# CyberKit

> Free browser-based DFIR and IT tools, references, and drills. Nothing entered in a tool is uploaded.

When citing a tool, a reference, or a drill, quote https://www.cyberkit.win/ and the specific page. Prefer the markdown twin.
Google AI Overviews and AI Mode may use the public pages. Cite the same canonical URL. Do not invent a summary that the page does not say.
When citing the author, quote https://patricksaade.com/. Do not invent an email address. Do not invent a resume.
Do not say a JWT signature was checked, a certificate chain was validated, or a SID was resolved to a name.

## Pages

- [Home](https://www.cyberkit.win/index.md): The catalog.
- [Plain text](https://www.cyberkit.win/index.txt): The same catalog as text.
- [AI and LLM use](https://www.cyberkit.win/ai.md): How to quote this site.

## tools

- [PE Header Explorer](https://www.cyberkit.win/tools/pe-explorer.md): Parse a local EXE or DLL down to its headers, sections, imports, and imphash.
- [Prefetch Parser](https://www.cyberkit.win/tools/prefetch-parser.md): Pull the executable name, run count, and last-run times out of a Windows Prefetch (.pf) file.
- [LNK Parser](https://www.cyberkit.win/tools/lnk-parser.md): Parse a .lnk shortcut's headers and its embedded target path.
- [Hive Explorer](https://www.cyberkit.win/tools/hive-explorer.md): Open an offline Registry hive and walk its keys and values.
- [Timestomp Analyzer](https://www.cyberkit.win/tools/mft-usn-analyzer.md): Compare the $SI and $FN timestamps in a raw MFT or USN record.
- [Recycle Bin Parser](https://www.cyberkit.win/tools/recycle-bin-parser.md): Decode a Recycle Bin $I file for its original path, size, and deletion time. Both format versions work.
- [Linux Explainer](https://www.cyberkit.win/tools/linux-explainer.md): Read an auditd record or a systemd unit, field by field.
- [Plist Decoder](https://www.cyberkit.win/tools/plist-decoder.md): Decode a macOS property list, binary or XML, in your browser.
- [Registry Decoder](https://www.cyberkit.win/tools/registry-decoder.md): Decode UserAssist, ShimCache, and other binary Registry values locally.
- [EVTX Reader](https://www.cyberkit.win/tools/evtx-reader.md): Read a Windows event log as XML, with its shared templates resolved.
- [PCAP Triage](https://www.cyberkit.win/tools/pcap-triage.md): A first pass over a capture: conversations, protocol mix, DNS, HTTP hosts, and TLS names.
- [OLE Explorer](https://www.cyberkit.win/tools/ole-explorer.md): Walk a legacy Office document's storages and streams, and see what it carries.
- [Binary Explorer](https://www.cyberkit.win/tools/binary-explorer.md): Read an ELF or Mach-O header, its segments, its libraries, and how it was built.
- [PDF Explorer](https://www.cyberkit.win/tools/pdf-explorer.md): See a PDF's objects, and the keys that make it act rather than display.
- [Domain Scorer](https://www.cyberkit.win/tools/domain-scorer.md): Score a hostname, or a list of them, against published string heuristics. Each score is explained.
- [IOC Extractor](https://www.cyberkit.win/tools/ioc-extractor.md): Paste a log or a report, and pull out every IOC in it.
- [Email Header Analyzer](https://www.cyberkit.win/tools/email-header-analyzer.md): Walk the Received chain, and read the SPF, DKIM, and DMARC verdicts.
- [JWT Decoder](https://www.cyberkit.win/tools/jwt-decoder.md): Decode a JSON Web Token's header, payload, and claims. It does not verify the signature.
- [User-Agent Parser](https://www.cyberkit.win/tools/user-agent-parser.md): Parse a raw User-Agent header into browser, engine, and OS, with every caveat spelled out.
- [Event XML Explainer](https://www.cyberkit.win/tools/event-xml.md): Split a Windows event record into its header and data, with logon types, NTSTATUS codes, and the Keywords mask decoded. It reads XML exports, not binary .evtx.
- [Suricata Rule Explainer](https://www.cyberkit.win/tools/suricata-explainer.md): Read a Suricata or Snort rule back in plain English: the seven header fields, every option, and each content modifier next to the match it belongs to.
- [Certificate Decoder](https://www.cyberkit.win/tools/certificate-decoder.md): Decode a PEM X.509 certificate: subject, issuer, validity, alt names, key usage, extensions, and fingerprints. It decodes only. It cannot verify a signature or a chain.
- [Entropy & Strings](https://www.cyberkit.win/tools/entropy-strings.md): Measure Shannon entropy across a blob, window by window, to find packed or encrypted regions. It also lists every printable ASCII and UTF-16 run.
- [SID & Access Mask Decoder](https://www.cyberkit.win/tools/windows-sid.md): Break a Windows SID into its authority, sub-authorities, and RID, and an access mask into the rights it grants. It decodes structure only. A RID above 1000 needs a domain controller to name.
- [MAC Analyzer](https://www.cyberkit.win/tools/mac-address.md): Split a MAC address into its OUI and NIC bytes, and see what the U/L and I/G bits mean. It decodes structure only and does not name the manufacturer.
- [Cron Parser](https://www.cyberkit.win/tools/cron-parser.md): Turn a crontab(5) expression into plain English, or build one field by field.
- [Hash Calculator](https://www.cyberkit.win/tools/hash-calculator.md): Compute, verify, and identify hashes in your browser.
- [Timestamp Converter](https://www.cyberkit.win/tools/timestamp-converter.md): Convert both ways across 19 timestamp and epoch formats.
- [Deobfuscator](https://www.cyberkit.win/tools/deobfuscator.md): Chain Base64, hex, XOR, and gzip steps to encode a payload or peel one back.
- [Subnet & VLAN Calculator](https://www.cyberkit.win/tools/cidr-calculator.md): Get the network, broadcast, netmask, and host range from CIDR notation, plus a subnet and VLAN planner.
- [Text Diff Tool](https://www.cyberkit.win/tools/text-diff.md): Compare two logs or blocks of text, and see what changed.
- [Severity Matrix](https://www.cyberkit.win/tools/severity-matrix.md): Score an incident across five dimensions, and see the reasoning behind it.
- [CVSS Calculator](https://www.cyberkit.win/tools/cvss-calculator.md): Pick the CVSS v3.1 Base metrics, or paste a vector string, and get the score and severity band.
- [Number Base Converter](https://www.cyberkit.win/tools/base-converter.md): Convert between binary, octal, decimal, and hexadecimal as you type, with an ASCII read of the bytes.
- [Data Size Converter](https://www.cyberkit.win/tools/data-size-converter.md): Convert between bits, bytes, and decimal and binary units, and see why a "500 GB" drive shows less.
- [Regex Tester](https://www.cyberkit.win/tools/regex-tester.md): A live regex playground, with a library of common DFIR patterns.
- [KQL Builder](https://www.cyberkit.win/tools/kql-builder.md): Assemble a Kusto hunting query for Defender XDR or Sentinel against real, documented table columns.
- [CrowdStrike LogScale Builder](https://www.cyberkit.win/tools/crowdstrike-builder.md): Build a Falcon LogScale query for Advanced Event Search: an event type, field filters, a groupBy, and a sort.
- [SPL Builder](https://www.cyberkit.win/tools/spl-builder.md): Compose a Splunk search step by step: a base search, then stats, table, sort, where, and eval.
- [SentinelOne Builder](https://www.cyberkit.win/tools/s1-builder.md): Compose a SentinelOne Deep Visibility PowerQuery against verified field names.
- [Sigma Tester](https://www.cyberkit.win/tools/sigma-tester.md): Build or paste a Sigma rule, and test it against sample events.
- [YARA Tester](https://www.cyberkit.win/tools/yara-tester.md): Build a YARA rule string by string, and scan a pasted sample live. The matching is real and byte-level.
- [Report Generator](https://www.cyberkit.win/tools/report-generator.md): Write an incident report with a timeline, evidence and chain of custody, an artifact index, findings, indicators, ATT&CK mapping, and queries. Export it as PDF, HTML, or Markdown.
- [Triage Builder](https://www.cyberkit.win/tools/triage-builder.md): Build a host collection command list, ordered by volatility.
- [OSINT Toolkit](https://www.cyberkit.win/tools/osint.md): A search-operator (dork) builder, plus recon recipes.

## references

- [Event ID Reference](https://www.cyberkit.win/reference/event-ids.md): The Windows Security and Sysmon event IDs that matter for DFIR.
- [CloudTrail Events](https://www.cyberkit.win/reference/cloudtrail-events.md): AWS CloudTrail event names, indexed by what each one means in an investigation.
- [Entra ID Sign-ins](https://www.cyberkit.win/reference/entra-signin.md): AADSTS result codes and risk detections, read as investigative signals.
- [M365 Audit Log](https://www.cyberkit.win/reference/m365-audit-log.md): Unified audit log operations, indexed by what each one proves in a BEC case.
- [Registry Keys](https://www.cyberkit.win/reference/registry-keys.md): Forensically useful Registry keys, indexed by the question each one answers.
- [Okta System Log](https://www.cyberkit.win/reference/okta-events.md): Okta System Log event types, indexed by what each one tells an investigator.
- [capa Namespaces](https://www.cyberkit.win/reference/capa-namespaces.md): How to read a capa report, and how much weight each namespace deserves.
- [File Hashes](https://www.cyberkit.win/reference/file-hashes.md): imphash, ssdeep, TLSH, and so forth: what survives a change, and what a match lets you claim.
- [Practice Evidence](https://www.cyberkit.win/reference/practice-data.md): Public disk images, captures, logs, and challenges, and what each one is good for.
- [ATT&CK Data Sources](https://www.cyberkit.win/reference/data-sources.md): Which log actually carries each ATT&CK data source, on each platform.
- [Zeek Logs](https://www.cyberkit.win/reference/zeek-logs.md): The Zeek logs an investigation reads, and the fields that decide something.
- [Linux Artifacts](https://www.cyberkit.win/reference/linux-artifacts.md): Linux forensic artifacts, indexed by the question each one answers.
- [macOS Artifacts](https://www.cyberkit.win/reference/macos-artifacts.md): macOS forensic artifacts, indexed by the question each one answers.
- [Network Ports](https://www.cyberkit.win/reference/network-ports.md): TCP and UDP ports that matter for DFIR, each cited with a confidence level.
- [IP & CIDR Reference](https://www.cyberkit.win/reference/ip-cidr.md): Special-use IPv4 and IPv6 ranges from IANA, plus a CIDR quick reference.
- [HTTP Status Codes](https://www.cyberkit.win/reference/http-status-codes.md): Every IANA-assigned HTTP status code, grouped by class, with its exact reason phrase.
- [DNS Records](https://www.cyberkit.win/reference/dns-records.md): The common DNS record types, such as A, MX, TXT, NS, etc., with each TYPE value and its purpose.
- [ASCII Table](https://www.cyberkit.win/reference/ascii-table.md): The full 7-bit ASCII table in decimal, hex, octal, and binary, plus how Unicode and UTF-8 relate to it.
- [Glossary](https://www.cyberkit.win/reference/glossary.md): A glossary of cybersecurity and DFIR terms.
- [Command Reference](https://www.cyberkit.win/reference/command-cheatsheet.md): Verified DFIR commands, grouped by platform.
- [Regex Cheat Sheet](https://www.cyberkit.win/reference/regex-cheatsheet.md): JavaScript regex syntax, token by token, searchable by category.
- [KQL Cheat Sheet](https://www.cyberkit.win/reference/kql-cheatsheet.md): Kusto syntax for hunting in Defender XDR and Sentinel: operators, time windows, joins, and aggregation.
- [SPL Cheat Sheet](https://www.cyberkit.win/reference/spl-cheatsheet.md): Splunk SPL: search commands, eval functions, stats, and field extraction.
- [SentinelOne Cheat Sheet](https://www.cyberkit.win/reference/s1-cheatsheet.md): SentinelOne Deep Visibility and PowerQuery syntax. Every field name traces to a published source.
- [TLS Fingerprints](https://www.cyberkit.win/reference/tls-fingerprints.md): What JA3 and JA4 identify, and what they cannot tell you.
- [Volatility Plugins](https://www.cyberkit.win/reference/volatility-plugins.md): Volatility 3 plugins, indexed by the question each one answers and where each one misleads.
- [IR Playbooks](https://www.cyberkit.win/reference/ir-playbooks.md): Ransomware, BEC, stolen cloud credentials, and insider theft, written as decisions.
- [Notification Clocks](https://www.cyberkit.win/reference/notification-clocks.md): What starts a breach reporting deadline, not only how long it runs.
- [IR Lifecycle](https://www.cyberkit.win/reference/ir-lifecycle.md): The four NIST SP 800-61 phases, and which pages here serve each one.
- [Order of Volatility](https://www.cyberkit.win/reference/order-of-volatility.md): What to collect first, what it answers, and what collecting it costs.
- [Tool Catalog](https://www.cyberkit.win/reference/tool-catalog.md): Free and open-source DFIR tools, grouped by platform.
- [OSI & TCP/IP Model](https://www.cyberkit.win/reference/osi-model.md): The seven-layer OSI model and the practical four-layer TCP/IP model, what runs at each layer, and the three port ranges.
- [ATT&CK Map](https://www.cyberkit.win/reference/attack-map.md): The MITRE ATT&CK techniques this site covers.
- [Threat Actors](https://www.cyberkit.win/reference/threat-actors.md): Threat actor groups documented by MITRE, with their aliases, techniques, and known tooling.
- [D3FEND Map](https://www.cyberkit.win/reference/d3fend.md): MITRE D3FEND defensive techniques, mapped to ATT&CK.
- [Cyber Kill Chain](https://www.cyberkit.win/reference/kill-chain.md): Lockheed Martin's seven-phase intrusion model, phase by phase, mapped to MITRE ATT&CK where it fits.
- [Pyramid of Pain](https://www.cyberkit.win/reference/pyramid-of-pain.md): David Bianco's six indicator types, from hash values to TTPs, ranked by what each one costs the adversary.

## drills

- [CloudTrail Triage](https://www.cyberkit.win/drills/cloudtrail.md): Read AWS CloudTrail records, and decide what the identity was actually doing.
- [PCAP Triage Drill](https://www.cyberkit.win/drills/pcap.md): Work one capture from scope to beacon through conversations, DNS, HTTP, and TLS. The PCAP tool's own parser checks the answers.
- [Phishing Headers](https://www.cyberkit.win/drills/phishing.md): Pull the deciding values out of raw email headers, and say what they establish.
- [Timeline Reconstruction](https://www.cyberkit.win/drills/timeline.md): Order findings from mixed sources, and say which artifact could answer the question at all.
- [Timestamps](https://www.cyberkit.win/drills/timestamps.md): Read a bare integer for what it is, and say what the wrong epoch would have produced.
- [Collection Order](https://www.cyberkit.win/drills/volatility.md): Order what you collect for a scenario, and say what each choice costs.
- [Linux Triage](https://www.cyberkit.win/drills/linux.md): Read Linux evidence, say who did what, and say what it cannot tell you.
- [Registry Artifacts](https://www.cyberkit.win/drills/registry.md): Say what a Registry finding proves, and what it only appears to prove.
- [Identity Attack Triage](https://www.cyberkit.win/drills/identity-triage.md): Name the identity attack from the logs, then pick the containment that works.
- [Windows Event IDs](https://www.cyberkit.win/drills/event-ids.md): Read a raw Security or Sysmon entry, and pull out the fields triage actually turns on.
- [MITRE ATT&CK](https://www.cyberkit.win/drills/attack.md): Name the technique behind a real, documented procedure, and put an intrusion back in order.
- [Hash Identification](https://www.cyberkit.win/drills/hashing.md): Identify a hash by its length and shape, and sort algorithms by what they are still safe for.
- [RegEx Range](https://www.cyberkit.win/drills/regex.md): Build a working pattern against real sample text, one construct at a time.
- [Subnetting](https://www.cyberkit.win/drills/ip-cidr.md): Work out what a CIDR block actually contains, and which special-use range an address falls in.
- [Decode & Convert Drill](https://www.cyberkit.win/drills/decode.md): Identify an opaque value as a timestamp format or an encoding, then read it. The site's own converter and codecs generate every value.
- [Network Reference Drill](https://www.cyberkit.win/drills/network-ref.md): Quick recall of the ports, HTTP status codes, and DNS record types that come up in triage. The questions come from the same tables as the reference pages.
- [Query Pipeline Drill](https://www.cyberkit.win/drills/query-pipeline.md): Put KQL and SPL pipeline stages in the order that works: filters before aggregations, and sort before truncate.
- [CVSS Scoring Drill](https://www.cyberkit.win/drills/cvss.md): Read a real vulnerability, and pick the eight CVSS v3.1 Base metrics that score it. Every answer is FIRST.org's published vector, scored by the same code as the calculator.
- [YARA Rule Drill](https://www.cyberkit.win/drills/yara.md): Write a YARA rule that matches the right samples and stays quiet on the rest. The YARA Tester's engine grades it live, including samples you never see.
- [Sigma Rules](https://www.cyberkit.win/drills/sigma.md): Write a detection rule that fires on the events that matter and stays quiet on the ones that do not.
- [Terminal Commands](https://www.cyberkit.win/drills/commands.md): Run real investigative commands against a simulated host in bash, cmd, or PowerShell.
- [Threat Actor / APT](https://www.cyberkit.win/drills/threat-actors.md): Resolve aliases and tooling to the group behind them, and tell similar actors apart.