+                "FIN": s.readBits(1),
+            },
+            "Window size": s.readInt(2),
+            "Checksum": "0x" + toHexFast(s.getBytes(2)),
+            "Urgent pointer": "0x" + toHexFast(s.getBytes(2))
+        };
+
+        // Parse options if present
+        let windowScaleShift = 0;
+        if (TCPPacket["Data offset"] > 5) {
+            let remainingLength = TCPPacket["Data offset"] * 4 - 20;
+
+            const options = {};
+            while (remainingLength > 0) {
+                const option = {
+                    "Kind": s.readInt(1)
+                };
+
+                let opt = { name: "Reserved", length: true };
+                if (Object.prototype.hasOwnProperty.call(TCP_OPTION_KIND_LOOKUP, option.Kind)) {
+                    opt = TCP_OPTION_KIND_LOOKUP[option.Kind];
+                }
+
+                // Add Length and Value fields
+                if (opt.length) {
+                    option.Length = s.readInt(1);
+
+                    if (option.Length > 2) {
+                        if (Object.prototype.hasOwnProperty.call(opt, "parser")) {
+                            option.Value = opt.parser(s.getBytes(option.Length - 2));
+                        } else {
+                            option.Value = option.Length <= 6 ?
+                                s.readInt(option.Length - 2):
+                                "0x" + toHexFast(s.getBytes(option.Length - 2));
+                        }
+
+                        // Store Window Scale shift for later
+                        if (option.Kind === 3 && option.Value) {
+                            windowScaleShift = option.Value["Shift count"];
+                        }
+                    }
+                }
+                options[opt.name] = option;
+
+                const length = option.Length || 1;
+                remainingLength -= length;
+            }
+            TCPPacket.Options = options;
+        }
+
+        if (s.hasMore()) {
+            TCPPacket.Data = "0x" + toHexFast(s.getBytes());
+        }
+
+        // Improve values
+        TCPPacket["Data offset"] = `${TCPPacket["Data offset"]} (${TCPPacket["Data offset"] * 4} bytes)`;
+        const trueWndSize = BigNumber(TCPPacket["Window size"]).multipliedBy(BigNumber(2).pow(BigNumber(windowScaleShift)));
+        TCPPacket["Window size"] = `${TCPPacket["Window size"]} (Scaled: ${trueWndSize})`;
+
+        return TCPPacket;
+    }
+
+    /**
+     * Displays the TCP Packet in a tabular style
+     * @param {Object} data
+     * @returns {html}
+     */
+    present(data) {
+        return objToTable(data);
+    }
+
+}
+
+// Taken from https://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml
+// on 2022-05-30
+const TCP_OPTION_KIND_LOOKUP = {
+    0: { name: "End of Option List", length: false },
+    1: { name: "No-Operation", length: false },
+    2: { name: "Maximum Segment Size", length: true },
+    3: { name: "Window Scale", length: true, parser: windowScaleParser },
+    4: { name: "SACK Permitted", length: true },
+    5: { name: "SACK", length: true },
+    6: { name: "Echo (obsoleted by option 8)", length: true },
+    7: { name: "Echo Reply (obsoleted by option 8)", length: true },
+    8: { name: "Timestamps", length: true, parser: tcpTimestampParser },
+    9: { name: "Partial Order Connection Permitted (obsolete)", length: true },
+    10: { name: "Partial Order Service Profile (obsolete)", length: true },
+    11: { name: "CC (obsolete)", length: true },
+    12: { name: "CC.NEW (obsolete)", length: true },
+    13: { name: "CC.ECHO (obsolete)", length: true },
+    14: { name: "TCP Alternate Checksum Request (obsolete)", length: true, parser: tcpAlternateChecksumParser },
+    15: { name: "TCP Alternate Checksum Data (obsolete)", length: true },
+    16: { name: "Skeeter", length: true },
+    17: { name: "Bubba", length: true },
+    18: { name: "Trailer Checksum Option", length: true },
+    19: { name: "MD5 Signature Option (obsoleted by option 29)", length: true },
+    20: { name: "SCPS Capabilities", length: true },
+    21: { name: "Selective Negative Acknowledgements", length: true },
+    22: { name: "Record Boundaries", length: true },
+    23: { name: "Corruption experienced", length: true },
+    24: { name: "SNAP", length: true },
+    25: { name: "Unassigned (released 2000-12-18)", length: true },
+    26: { name: "TCP Compression Filter", length: true },
+    27: { name: "Quick-Start Response", length: true },
+    28: { name: "User Timeout Option (also, other known unauthorized use)", length: true },
+    29: { name: "TCP Authentication Option (TCP-AO)", length: true },
+    30: { name: "Multipath TCP (MPTCP)", length: true },
+    69: { name: "Encryption Negotiation (TCP-ENO)", length: true },
+    70: { name: "Reserved (known unauthorized use without proper IANA assignment)", length: true },
+    76: { name: "Reserved (known unauthorized use without proper IANA assignment)", length: true },
+    77: { name: "Reserved (known unauthorized use without proper IANA assignment)", length: true },
+    78: { name: "Reserved (known unauthorized use without proper IANA assignment)", length: true },
+    253: { name: "RFC3692-style Experiment 1 (also improperly used for shipping products) ", length: true },
+    254: { name: "RFC3692-style Experiment 2 (also improperly used for shipping products) ", length: true }
+};
+
+/**
+ * Parses the TCP Alternate Checksum Request field
+ * @param {Uint8Array} data
+ */
+function tcpAlternateChecksumParser(data) {
+    const lookup = {
+        0: "TCP Checksum",
+        1: "8-bit Fletchers's algorithm",
+        2: "16-bit Fletchers's algorithm",
+        3: "Redundant Checksum Avoidance"
+    }[data[0]];
+
+    return `${lookup} (0x${toHexFast(data)})`;
+}
+
+/**
+ * Parses the TCP Timestamp field
+ * @param {Uint8Array} data
+ */
+function tcpTimestampParser(data) {
+    const s = new Stream(data);
+
+    if (s.length !== 8)
+        return `Error: Timestamp field should be 8 bytes long (received 0x${toHexFast(data)})`;
+
+    const tsval = bytesToLargeNumber(s.getBytes(4)),
+        tsecr = bytesToLargeNumber(s.getBytes(4));
+
+    return {
+        "Current Timestamp": tsval,
+        "Echo Reply": tsecr
+    };
+}
+
+/**
+ * Parses the Window Scale field
+ * @param {Uint8Array} data
+ */
+function windowScaleParser(data) {
+    if (data.length !== 1)
+        return `Error: Window Scale should be one byte long (received 0x${toHexFast(data)})`;
+
+    return {
+        "Shift count": data[0],
+        "Multiplier": 1 << data[0]
+    };
+}
+
+export default ParseTCP;