diff --git a/public/arf.json b/public/arf.json index d5b32bb..1fb1f6f 100644 --- a/public/arf.json +++ b/public/arf.json @@ -10975,7 +10975,22 @@ { "name": "ClearImage Barcode Reader", "type": "url", - "url": "https://online-barcode-reader.inliteresearch.com/" + "url": "https://online-barcode-reader.inliteresearch.com/", + "description": "Web-based barcode and QR code recognition tool using Inlite Research ClearImage technology for common image and document formats.", + "status": "live", + "pricing": "free", + "bestFor": "Barcode and QR code decoding from uploaded files", + "input": "Image files and PDFs containing barcode or QR symbols", + "output": "Decoded barcode and QR payload values", + "opsec": "active", + "opsecNote": "Uploaded files are processed by a third-party web service and may be logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -10986,32 +11001,122 @@ { "name": "JS Beautifier", "type": "url", - "url": "https://beautifier.io/" + "url": "https://beautifier.io/", + "description": "Open-source JavaScript formatter that rewrites minified or obfuscated code into readable, consistently indented source.", + "status": "live", + "pricing": "free", + "bestFor": "Fast readability improvements for packed JavaScript", + "input": "Minified or obfuscated JavaScript source text", + "output": "Formatted JavaScript with normalized structure and spacing", + "opsec": "passive", + "opsecNote": "Typical use is low-risk code formatting through a public web interface.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "JS NICE", "type": "url", - "url": "https://jsnice.org/" + "url": "https://jsnice.org/", + "description": "Legacy JavaScript reverse-engineering service that previously improved variable names and recovered structure from minified code.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference for JavaScript decompilation workflows", + "input": "Obfuscated or minified JavaScript code", + "output": "No current output because the public service is unavailable", + "opsec": "Unknown", + "opsecNote": "Service is currently unreachable and should be treated as defunct until replaced.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Firebug (T)", "type": "url", - "url": "https://getfirebug.com/downloads/" + "url": "https://getfirebug.com/downloads/", + "description": "Former Firefox debugging extension that has been retired, with core functionality absorbed into modern Firefox Developer Tools.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical context for legacy JavaScript debugging references", + "input": "Legacy Firefox extension workflows and old debugging material", + "output": "Archived documentation and obsolete download artifacts", + "opsec": "Unknown", + "opsecNote": "Tool is unmaintained and not suitable for active investigative workflows.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "SpiderMonkey (T)", "type": "url", - "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey" + "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey", + "description": "Mozilla JavaScript engine used by Firefox and available for standalone execution and analysis in local environments.", + "status": "live", + "pricing": "free", + "bestFor": "Local JavaScript execution and behavior testing without browser UI", + "input": "JavaScript source code", + "output": "Execution results, runtime behavior, and script output", + "opsec": "passive", + "opsecNote": "Runs locally and avoids sending samples to third-party analysis services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Kahu Revelo (T)", "type": "url", - "url": "https://www.kahusecurity.com/tools/" + "url": "https://www.kahusecurity.com/tools/", + "description": "Windows-focused JavaScript deobfuscation utility that executes scripts in a controlled environment to reveal hidden logic.", + "status": "live", + "pricing": "free", + "bestFor": "Unpacking heavily obfuscated JavaScript samples on Windows", + "input": "Obfuscated JavaScript files or script text", + "output": "Deobfuscated code and decoded runtime content", + "opsec": "active", + "opsecNote": "Tool executes suspect code paths, so sandbox or VM isolation is recommended.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "JavaScript Deobfuscator (T)", "type": "url", - "url": "https://addons.mozilla.org/en-US/firefox/addon/javascript-deobfuscator/" + "url": "https://addons.mozilla.org/en-US/firefox/addon/javascript-deobfuscator/", + "description": "Firefox add-on for inspecting and deobfuscating JavaScript in-browser during page analysis and script review.", + "status": "live", + "pricing": "free", + "bestFor": "Browser-native JavaScript deobfuscation during web investigations", + "input": "JavaScript loaded in Firefox pages or pasted script content", + "output": "Readable deobfuscated script output in browser tooling", + "opsec": "active", + "opsecNote": "Browser execution context can run page scripts and trackers while analyzing content.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -11022,7 +11127,22 @@ { "name": "DDecode - PHP Decoder", "type": "url", - "url": "https://ddecode.com/phpdecoder/" + "url": "https://ddecode.com/phpdecoder/", + "description": "Online decoder for layered PHP obfuscation chains such as eval, base64, gzinflate, and related encoding wrappers.", + "status": "live", + "pricing": "free", + "bestFor": "Rapid decoding of obfuscated PHP webshell and malware snippets", + "input": "Encoded or obfuscated PHP code", + "output": "Decoded and expanded PHP source text", + "opsec": "active", + "opsecNote": "Submitted samples are processed by a third-party server, so sensitive code should be sanitized first.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -11037,17 +11157,62 @@ { "name": "XORSearch & XORStrings (T)", "type": "url", - "url": "https://blog.didierstevens.com/programs/xorsearch/" + "url": "https://blog.didierstevens.com/programs/xorsearch/", + "description": "Didier Stevens command-line utilities for locating XOR, ROL, ROT, and SHIFT-encoded strings in suspicious binaries.", + "status": "live", + "pricing": "free", + "bestFor": "String extraction and key hunting in encoded malware payloads", + "input": "Binary files and encoded byte streams", + "output": "Decoded candidate strings across transformation and key ranges", + "opsec": "passive", + "opsecNote": "Runs locally on analyst systems and does not require online submission.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "xortool (T)", "type": "url", - "url": "https://github.com/hellman/xortool" + "url": "https://github.com/hellman/xortool", + "description": "Python-based XOR analysis tool that estimates key lengths and recovers likely multi-byte keys via frequency analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Recovering repeating XOR keys from encoded files", + "input": "XOR-encrypted text or binary data", + "output": "Likely XOR keys and candidate decrypted output", + "opsec": "passive", + "opsecNote": "Pure local processing with no required external service calls.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "unxor (T)", "type": "url", - "url": "https://github.com/tomchop/unxor" + "url": "https://github.com/tomchop/unxor", + "description": "Known-plaintext XOR analysis utility for deriving keystreams and recovering original content from encoded samples.", + "status": "live", + "pricing": "free", + "bestFor": "Known-plaintext XOR cracking against malware and encoded artifacts", + "input": "XOR-encoded file plus known plaintext fragments", + "output": "Recovered keystream segments and decoded content", + "opsec": "passive", + "opsecNote": "Local command-line analysis avoids submitting artifacts to remote services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -11058,7 +11223,22 @@ { "name": "Kahu Converter Utilities (T)", "type": "url", - "url": "https://www.kahusecurity.com/tools/" + "url": "https://www.kahusecurity.com/tools/", + "description": "Windows utility collection for format conversion, hex/binary transforms, and XOR-related decoding workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Mixed conversion and XOR utility operations on Windows", + "input": "Binary blobs, hex strings, and text samples", + "output": "Converted data and decoded intermediate representations", + "opsec": "passive", + "opsecNote": "Runs locally on analyst systems without mandatory cloud processing.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -11069,22 +11249,82 @@ { "name": "iheartxor.py (T)", "type": "url", - "url": "https://hooked-on-mnemonics.blogspot.com/p/iheartxor.html" + "url": "https://hooked-on-mnemonics.blogspot.com/p/iheartxor.html", + "description": "Python script for brute-forcing XOR-obfuscated strings within defined boundaries to reveal hidden text in malware samples.", + "status": "live", + "pricing": "free", + "bestFor": "Targeted extraction of XOR-obfuscated strings from binaries", + "input": "Binary data, dumps, or encoded string segments", + "output": "Recovered candidate strings and associated key bytes", + "opsec": "passive", + "opsecNote": "Offline local script execution keeps sample handling under analyst control.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "XORBruteForcer.py (T)", "type": "url", - "url": "https://eternal-todo.com/var/scripts/xorbruteforcer" + "url": "https://github.com/jesparza/scripts/blob/master/xorBruteForcer.py", + "description": "Single-byte XOR brute-force Python script that iterates candidate key values and surfaces matching decoded output.", + "status": "live", + "pricing": "free", + "bestFor": "Single-byte XOR key brute-forcing and quick validation", + "input": "Encoded file or byte sequence", + "output": "Decoded candidates mapped to tested XOR key values", + "opsec": "passive", + "opsecNote": "Local script analysis avoids artifact upload and minimizes external exposure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "NoMoreXOR.py (T)", "type": "url", - "url": "https://github.com/hiddenillusion/NoMoreXOR" + "url": "https://github.com/hiddenillusion/NoMoreXOR", + "description": "Python utility for recovering long XOR keys using character frequency heuristics and YARA-assisted pattern matching.", + "status": "live", + "pricing": "free", + "bestFor": "Recovering long XOR keys in malware binaries", + "input": "Malware sample or obfuscated binary content", + "output": "Likely keys, decoded streams, and extraction hints", + "opsec": "passive", + "opsecNote": "Operates locally and is suitable for isolated malware analysis environments.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Balbuzard (T)", "type": "url", - "url": "https://bitbucket.org/decalage/balbuzard" + "url": "https://github.com/decalage2/balbuzard", + "description": "Python malware analysis toolkit that extracts indicators and brute-forces common obfuscation patterns including XOR and rotation transforms.", + "status": "live", + "pricing": "free", + "bestFor": "Automated deobfuscation and indicator extraction from suspicious files", + "input": "Suspicious binaries and encoded artifact files", + "output": "Decoded content, extracted IoCs, and pattern-analysis results", + "opsec": "passive", + "opsecNote": "Local toolkit execution supports controlled analysis without remote sample submission.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -11093,12 +11333,42 @@ { "name": "CyberChef", "type": "url", - "url": "https://gchq.github.io/CyberChef/" + "url": "https://gchq.github.io/CyberChef/", + "description": "GCHQ-maintained browser workbench for chained encoding, decoding, hashing, crypto, and data transformation operations.", + "status": "live", + "pricing": "free", + "bestFor": "Building and replaying multi-step decode and transform recipes", + "input": "Text, binary, hex, Base64, and structured payloads", + "output": "Transformed output for each selected operation chain", + "opsec": "passive", + "opsecNote": "Public web app use is convenient, but locally hosted builds are preferred for sensitive data.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Functions Online", "type": "url", - "url": "https://www.functions-online.com/" + "url": "https://www.functions-online.com/", + "description": "PHP-oriented online utility suite for common encoding, decoding, hashing, and string-manipulation function tests.", + "status": "live", + "pricing": "free", + "bestFor": "Quick PHP-specific encoding and decoding checks in browser", + "input": "Function parameters and data strings for selected PHP routines", + "output": "Computed function results and transformed data values", + "opsec": "active", + "opsecNote": "Data is processed server-side, so avoid submitting sensitive payloads directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] },