mirror of
https://github.com/lockfale/OSINT-Framework.git
synced 2026-09-12 04:37:46 +02:00
Merge pull request #620 from lockfale/feature/THE-163-enrich-encoding-decoding
Enrich Encoding / Decoding tools with OSINT metadata (THE-163)
This commit is contained in:
s0lray
+288
-18
@@ -10975,7 +10975,22 @@
|
||||
{
|
||||
"name": "ClearImage Barcode Reader",
|
||||
"type": "url",
|
||||
"url": "https://online-barcode-reader.inliteresearch.com/"
|
||||
"url": "https://online-barcode-reader.inliteresearch.com/",
|
||||
"description": "Web-based barcode and QR code recognition tool using Inlite Research ClearImage technology for common image and document formats.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Barcode and QR code decoding from uploaded files",
|
||||
"input": "Image files and PDFs containing barcode or QR symbols",
|
||||
"output": "Decoded barcode and QR payload values",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Uploaded files are processed by a third-party web service and may be logged.",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -10986,32 +11001,122 @@
|
||||
{
|
||||
"name": "JS Beautifier",
|
||||
"type": "url",
|
||||
"url": "https://beautifier.io/"
|
||||
"url": "https://beautifier.io/",
|
||||
"description": "Open-source JavaScript formatter that rewrites minified or obfuscated code into readable, consistently indented source.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Fast readability improvements for packed JavaScript",
|
||||
"input": "Minified or obfuscated JavaScript source text",
|
||||
"output": "Formatted JavaScript with normalized structure and spacing",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Typical use is low-risk code formatting through a public web interface.",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "JS NICE",
|
||||
"type": "url",
|
||||
"url": "https://jsnice.org/"
|
||||
"url": "https://jsnice.org/",
|
||||
"description": "Legacy JavaScript reverse-engineering service that previously improved variable names and recovered structure from minified code.",
|
||||
"status": "down",
|
||||
"pricing": "free",
|
||||
"bestFor": "Historical reference for JavaScript decompilation workflows",
|
||||
"input": "Obfuscated or minified JavaScript code",
|
||||
"output": "No current output because the public service is unavailable",
|
||||
"opsec": "Unknown",
|
||||
"opsecNote": "Service is currently unreachable and should be treated as defunct until replaced.",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": true
|
||||
},
|
||||
{
|
||||
"name": "Firebug (T)",
|
||||
"type": "url",
|
||||
"url": "https://getfirebug.com/downloads/"
|
||||
"url": "https://getfirebug.com/downloads/",
|
||||
"description": "Former Firefox debugging extension that has been retired, with core functionality absorbed into modern Firefox Developer Tools.",
|
||||
"status": "degraded",
|
||||
"pricing": "free",
|
||||
"bestFor": "Historical context for legacy JavaScript debugging references",
|
||||
"input": "Legacy Firefox extension workflows and old debugging material",
|
||||
"output": "Archived documentation and obsolete download artifacts",
|
||||
"opsec": "Unknown",
|
||||
"opsecNote": "Tool is unmaintained and not suitable for active investigative workflows.",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": true
|
||||
},
|
||||
{
|
||||
"name": "SpiderMonkey (T)",
|
||||
"type": "url",
|
||||
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey"
|
||||
"url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey",
|
||||
"description": "Mozilla JavaScript engine used by Firefox and available for standalone execution and analysis in local environments.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Local JavaScript execution and behavior testing without browser UI",
|
||||
"input": "JavaScript source code",
|
||||
"output": "Execution results, runtime behavior, and script output",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Runs locally and avoids sending samples to third-party analysis services.",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Kahu Revelo (T)",
|
||||
"type": "url",
|
||||
"url": "https://www.kahusecurity.com/tools/"
|
||||
"url": "https://www.kahusecurity.com/tools/",
|
||||
"description": "Windows-focused JavaScript deobfuscation utility that executes scripts in a controlled environment to reveal hidden logic.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Unpacking heavily obfuscated JavaScript samples on Windows",
|
||||
"input": "Obfuscated JavaScript files or script text",
|
||||
"output": "Deobfuscated code and decoded runtime content",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Tool executes suspect code paths, so sandbox or VM isolation is recommended.",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "JavaScript Deobfuscator (T)",
|
||||
"type": "url",
|
||||
"url": "https://addons.mozilla.org/en-US/firefox/addon/javascript-deobfuscator/"
|
||||
"url": "https://addons.mozilla.org/en-US/firefox/addon/javascript-deobfuscator/",
|
||||
"description": "Firefox add-on for inspecting and deobfuscating JavaScript in-browser during page analysis and script review.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Browser-native JavaScript deobfuscation during web investigations",
|
||||
"input": "JavaScript loaded in Firefox pages or pasted script content",
|
||||
"output": "Readable deobfuscated script output in browser tooling",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Browser execution context can run page scripts and trackers while analyzing content.",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -11022,7 +11127,22 @@
|
||||
{
|
||||
"name": "DDecode - PHP Decoder",
|
||||
"type": "url",
|
||||
"url": "https://ddecode.com/phpdecoder/"
|
||||
"url": "https://ddecode.com/phpdecoder/",
|
||||
"description": "Online decoder for layered PHP obfuscation chains such as eval, base64, gzinflate, and related encoding wrappers.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Rapid decoding of obfuscated PHP webshell and malware snippets",
|
||||
"input": "Encoded or obfuscated PHP code",
|
||||
"output": "Decoded and expanded PHP source text",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Submitted samples are processed by a third-party server, so sensitive code should be sanitized first.",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -11037,17 +11157,62 @@
|
||||
{
|
||||
"name": "XORSearch & XORStrings (T)",
|
||||
"type": "url",
|
||||
"url": "https://blog.didierstevens.com/programs/xorsearch/"
|
||||
"url": "https://blog.didierstevens.com/programs/xorsearch/",
|
||||
"description": "Didier Stevens command-line utilities for locating XOR, ROL, ROT, and SHIFT-encoded strings in suspicious binaries.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "String extraction and key hunting in encoded malware payloads",
|
||||
"input": "Binary files and encoded byte streams",
|
||||
"output": "Decoded candidate strings across transformation and key ranges",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Runs locally on analyst systems and does not require online submission.",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "xortool (T)",
|
||||
"type": "url",
|
||||
"url": "https://github.com/hellman/xortool"
|
||||
"url": "https://github.com/hellman/xortool",
|
||||
"description": "Python-based XOR analysis tool that estimates key lengths and recovers likely multi-byte keys via frequency analysis.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Recovering repeating XOR keys from encoded files",
|
||||
"input": "XOR-encrypted text or binary data",
|
||||
"output": "Likely XOR keys and candidate decrypted output",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Pure local processing with no required external service calls.",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "unxor (T)",
|
||||
"type": "url",
|
||||
"url": "https://github.com/tomchop/unxor"
|
||||
"url": "https://github.com/tomchop/unxor",
|
||||
"description": "Known-plaintext XOR analysis utility for deriving keystreams and recovering original content from encoded samples.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Known-plaintext XOR cracking against malware and encoded artifacts",
|
||||
"input": "XOR-encoded file plus known plaintext fragments",
|
||||
"output": "Recovered keystream segments and decoded content",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Local command-line analysis avoids submitting artifacts to remote services.",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -11058,7 +11223,22 @@
|
||||
{
|
||||
"name": "Kahu Converter Utilities (T)",
|
||||
"type": "url",
|
||||
"url": "https://www.kahusecurity.com/tools/"
|
||||
"url": "https://www.kahusecurity.com/tools/",
|
||||
"description": "Windows utility collection for format conversion, hex/binary transforms, and XOR-related decoding workflows.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Mixed conversion and XOR utility operations on Windows",
|
||||
"input": "Binary blobs, hex strings, and text samples",
|
||||
"output": "Converted data and decoded intermediate representations",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Runs locally on analyst systems without mandatory cloud processing.",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -11069,22 +11249,82 @@
|
||||
{
|
||||
"name": "iheartxor.py (T)",
|
||||
"type": "url",
|
||||
"url": "https://hooked-on-mnemonics.blogspot.com/p/iheartxor.html"
|
||||
"url": "https://hooked-on-mnemonics.blogspot.com/p/iheartxor.html",
|
||||
"description": "Python script for brute-forcing XOR-obfuscated strings within defined boundaries to reveal hidden text in malware samples.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Targeted extraction of XOR-obfuscated strings from binaries",
|
||||
"input": "Binary data, dumps, or encoded string segments",
|
||||
"output": "Recovered candidate strings and associated key bytes",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Offline local script execution keeps sample handling under analyst control.",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "XORBruteForcer.py (T)",
|
||||
"type": "url",
|
||||
"url": "https://eternal-todo.com/var/scripts/xorbruteforcer"
|
||||
"url": "https://github.com/jesparza/scripts/blob/master/xorBruteForcer.py",
|
||||
"description": "Single-byte XOR brute-force Python script that iterates candidate key values and surfaces matching decoded output.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Single-byte XOR key brute-forcing and quick validation",
|
||||
"input": "Encoded file or byte sequence",
|
||||
"output": "Decoded candidates mapped to tested XOR key values",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Local script analysis avoids artifact upload and minimizes external exposure.",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "NoMoreXOR.py (T)",
|
||||
"type": "url",
|
||||
"url": "https://github.com/hiddenillusion/NoMoreXOR"
|
||||
"url": "https://github.com/hiddenillusion/NoMoreXOR",
|
||||
"description": "Python utility for recovering long XOR keys using character frequency heuristics and YARA-assisted pattern matching.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Recovering long XOR keys in malware binaries",
|
||||
"input": "Malware sample or obfuscated binary content",
|
||||
"output": "Likely keys, decoded streams, and extraction hints",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Operates locally and is suitable for isolated malware analysis environments.",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Balbuzard (T)",
|
||||
"type": "url",
|
||||
"url": "https://bitbucket.org/decalage/balbuzard"
|
||||
"url": "https://github.com/decalage2/balbuzard",
|
||||
"description": "Python malware analysis toolkit that extracts indicators and brute-forces common obfuscation patterns including XOR and rotation transforms.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Automated deobfuscation and indicator extraction from suspicious files",
|
||||
"input": "Suspicious binaries and encoded artifact files",
|
||||
"output": "Decoded content, extracted IoCs, and pattern-analysis results",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Local toolkit execution supports controlled analysis without remote sample submission.",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -11093,12 +11333,42 @@
|
||||
{
|
||||
"name": "CyberChef",
|
||||
"type": "url",
|
||||
"url": "https://gchq.github.io/CyberChef/"
|
||||
"url": "https://gchq.github.io/CyberChef/",
|
||||
"description": "GCHQ-maintained browser workbench for chained encoding, decoding, hashing, crypto, and data transformation operations.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Building and replaying multi-step decode and transform recipes",
|
||||
"input": "Text, binary, hex, Base64, and structured payloads",
|
||||
"output": "Transformed output for each selected operation chain",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Public web app use is convenient, but locally hosted builds are preferred for sensitive data.",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Functions Online",
|
||||
"type": "url",
|
||||
"url": "https://www.functions-online.com/"
|
||||
"url": "https://www.functions-online.com/",
|
||||
"description": "PHP-oriented online utility suite for common encoding, decoding, hashing, and string-manipulation function tests.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Quick PHP-specific encoding and decoding checks in browser",
|
||||
"input": "Function parameters and data strings for selected PHP routines",
|
||||
"output": "Computed function results and transformed data values",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Data is processed server-side, so avoid submitting sensitive payloads directly.",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
Reference in New Issue
Block a user