Cyber Security Analyst Tools

Pull indicators of compromise out of any block of text, log or report.

Neutralise indicators so they can be shared without becoming clickable.

Restore defanged indicators to their original, machine-readable form.

Collapse a messy indicator list down to its unique entries.

Standardise a mixed indicator list into one consistent format.

Review a set of pasted HTTP response headers against current guidance.

Break a Content-Security-Policy into its directives and flag the weak ones.

Check a set of CORS response headers for the combinations that undo them.

Read a STIX 2.1 bundle as structured objects instead of raw JSON.

Check a STIX 2.1 bundle for structural and required-property errors.

Trace the relationship graph inside a STIX bundle object by object.

Break a YARA rule into its meta, strings and condition sections.

Reformat a YARA rule to consistent indentation and section order.

Read a Sigma detection rule as structured logsource and detection blocks.

Reorder a Sigma rule’s top-level keys to the conventional sequence.

Find a MITRE ATT&CK technique by ID or name from a bundled dataset.

Narrow an unlabelled hash down to the algorithms that could have produced it.

Build or decode a CVSS v3.1 vector and see which metric drives the score.

Read a User-Agent string, with the token behind every claim and the spoofing tells named.

Paste a script or stylesheet, get its sha256/sha384/sha512 integrity attribute.

Build a Content-Security-Policy header directive by directive, not by editing a string.

Turn on, off or origin-scope a browser feature per directive, then copy the header.

Paste a PEM certificate to read its subject, issuer, validity, key and extensions.

Paste a PKCS#10 CSR to read its requested subject, key and Subject Alternative Names.

Paste a PEM certificate, get its SHA-1 and SHA-256 fingerprint.

Paste an OpenSSH public key line to read its type, size and SHA256 fingerprint.

Scan pasted text or code for the shape of a leaked API key, token or private key.

A charset-and-length entropy estimate, with the math and its limits shown, not a bare score.

Read a raw email header as an ordered delivery path with authentication results.

Look up a domain’s SPF record or paste one, and see every mechanism explained and counted.

Look up a domain’s DMARC record or paste one, and see what policy it actually applies.

Look up the DKIM key at a selector, or read a DKIM-Signature header and key record tag by tag.

See where a domain’s mail is delivered, in priority order, with its SPF and DMARC status beside it.

Network, broadcast, mask and usable range for any block — and split it into subnets.

Enter an IPv4 address with a prefix or subnet mask, see the whole subnet, and divide it.

Convert between a start-end IP range and the CIDR blocks covering it.

Find which blocks in a list overlap, contain or duplicate each other.

Expand, compress and inspect an IPv6 address or prefix.

Every representation of an address at once — dotted, binary, integer and hex.

Tell whether an address is routable, private, loopback or otherwise reserved.

Look up what normally listens on a TCP or UDP port, and why it matters if it is exposed.

What a status code means, which RFC defines it, and what to do next.

Query A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records for any domain.

Registrar, registration and expiry dates, status codes and name servers for any domain.

Check whether one well-known port on a host answers — open, closed, or timed out.

Every certificate publicly logged for a domain, decoded — via Certificate Transparency, not a live handshake.

Decode a JSON Web Token and read its header, claims and expiry.

Check a decoded token against the weaknesses that show up in real audits.

Format, validate and measure JSON, with errors located by line and column.

Test a pattern against sample text with a hard execution timeout.

Produce SHA-1, SHA-256, SHA-384 and SHA-512 digests of text or a file.

Generate cryptographically random v4 UUIDs in bulk.

Convert between Unix time and readable dates in UTC or local time.

Read a cron expression in plain English and see when it next fires.

Split a URL into scheme, host, path, query and fragment.

Convert between 755 and rwxr-xr-x, special bits included, in both directions.

Decode a SAMLResponse and read its issuer, subject, conditions and attributes.

Compare two JSON documents and see what actually changed, independent of formatting.

Infer a TypeScript interface from a JSON example, with optional fields worked out from an array.

Infer a runtime-checkable Zod schema from a JSON example.

Infer a JSON Schema (2020-12) document from a JSON example.

Convert CSV to a JSON array of objects, or back, with proper quoted-field parsing.

Validate JSON Lines file by line and convert it to a single JSON array.

Convert between .env, JSON and YAML — the same config in three syntaxes.

Check a .env file for duplicate keys, invalid names and unterminated quotes.

Compare two versions of a config file line by line.

Convert INI to JSON and back, with sections becoming nested objects.

Parse a TOML document — tables, arrays of tables and all — into JSON.

Generate a .gitignore for common stacks, or check whether a path is actually ignored.

Break a git remote URL into protocol, host, owner and repository.

Break a github.com URL into owner, repo, ref, path and line range.

Validate a Conventional Commits message, or build one from separate fields.

Compare two versions using SemVer 2.0.0 precedence, not string sort.

Check whether a version satisfies a range like ^1.2.0 or ~2.0.0.

Group Conventional Commits into a Keep a Changelog-style breakdown.

Render git diff output as a readable, colour-coded diff.

Parse git format-patch output into author, subject and diff.

Check a CSV file for ragged rows and detect its delimiter, without converting it to anything.

Reflow a SQL query onto readable lines, one clause per line.

Turn a pasted curl command into a fetch call or Python requests snippet.

Turn a regular expression into a plain-English, line-by-line breakdown.

Convert a date and time between IANA time zones, or find the gap between two instants.

Validate a JSON document against a JSON Schema and see exactly which rule failed, and where.

Check a Compose file for the mistakes that stop it loading — before you find out with docker compose up.

Check one or more Kubernetes manifests for the fields each kind cannot function without.

Check an OpenAPI document for the fields it needs to describe a real API — not full spec compliance.

Decode Base64 and Base64URL back to text or raw bytes.

Encode text or bytes to Base64 or Base64URL.

Percent-encode text for a URL path, query value or component.

Decode percent-encoded text, including repeatedly-encoded strings.

Convert between hex byte sequences and readable text.

Convert a number between binary, octal, decimal and hexadecimal.

Convert between raw characters and HTML entity references.

Convert YAML to JSON and back, with what the conversion costs stated rather than dropped.

Pretty-print XML and catch a mismatched or unclosed tag, without ever expanding a DOCTYPE.

See the real code points, UTF-8 bytes and normalization forms behind any pasted text.