Category
2026-03-01
•
Post Title
Post summary description...
Category Name
Explore articles in this domain
M
SHIELD OF DEFENSE • MAGEN
The Unyielding Digital Defense Shield
Real-Time Threat Hunting & Incident Response
DEFENSE v2.4
PROTECTION ACTIVE
Magen Cybersecurity // Advanced Threat Defense Suite
Empowering SOC analysts, incident responders, and threat hunters with an unyielding security suite: neutralize weaponized IOCs, inspect TLS trust chains, compute cryptographic hashes, audit security headers, calculate CIDR ranges, parse security logs, and forge Sigma & YARA detection rules.
Raw Security Data
Drop security file to load
0 chars | 0 lines
Neutralized Results
0 IOCs Found
Output Stream
Discovered Indicators
No indicators extracted yet.
Scan ID: --
Logged to SQLite DB
Hash Generator & Entropy Analyzer
Enter text and click generate to view hashes.
Hash Type Identifier
Paste a hash to inspect characteristics.
Plaintext Input
XOR Key (Optional):
Docs
HTTP Security Headers & User-Agent Analyzer
Evaluate web server security posture (HSTS, CSP, XFO) and dissect User-Agent strings.
HTTP Response Headers Audit
Paste response headers to inspect security posture.
User-Agent Dissector & Bot Detector
Enter a User-Agent to detect OS, browser, or security scanner.
Inspect TLS certificates, validity countdowns, SANs, full certificate chains, cipher suites, and diagnose self-signed or invalid OT certs.
Quick Presets:
Performing TLS handshake with target socket & extracting X.509 peer state...
Connection / Handshake Failure
Expiration Lifecycle
Valid
Expires in -- days
Trust & Authority
Trusted CA
Standard Root Store
Negotiated TLS Protocol
TLS 1.3
TLS_AES_128_GCM_SHA256
⚡ 0.00 ms handshake
Public Key & Signature
RSA 2048-bit
SHA256-RSA
Diagnostic & Security Analysis
0 FindingsSubject (Issued To)
Issuer (Issued By)
Validity Period & Expiration Timeline
Issued On (NotBefore):
--
Expires On (NotAfter):
--
Remaining Lifespan:
--
Subject Alternative Names (SANs)
Cryptographic Specs & Thumbprints
SHA-256 Fingerprint:
--
SHA-1 Fingerprint:
--
Serial Number (Hex):
--
X.509 Version & Basic Constraints:
--
Key Usages & Extensions:
Revocation & Authority Info Access (AIA):
Peer Certificate Chain Hierarchy
Hierarchical chain presented by the server during TLS handshake (Leaf → Intermediate CAs → Root CA).
OpenSSL Incident Reproduction Command
Run this command on your terminal or jumpbox to verify the TLS handshake manually during an outage:
Leaf Certificate (PEM)
Full Chain (PEM Bundle)
Lightning-fast offline IEEE OUI lookup and OT rogue device detector for air-gapped industrial enclaves, SCADA segments, and SOC incident triage.
Quick Dumps:
Supports 24-bit OUI, 28-bit MAM, 36-bit MAS, dot-notation, hyphen, and raw hex
Total Scanned
0
MACs / Entries
Identified
0
Known IEEE OUIs
Rogue Alerts
0
Critical / High Risk
Randomized LAA
0
Private / Spoofed MACs
Industrial OT
0
SCADA & PLCs
Consumer/Mobile
0
TVs, Phones, Tablets
Filter View:
| Triage / Risk | MAC Address & OUI | Manufacturer / Vendor | Device Classification | Security Assessment / Reason | Actions |
|---|
Convert open Sigma detection rules into native Splunk SPL, KQL, Elastic DSL/Lucene/EQL, QRadar AQL, and craft verified YARA rules.
Worker: Checking...
Sample Rules:
Fast microservice translation powered by pySigma AST parser
Converted SIEM Query
Target: Splunk | Latency: 1.2msNative Pure-Go YARA Rule Generator
Synthesize production-ready YARA rules from string signatures, hex byte patterns, or extracted threat IOCs.
rule.yar
Verified Syntax
| Type | Defanged Value | Original Fanged Value | Logged Date | Copy |
|---|---|---|---|---|
| Loading IOC database records... | ||||
Targeted bitwise decoding and endianness alignment for DNP3 48-bit Time Sync, Modbus 32-bit register pairs (ABCD/CDAB/BADC/DCBA), and IEC 60870-5-104 / IEC 61850 CP56Time2a substation standards.
Substation Clock Sync Analyzer
Quick Presets:
Modbus Holding Register Endianness:
Permutation across 2x 16-bit registers (R1, R2)
Supports: Spaced Hex, 0x Prefixes, Comma Delimited, [R1, R2]
Press Ctrl + Enter to decode
CRITICAL OT TELEMETRY ALERT: UNSYNCHRONIZED SUBSTATION CLOCK (IV=1)
IEC 60870-5-104 / 61850The CP56Time2a IV (Invalid) bit is set to 1 in byte 3. This proves the RTU, protective relay, or substation clock was unsynchronized / free-running when this timestamp was generated. Incident response chronologies must account for local crystal oscillator drift.
Standardized UTC Timestamp (ISO-8601 / RFC 3339)
2026-08-22T19:15:30.500Z
Saturday, Aug 22, 2026 19:15:30.500 UTC
Unix Epoch Time
1787426130500 ms
Epoch Seconds:
1787426130
Protocol Engine
IEC CP56Time2a
Clock Synchronization
Synchronized (IV=0)
Daylight Saving (SU)
Standard Time (SU=0)
Bit-Level Component Breakdown
Parse Cisco, Fortinet, Palo Alto, Juniper, HP/Aruba, Netgear, and TP-Link rulebases. Simulate live 5-tuple traffic flows, evaluate first-match and LPM routing, and detect shadowed, redundant, and overlapping anomalies.
Policy Auditor & Flow Simulator
Sample Presets:
5-Tuple Packet Flow Simulator
Mode:
✓
Evaluation Verdict
PERMITTED
First-Match
Rule #1 Hit
Matched Rule Details
Rule #1
access-list OUTSIDE_IN extended permit tcp 10.0.0.0 0.0.0.255 host 192.168.1.50 eq 443
Evaluation Trace (0 steps)
Total Rules Parsed
0
Shadowed (Dead Rules)
0
Redundant Rules (Bloat)
0
Subnet/Port Overlaps
0
Click "Audit Policy & Detect Anomalies" to inspect rulebase conflicts, shadowed statements, and configuration bloat.
| # | Line | Vendor | Source Subnet | Destination Subnet | Proto | Dst Port | Action | Raw Text |
|---|---|---|---|---|---|---|---|---|
| No parsed rules loaded yet. | ||||||||
Pure-Go & WebAssembly extraction engine for Modbus TCP, DNP3, DNS, HTTP, and secret payload carving.
Capture Ingestion & Hex Dump
Drop .pcap or .pcapng capture to analyze
100% processed locally in your browser memory
0 bytes loaded | No file loaded
Zero telemetry • Air-gapped safe
Engine Execution Mode
Min String Carving Length:
4 chars
Include Raw Packets
Total Packets
0
Capture Volume
0 B
OT SCADA Events
0
0 ALERTS
HTTP Streams
0
DNS Queries
0
Carved Strings
0
0 SECRETS
Modbus TCP (Port 502)
DNP3 (Port 20000)
| # | Protocol | Source -> Destination | Function | Addresses / Unit | Payload Summary | OT Safety Risk |
|---|---|---|---|---|---|---|
| No Modbus or DNP3 frames detected. | ||||||
Docs
Default Credentials & Port Catalog
PURE-GO SQLITE FTS5Air-gapped substation & triage engine: factory defaults, protocol ports, and reverse credential lookup
OFFLINE READY / CACHED
Total Hardware Devices
66
PLCs, RTUs, Switches, BMCs
Factory Accounts
128
Admin, Engineering, Diagnostics
Protocol Port Mappings
180
Modbus, S7, DNP3, CIP, IPMI
Industrial Vendors
22
Siemens, Rockwell, SEL, Moxa...
Quick Filters:
Matching Devices
0 devices
0.00ms
Reverse Credential Hardware Identification
Enter an observed default username and password pair from a triage session, packet capture, or banner grab. The engine will query the embedded index to identify all candidate industrial and enterprise devices that ship with matching factory accounts.
Sample Credential Pairs:
Industrial Port & Protocol Resolution
Resolve a TCP/UDP port number to its canonical industrial automation / IT protocol standard (Modbus, DNP3, EtherNet/IP, S7comm, IPMI, BACnet) and explore all default hardware profiles listening on that port.
Common Industrial Ports:
Docs
JWT Inspector & Security Workbench RFC 7515 / 7519
Dual-execution decoupled decoder, vulnerability scanner (alg: none, key confusion, header injections), cryptographic verifier & offline dictionary cracker.
Zero-Transmission Client Decoding
HMAC / RSA / ECDSA / EdDSA
kid Injection Auditing
Offline Worker-Pool Cracker
Load Preset:
Encoded JSON Web Token (JWT)
3 segments
Header
Payload
Signature
Ready for token input
RFC 7519 Standard Claims & Timeline
NO TOKENIssued At (iat)
--
--
Not Before (nbf)
--
--
Expiration (exp)
--
--
Subject (sub) & Principal
--
Issuer (iss) & Audience (aud)
--
JOSE Header
alg: --
Payload Claims
0 claims
Security Audit & Vulnerabilities
0 Findings
No active vulnerabilities detected or token is empty.
Cryptographic Verification
UNVERIFIEDOffline HMAC Dictionary Cracker
High-throughput Go worker pool dictionary attack
Token Forger & Resigner
Claim TamperModifies Header & Payload in real-time and resigns with a designated key or strips signature.
Docs
Email Auth & Phishing Analyzer
RFC 7208 / 7489 / 6376 Dual-ModeLive DNS resolver and offline static RFC validator for SPF, DMARC, and DKIM public keys. Evaluates lookup limits, key strengths, alignment policies, and generates an automated phishing spoofability assessment matrix.
Quick Selectors:
RFC 7208
RFC 7489
SECURE
Target:
google.com
Queried at: --
Phishing Spoofability Verdict:
Protected: Direct spoofing attempts will be rejected by compliant MTAs.
DNS Lookups (Max 10):
1 / 10
ALL QUALIFIER
~all (SoftFail)
RECORD COUNT
1 record
Deprecated 'ptr' mechanism detected
Mechanisms:
RAW RECORD
--
POLICY (P=)
p=reject
SUBDOMAIN (SP=)
Inherited
Enforcement (pct=):
100%
Alignment:
SPF (relaxed) • DKIM (relaxed)
Aggregate Reports (RUA):
RAW RECORD (_dmarc)
--
Algorithm / Type:
RSA
Key Bit Length:
2048-bit
Testing Mode (t=y):
Disabled (Enforced)
RAW RECORD
--
Protocol Audit Findings
0 Findings
One-Click Remediation Records
Copy and publish these hardened DNS TXT records to achieve DMARC enforcement (p=reject) and prevent domain spoofing.
RECOMMENDED SPF TXT
v=spf1 include:_spf.google.com ~all
RECOMMENDED DMARC TXT (_dmarc)
v=DMARC1; p=reject; pct=100; aspf=r; adkim=r; rua=mailto:dmarc-reports@domain
💡 Tip: Always verify that legitimate third-party transactional email senders (SendGrid, Mailgun, Google Workspace) are included before applying strict reject policies.
Docs
BGP / ASN Route Mapper HYBRID RESOLVER
Team Cymru DNS inversion, RPKI origin validation (ROA), deep RIR RDAP, PeeringDB topology, and infrastructure threat attribution
Sub-millisecond DNS Fast-Path
RPKI Cryptographic ROA
Dual LRU / SQLite Tier
Quick Triage:
AS13335
US
ARIN
CACHED
CLOUDFLARENET
Cloudflare, Inc.
Announced Route
1.1.1.0/24
Cloud Hyperscaler
Risk Score:
20/100
AWS Elastic Compute Cloud & Infrastructure. Traffic represents customer cloud workloads or reverse proxies.
RPKI Origin Validation
VALID
Cryptographically verified ROA matches origin ASN and max prefix length.
Matched ROA:
1.1.1.0/24
Max Permitted Length:
/24
Trust Anchor:
RIPEstat Trust Anchors
Autonomous System Graph & Peering Flow
Target $\rightarrow$ Prefix $\rightarrow$ Origin ASN $\rightarrow$ Tier-1 Upstreams
Target Query
1.1.1.1
announces
BGP Route
1.1.1.0/24
originated by
Origin AS
AS13335
CLOUDFLARENET
transit to
Upstream Transit
Top Transits
Telia, Lumen, NTT
Upstream Transits
0
No direct upstreams reported
Downstream Peers
0
No downstreams reported
IXP Interconnects
0
No public IXPs reported
RDAP Legal & Abuse Contacts
Abuse Contact Email
abuse@domain.com
Abuse Phone / NOC
+1-000-000-0000
Registry Handle
AS13335
Registration Date
2010-07-13
Registered Postal Address
101 Townsend St, San Francisco, CA 94107, US
Global BGP Prefix Telemetry
Total IPv4 Prefixes
1,248
Total IPv6 Prefixes
894
Telemetry Timestamp:
Just now
One-Click Firewall & BGP Mitigation Generator
# iptables drop ruleInspect Complete RouteReport JSON Payload
{}Bulk Fleet & Telemetry Ingestion (Up to 500 Targets)
Paste mixed IPs, CIDRs, and ASNs (one per line). Processed concurrently via Go worker pools.
Concurrency:
Total Targets
0
Resolved
0
Failed / Errors
0
Duration
0ms
Enriched Fleet Table
| Query | ASN | AS Name & Org | Prefix | CC | RPKI | Classification | Action |
|---|
Client-side WebAssembly triage: Shannon entropy profiling, 100+ magic byte carving, extension masquerading & PE cryptor detection.
Sample Presets:
Drag & drop binary or document here, or browse workstation
Supports up to 200 MB files • Parallel 64 KB chunk streaming • Zero cloud leakage
sample.bin
•
0 KB
Reading parallel 64 KB slices...
0%
Analysis Config
Raw Byte Payload Input (Hex / Base64)
Shannon Entropy
0.000
/ 8.0 bits
Carved Format
Unknown
application/octet-stream
Extension Integrity
Verified Match
Claimed: .bin
File Size
0 Bytes
0 sliding blocks
Binary Category
Generic Binary
Rating: Benign
Visual Entropy Density Profile
1 KB Sliding Window
Entropy Curve
7.2 (PE Packing Line)
7.6 (Cryptor / Shellcode Spike)
Min Entropy
0.000
Max Peak Entropy
0.000
Average Density
0.000
Peak Random Offset
0x0000
Magic Byte Carving & Hex Dump
First 32 Bytes
Matched Signature:
PE Executable
Legitimate Entropy Range:
4.5 - 6.8 bits/byte
Standard Extensions:
.exe, .dll, .sys
Heuristic Triage Analysis
0 Rules Evaluated
Cryptographic File Hashes
Forensic Identity
SHA-256 Hash
--
MD5 Hash
--
SNMPv3 Config Linter & Active Prober RFC 3414 / RFC 7860
Dual-engine security auditor: Offline multi-vendor static analysis (Cisco, Fortinet, PAN-OS, SolarWinds Orion) and active UDP 161 network prober with CoPP protection.
NIST SP 800-41 / CIS Controls
FIPS 140-3 Cryptographic Baseline
SolarWinds IT/OT Domain Audit
OASIS SARIF v2.1.0 Export
Load Preset:
Paste Network Configuration or SolarWinds SWQL JSON/CSV:
0 lines
Deterministic AST parsing • Zero credential leakage
Active UDP 161 Network Auditing Safety Notice
Active sweeps validate unauthenticated SNMPv3 USM engine discovery, cipher negotiation, and v1/v2c fallback. To avoid saturating device Route Processors or triggering Control Plane Policing (CoPP), this engine applies a token-bucket rate limiter (5 pps/host). Enable Safe Mode when scanning industrial OT subnets containing legacy RTUs or PLCs.
Timeout:
Critical
0
High
0
Medium
0
Low / Info
0
Approved Baseline
0
Audit Findings & Compliance Scorecard
0 findings| Severity | Rule ID | Finding Description | Location / Target | Standard Reference | Remediation |
|---|
Suricata & Snort Rule Forge AST Engine v1.0
Automated NIDS signature synthesis: Reassembles TCP streams, scores Shannon entropy anchors, isolates fast patterns, and transpiles to Suricata 7, Snort 3, and Snort 2.9 with sandboxed verification.
Universal Intermediate Representation (IR)
ReDoS Guard & Greedy Bounding
Quota: 25 MB Free (200 MB for Paid)
Presets:
0 bytes parsed
Drag and drop .pcap or .pcapng file here
Standard limit: 25 MB • Pro subscribers: up to 200 MB
Dissecting protocols & scoring entropy...
Interactive Hex Stream Inspector
Click/drag bytes to inspect entropy & assign buffers
Selection: 0..0 (0 B)
Entropy: 0.00
Target Sweet Spot
Generated NIDS Signatures
# Output will be generated upon dissection...
Heuristic Anchors & Entropy
0 anchors
Validation & Replay Sandbox
Syntax & AST Linting:
Not Tested
True Positive Replay:
Not Tested
Benign Baseline False Positives:
Not Tested
Latency / Performance Target:
< 50 µs / packet
Ransomware Identifier & IR Triage Offline Engine
Multi-factor confidence scoring across header/footer magic bytes, SQLite FTS5 ransom note full-text search, and normalized extension heuristics.
SQLite FTS5 Porter Stemmer
NoMoreRansom Integration
Header (512B) & Footer (4096B) Slicing
50+ Strains Embedded
Demos:
DYNAMIC ALPHANUMERIC
Supports standard extensions, multi-extension ransomware masks (.id[...].[email].ext), and dynamic 5-10 character victim extensions.
Header Hex (Start of File):
Footer Hex (End of File):
No Forensic Evidence Submitted
Enter an encrypted file extension, paste a ransom note, supply byte markers, or drop an encrypted file to begin multi-factor attribution.
Candidate Family Attributions
Drag and drop an encrypted file here
Reads first 512 bytes (Header) and last 4096 bytes (Footer) directly in browser and queries offline database.
HEADER BYTES (OFFSET 0..512)
FOOTER BYTES (LAST 4096)
| CANONICAL NAME | KNOWN ALIASES | ENCRYPTION DETAILS | DECRYPTOR AVAILABILITY | MITRE ID |
|---|---|---|---|---|
| Loading catalog... | ||||
Drop suspicious document here, or browse files
Supports OLE2 (.doc, .xls, .ppt), OOXML (.docm, .xlsm, .pptm), and RTF (up to 32MB)
100% Network Air-Gapped
Memory-Safe Sandbox
Zip Bomb Defense
Load Verified Test Fixtures:
MALICIOUS
OLE2/CFBF
2.5 KB
sample_document.docm
Analysis summary and verdict description.
Risk Score
85/100
MD5:
...
SHA1:
...
SHA256:
...
Streams
0
Macros
0
Carved Objects
0
External Targets
0
Duration
0 ms
No heuristic threats detected in this document.
Select Module:
Module1
VBA
Decompressed Stream View
No embedded binaries or \x01Ole10Native packages carved from this document.
| # | Label / Filename | Magic Type | Payload Size | SHA-256 Digest | Actions |
|---|
| Path / Name | Size | Entropy | MIME Type | Header Preview | Action |
|---|
Stream:
Byte Offset | Hex Dump (16B) | ASCII Representation
MAGEN CYBER DEFENSE PLATFORM
22 High-Performance Security Tools
About Magen Cybersecurity & Defense Suite
Magen (Hebrew for Shield) is an advanced, unified cyber defense, threat intelligence, and digital forensics workstation. Built for Security Operations Center (SOC) analysts, incident responders, threat hunters, penetration testers, and Operational Technology (OT/ICS) plant engineers, Magen delivers instant, sub-millisecond security operations with zero data leakage, air-gapped readiness, and uncompromising cryptographic rigor.
22
Specialized Tools
0 ms
Local WASM Triage
100%
Client-Side Privacy
PWA
Air-Gapped Offline
Client-Side WebAssembly (WASM)
Computationally heavy operations—such as PCAP packet dissection, Shannon binary entropy computation, and file signature carving—run client-side via compiled WebAssembly and Web Workers. Packet streams and proprietary binaries never leave your local browser sandbox.
Zero-Knowledge & Air-Gapped Ready
Magen is engineered with an offline-first architecture. It features service-worker caching, local SQLite indexing via FTS5, and zero third-party telemetry, allowing full deployment in isolated nuclear plants, defense environments, or sea vessels.
Concurrent Pure-Go Microservice
When live network handshakes are required (e.g. SNI certificate inspection, BGP ASN RDAP resolution, Team Cymru DNS queries), our Go backend leverages goroutines and non-blocking sockets to complete audits in under 5 milliseconds.
Jump to Security Domain:
Threat Intelligence, Detection & Incident Triage
Tools designed for active indicator extraction, rule compilation, and indicator vault management
Threat Intel & Defense
IOC Defanger & Extractor
Safely extracts, neutralizes (defangs), and restores (refangs) suspicious Indicators of Compromise (IOCs) across raw text, phishing emails, malware logs, and forensic artifacts. Defanging replaces live protocols and dots with harmless brackets (e.g., hxxps[://]malware[.]site) to prevent accidental execution, malicious web browser clicks, or automated link preview expansion in communication platforms.
Key Capabilities & Specifications:
- ReDoS-Safe Linear Extraction: High-speed parsing resistant to Regular Expression Denial of Service.
- Bidirectional Processing: Defang raw URLs/IPs or refang previously sanitized indicators for active sandbox detonation.
- Multi-Entity Support: Dissects IPv4, IPv6, FQDNs, URLs (
http,https,ftp), and email addresses. - Multi-File Batch Ingestion: Drag-and-drop support for raw text, log files, and bulk email dumps with automatic deduplication.
Route: /tools/ioc-defanger
Launch Tool
Detection Engineering
Sigma to SIEM & YARA Studio
Universal detection engineering studio that bridges the gap between generic Sigma detection rules and enterprise SIEM/EDR platforms. In addition, the integrated YARA Studio allows threat hunters to craft and generate custom binary and memory detection signatures using plain strings, hexadecimal sequences, wildcards, and compound boolean condition logic.
Key Capabilities & Specifications:
- pySigma Multi-Backend Compiler: Converts Sigma YAML into Splunk SPL, Microsoft Sentinel/Defender KQL, Elastic DSL/Lucene/EQL, and IBM QRadar AQL.
- Automated Pipeline Mapping: Built-in translation pipelines for Windows Event Logs, Sysmon, Linux auditd, and cloud audit trails.
- Custom YARA Rule Generator: Visual rule builder supporting ASCII strings, wide strings, case-insensitive tokens, and hex jumps.
- Rule Validation: Live syntax checks ensuring clean compilation before production deployment.
Route: /tools/sigma-converter
Launch Tool
Threat Intel Repository
Threat Database (IOC Vault)
Centralized local SQLite repository and threat intelligence vault that indexes, stores, filters, and correlates all indicators extracted across your investigation sessions. Designed for persistent case management and rapid correlation across multi-day incident response engagements.
Key Capabilities & Specifications:
- High-Performance SQLite Backend: Indexed lookups across millions of IOCs with sub-millisecond query execution.
- Granular Filtering: Filter by indicator classification (IPv4, IPv6, Domain, URL, Hash, Email), threat score, tags, and timestamp.
- Audit & Scan History: Historical record of defanger, certificate, and header audits for chain-of-custody compliance.
- SIEM & CSV Export: Export curated indicator lists in standardized CSV format for firewall blocklists or SIEM feed ingestion.
Route: /tools/database
Launch Tool
OT & Asset Hardening
Default Credentials & Port Catalog
Offline database and reverse-lookup directory of factory default passwords, management ports, and service mappings for industrial automation hardware (PLCs, RTUs, SCADA human-machine interfaces), enterprise network switches, firewalls, and server Baseboard Management Controllers (iLO/iDRAC).
Key Capabilities & Specifications:
- SQLite FTS5 Full-Text Search: Instant fuzzy and exact matching across thousands of vendor models and credential sets.
- Reverse Credential Lookup: Discover which devices match a captured password or default username during penetration testing.
- Industrial & IT Port Directory: Protocol resolution for standard IT services (SSH, RDP, HTTPS) and OT protocols (Modbus 502, DNP3 20000, EtherNet/IP 44818, BACnet 47808).
- 100% Air-Gapped Operation: Self-contained catalog operable in disconnected nuclear, maritime, or defense networks.
Route: /tools/default-creds
Launch Tool
NIDS Signature Automation
Suricata & Snort Rule Forge
Automate NIDS signature generation from PCAP captures, hex streams, and PCRE with real-time AST transpilation between Suricata 7, Snort 3, and Snort 2.9. Features fast_pattern hardware acceleration, Shannon entropy payload scoring, and sandboxed test replay.
Key Capabilities & Specifications:
- Multi-Dialect AST Transpiler: Seamless bidirectional conversion across Suricata 7, Snort 3, and legacy Snort 2.9 engines.
- Automated PCAP Extraction: Ingest .pcap captures to automatically synthesize flow options, ports, and content patterns.
- Hyperscan Fast Pattern Tuning: Recommends optimal, lowest-entropy substrings to maximize engine throughput.
- ReDoS & Backtracking Protection: Static analyzer warns against high-risk regular expressions before sensor deployment.
Route: /tools/rule-forge
Launch Tool
Cryptography, Payloads & Token Auditing
Tools for cryptographic hash generation, payload deobfuscation, and JWT vulnerability testing
Cryptography
Hash Generator & ID
Multi-algorithm cryptographic hashing utility, file digest calculator, and automated unknown hash identification engine with Shannon entropy scoring.
Key Features:
- Simultaneous Hashes: MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, and Windows NTLM.
- Hash Auto-Detection: Identifies 50+ hash formats including bcrypt, Argon2, PBKDF2, MySQL, and LM/NT hashes.
- Entropy Metrics: Calculates Shannon entropy to distinguish plaintext from encrypted/random data.
/tools/hash-tool
Launch
Payload Deobfuscation
Payload Encoder / Decoder
CyberChef-style payload transformation workbench for dissecting obfuscated malware commands, shellcode, and web exploit injection strings.
Key Features:
- Multi-Format Transformations: Standard & URL-safe Base64, Hex, URL encoding, HTML entities, ROT13, and raw binary.
- XOR Cipher Engine: Single-byte and multi-byte XOR encryption/decryption with key bruteforcing.
- Cyber Defense Triage: Unpacks multi-stage PowerShell, Bash, and JavaScript obfuscated dropper payloads.
/tools/encoder-decoder
Launch
Identity & Auth Auditing
JWT Inspector Workbench
Dual-execution JSON Web Token security inspector, vulnerability scanner, cryptographic verifier, and offline secret key dictionary cracker.
Key Features:
- Vulnerability Linter: Detects
alg:none(CVE-2015-9235), HMAC/RSA key confusion, weak secrets, and injection flaws. - Crypto Verification: HMAC (HS256/384/512), RSA (RS256/384/512), ECDSA (ES256/384/512), and EdDSA.
- Offline Cracker & Forger: High-speed dictionary secret recovery and modified claim forgery simulation.
/tools/jwt-inspector
Launch
Network Security, Reconnaissance & Routing Defense
Tools for IP subnetting, BGP/ASN routing intelligence, multi-vendor firewall ACL audit, and rogue MAC detection
Network Engineering
CIDR & Subnet Calculator
Comprehensive IPv4 and IPv6 subnetting workbench that calculates network boundaries, broadcast addresses, usable host ranges, binary representations, wildcard masks, and hierarchical subnet division trees.
Key Capabilities & Specifications:
- Dual IPv4/IPv6 Support: Full support for IPv4 (/0 to /32) and IPv6 (/0 to /128) prefix lengths.
- RFC Classifications: Instant detection of RFC 1918 Private, RFC 6598 CGNAT, Loopback, Link-Local, and Multicast blocks.
- Subnet Division Tree: Interactive network splitting tool for architecting zero-trust zones and DMZs.
- Binary & Wildcard Masks: Outputs Cisco-style wildcard masks and bitwise binary strings.
Route: /tools/cidr-calculator
Launch Tool
Infrastructure Intelligence
BGP / ASN Route Mapper
Ultra-fast IP-to-Autonomous System Number (ASN) mapping and routing intelligence workbench. Integrates Team Cymru DNS resolutions, RPKI origin validation (ROA), Regional Internet Registry (RIR) RDAP records, PeeringDB facility peering, and automated firewall rule generation.
Key Capabilities & Specifications:
- Team Cymru DNS & RDAP: Sub-millisecond ASN, BGP prefix, country code, and registry allocation lookups.
- RPKI ROA Validation: Cryptographic origin validation to detect BGP hijacking and route leaks (Valid / Invalid / NotFound).
- Bogon IP Detection: Flags unallocated, reserved, and private IP blocks in external threat feeds.
- Firewall Generator: Generates ready-to-deploy blocklists for Linux iptables, Cisco ACLs, and Juniper JunOS.
Route: /tools/bgp-mapper
Launch Tool
Firewall Policy Audit
Firewall ACL & Policy Anomaly Engine
Multi-vendor firewall configuration parser, 5-tuple packet flow simulator, and policy anomaly detection engine. Dissects complex enterprise rulebases to identify security vulnerabilities, misconfigurations, and rule bloat.
Key Capabilities & Specifications:
- Multi-Vendor Parser: Native support for Cisco IOS/ASA, Fortinet FortiOS, Palo Alto PAN-OS, Juniper JunOS, HP/Aruba, Netgear, TP-Link, and CSV rulebases.
- 5-Tuple Flow Simulator: Evaluates exact packet paths using Longest Prefix Matching (LPM) and port range resolution.
- Automated Anomaly Audit: Flags Shadowed rules (never reached), Redundant rules (duplicate actions), and Overlapping rules.
- Air-Gapped Audit: Zero network transmission ensures confidential security architectures remain strictly offline.
Route: /tools/acl-checker
Launch Tool
Asset Discovery & OT Triage
MAC OUI & OT Device Mapper
Zero-allocation, in-memory MAC Organizationally Unique Identifier (OUI) lookup and rogue device detection engine tailored for air-gapped industrial automation networks (ICS/SCADA), smart grid substations, and enterprise SOC network triage.
Key Capabilities & Specifications:
- In-Memory Hardware Catalog: Instantly resolves IEEE OUI prefixes (MA-L 24-bit, MA-M 28-bit, MA-S 36-bit) to vendor names.
- OT/ICS Vendor Fingerprinting: Prioritizes industrial vendors including Siemens, Rockwell Automation, Schneider Electric, ABB, Yokogawa, and Phoenix Contact.
- LAA & MAC Randomization Detection: Automatically flags Locally Administered Addresses (LAA) used in MAC spoofing or mobile device randomization.
- Batch Processing: Ingest bulk ARP tables or DHCP snooping logs for automated asset classification.
Route: /tools/mac-lookup
Launch Tool
Network Device Hardening
SNMPv3 Config Linter & Active Prober
Dual-engine offline configuration linter and active UDP 161 network auditor. Evaluates Cisco, Fortinet, Palo Alto, and SolarWinds SNMP configurations against NIST SP 800-41 and CIS controls, detecting plaintext SNMPv1/v2c fallback, weak MD5/DES ciphers, and unauthenticated engine exposure.
Key Capabilities & Specifications:
- Multi-Vendor Parser: Static AST validation for Cisco IOS/XE/XR, FortiOS, PAN-OS, and SolarWinds Orion.
- USM Cryptographic Verification: Enforces authPriv baseline with SHA-256+ and AES-128/256 ciphers.
- Active UDP Prober: Probes target IP:161 for public community strings and discovery engine ID responses.
- Zero Network Leakage: Offline linter runs locally with zero external telemetry.
Route: /tools/snmp-lint
Launch Tool
Web Application Security & Transport Layer Auditing
Tools for HTTP security header inspection, SSL/TLS certificate chain auditing, and email authentication linter
Web Security
Header & User-Agent
Audits HTTP response security headers for OWASP compliance and dissects User-Agent strings to flag web scrapers, bots, and vulnerability scanners.
Key Features:
- Security Header Audit: Evaluates HSTS, CSP, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
- Bot & Scanner Heuristics: Dissects User-Agents for sqlmap, nikto, curl, headless Chrome, and crawler signatures.
- Remediation Guidance: Actionable configuration snippets for Nginx, Apache, and Cloudflare.
/tools/header-analyzer
Launch
Transport Layer
SSL/TLS Cert Checker
Inspects live and offline X.509 TLS/SSL certificates, validity countdowns, Subject Alternative Names (SANs), trust chains, and cipher suite support.
Key Features:
- Complete Chain Analysis: Inspects Root, Intermediate, and Leaf certificates with thumbprint verification.
- Protocol & Cipher Negotiation: Assesses TLS 1.2/1.3 protocol versions and identifies weak legacy ciphers.
- OT/SCADA Diagnostics: Identifies self-signed, untrusted, or expired industrial control system certs.
/tools/cert-checker
Launch
Anti-Phishing
Email Auth & Phishing
Live DNS resolver and static RFC record linter for SPF (RFC 7208), DMARC (RFC 7489), and DKIM (RFC 6376) with automated spoofability risk scoring.
Key Features:
- SPF Lookups (RFC 7208): Recursively evaluates DNS lookup depth against the RFC 10-lookup void limit.
- DMARC Policy Enforcement: Analyzes
p=reject/quarantine/noneand alignment modes (aspf,adkim). - Spoofability Risk Matrix: Evaluates whether an attacker can forge emails impersonating the domain.
/tools/email-auth
Launch
Industrial OT/SCADA, Packet Forensics & Binary Analysis
Tools for SCADA telemetry timestamps, in-browser PCAP dissection, and binary file entropy carving
Industrial ICS/SCADA
OT Timestamp Decoder
Specialized ICS/SCADA telemetry timestamp converter for incident reconstruction across power grids, water treatment plants, and industrial substations.
Key Features:
- DNP3 48-bit Time Sync: Decodes 6-byte millisecond offsets since Unix epoch.
- Modbus Register Permutations: ABCD (Big-Endian), CDAB (Word Swap), BADC (Byte Swap), and DCBA (Little-Endian).
- CP56Time2a (IEC 60870-5-104 / 61850): 7-byte substation timestamps with Daylight Saving (SU) and Invalid Clock (IV) telemetry flags.
/tools/ot-time
Launch
Packet Dissection
PCAP & OT/IT Dissector
Zero-dependency packet capture analysis and protocol dissector powered by client-side WebAssembly for safe inspection without Wireshark dependencies.
Key Features:
- PCAP & PCAPNG Dissection: Ethernet, IPv4, IPv6, TCP, UDP, Modbus TCP, DNP3, DNS, and HTTP traffic.
- Sensitive String Carving: Automated extraction of cleartext passwords, API keys, endpoints, and bearer tokens.
- WASM Offline Privacy: Captures never leave your browser memory.
/tools/pcap-extractor
Launch
Malware & Forensics
File Entropy & Magic Bytes
Client-side binary forensics analyzer running via WebAssembly and Web Workers to detect packed executables, ransomware payloads, and file masquerading.
Key Features:
- Shannon Entropy Sliding Window: Visual interactive entropy curve mapping encrypted or packed sections (UPX, PE cryptors).
- 100+ Magic Byte Catalog: Carves headers and detects file extension masquerading attacks (e.g. executable disguised as PDF).
- Forensic Checksums: Instant SHA-256 and MD5 hash generation with zero server upload.
/tools/file-entropy
Launch
Incident Triage
Ransomware Identifier & IR
Offline-first ransomware strain identification via multi-factor confidence scoring across header/footer byte markers, SQLite FTS5 ransom note full-text search, and normalized extension matching.
Key Features:
- Multi-Factor Correlation: Evaluates extensions, note contents, and binary markers simultaneously.
- Decryptor Availability: Instantly cross-references No More Ransom public decryptor solutions.
- Threat Actor Attribution: Maps identified strains to MITRE ATT&CK techniques and incident runbooks.
/tools/ransom-id
Launch
Document Forensics
Maldoc Extractor & WASM
In-browser, zero-dependency malicious document extractor running inside an air-gapped WebAssembly sandbox. Decompresses OLE2/CFBF, OOXML, MS-OVBA VBA macros, BIFF8 Excel 4.0 XLM formulas, and carves \x01Ole10Native binaries.
Key Features:
- MS-OVBA & XLM Decompressor: Extracts and highlights obfuscated macros and hidden sheet formulas.
- Ole10Native Binary Carving: Carves embedded executables and DLLs with sanitized ZIP export.
- 100% Air-Gapped WASM: Analyzes weaponized documents safely without Office API execution.
/tools/maldoc-extractor
Launch
Magen Cybersecurity Platform
MITRE ATT&CK • NIST 800-82 • Zero-Knowledge Air-Gapped Ready
MAGEN DEFENSE MANUAL & RFC SPECIFICATIONS
22 Dedicated Tool Manuals
Magen Cybersecurity Tool Documentation & User Guide
Comprehensive operational manual, RFC standards, input specifications, security interpretation guides, and privacy guarantees for every tool in the Magen Defense Suite.
Tool Manuals
22 / 22
IOC Defanger & Extractor
ReDoS Safe RFC 3986 / NIST SP 800-61
Threat Intel & Defense
•
Route:
#tools/ioc-defanger
Executive Summary: Safely sanitize, defang, and reconstruct indicators of compromise (IPv4, IPv6, URLs, FQDNs, emails, hashes, CVEs) with linear-time deterministic regex parsing to eliminate ReDoS vulnerabilities.
Operational Context & Threat Landscape
When sharing threat intelligence across ticketing platforms (Jira, ServiceNow), chat systems (Slack, Teams), email, or documentation, live malicious URLs and IP addresses can accidentally trigger automated crawlers, link prefetchers, or accidental analyst clicks. Defanging neutralizes active indicators into inert representations (e.g. replacing 'http://' with 'hxxp://' and '.' with '[.]'). Magen employs a ReDoS-safe linear regex engine that guarantees bounded-time parsing even against multi-megabyte adversarial payloads.
Key Capabilities
- • Defangs & refangs IPv4, IPv6, URLs, hostnames, email addresses, hashes, and CVEs
- • Linear-time deterministic regex extraction with zero catastrophic backtracking
- • Batch processing of multi-paragraph incident reports, emails, and raw logs
- • Instant CSV and JSON structured exports for SIEM and firewall ingestion
- • Selective IOC type filtering (toggle IPs, Domains, URLs, Hashes, Emails independently)
Step-by-Step Usage Workflow
- 1 Paste raw incident text, threat report, phishing email body, or log extract into the input field.
- 2 Choose between 'Defang Mode' (to sanitize active indicators) or 'Refang Mode' (to restore neutralized indicators for live sandboxing).
- 3 Click 'Defang & Extract IOCs'. The engine will parse and categorize every indicator.
- 4 Review categorized indicators in the structured table or copy the sanitized raw text block.
- 5 Click 'Export CSV' or 'Export JSON' to download structured intelligence.
Input Syntax & Sample Data
Free-form text, security advisories, emails, JSON dumps, or comma/newline-separated IOC lists.Subject: URGENT: Ransomware Delivery Detected From: billing@invoice-malicious-update.com We observed outbound C2 traffic to http://malicious-c2-server.evil.ru/payload.exe Originating IP: 185.220.101.5 and secondary gateway 192.168.1.100. Dropped binary SHA256: 2c54f6b53a4c0288b50d640b61d0b81333d66a6c500000000000000000000000 Related vulnerability: CVE-2024-3400.
Output Interpretation & Remediation Guidance
Categorized IOCs: - URLs: hxxp://malicious-c2-server[.]evil[.]ru/payload[.]exe - Domains: invoice-malicious-update[.]com, malicious-c2-server[.]evil[.]ru - IPv4: 185[.]220[.]101[.]5 (Public C2), 192[.]168[.]1[.]100 (RFC 1918 Private) - Emails: billing[@]invoice-malicious-update[.]com - Hashes: 2c54f6b53a4c0288b50d640b61d0b81333d66a6c500000000000000000000000 (SHA-256) - CVEs: CVE-2024-3400
Review extracted indicators against internal EDR and firewall logs. Use defanged representations in ticketing notes to prevent link detonation. Public IPs should be checked against threat intel feeds; private RFC 1918 IPs represent compromised internal hosts requiring immediate forensic isolation.
Zero-Knowledge Guarantee: All parsing is executed 100% in client-side memory. Sensitive victim hostnames or internal IP addresses are never transmitted to third parties.
Ready to inspect or execute with this tool?
Open IOC Defanger & Extractor
Hash Generator & Identifier
Cryptographic Integrity FIPS 180-4 / FIPS 202 / RFC 1321
Cryptography & Hashes
•
Route:
#tools/hash-tool
Executive Summary: Simultaneously compute MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, and NTLM hashes, calculate Shannon entropy, and auto-detect unknown hash algorithms.
Operational Context & Threat Landscape
Digital forensics and incident response rely heavily on cryptographic checksums to establish evidence chain-of-custody, detect binary tampering, and correlate malware samples against threat intelligence repositories like VirusTotal. Identifying unknown hash formats (e.g. Bcrypt, NTLM, MD5, SHA-256) is vital during credential audits and memory dump triage.
Key Capabilities
- • Simultaneous real-time calculation of 8 cryptographic hashing algorithms
- • Shannon entropy score calculation ($H = 0.0$ to $8.0$) to spot randomness/encryption
- • Live hash comparison tool with instant match confirmation and bit difference alerts
- • Algorithmic reverse identifier recognizing 20+ hash structures (Bcrypt, NTLM, SHA-family, MD5)
- • NTLM (MD4-based) Windows authentication hash generator for pass-the-hash audits
Step-by-Step Usage Workflow
- 1 Type or paste any plaintext string, password, or encoded token into the Input String box.
- 2 View all 8 generated hash algorithms instantly updated in real-time.
- 3 To verify file or message integrity, paste the expected hash into the 'Compare / Verify Hash' field.
- 4 To identify an unknown hash from a dump, paste it into the 'Hash Identifier' box and click 'Identify Hash'.
Input Syntax & Sample Data
Plaintext string, byte stream, or hex-encoded hash string for reverse lookup.admin@magen-defense-system-2026
Output Interpretation & Remediation Guidance
- MD5: 5d41402abc4b2a76b9719d911017c592 - SHA-1: 7c4a8d09ca3762af61e59520943dc26494f8941b - SHA-256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 - SHA-512: cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e - NTLM: 31d6cfe0d16ae931b73c59d7e0c089c0 - Shannon Entropy: 4.12 bits/char
SHA-256 and SHA-512 are industry standards for malware correlation and code signing. MD5 and SHA-1 should not be used for cryptographic signatures due to collision attacks (RFC 6151), but remain common for legacy file indexing. NTLM hashes are vulnerable to pass-the-hash and offline cracking.
Zero-Knowledge Guarantee: All hash computations and entropy estimations occur locally in your browser session. Passwords and sensitive tokens are never transmitted across the network.
Ready to inspect or execute with this tool?
Open Hash Generator & Identifier
CIDR & Subnet Calculator
IPv4 / IPv6 Dual-Stack RFC 4632 / RFC 4291 / RFC 1918
Network & Recon
•
Route:
#tools/cidr-calculator
Executive Summary: Decompose IPv4 and IPv6 network prefixes, compute network boundaries, broadcast addresses, usable host capacities, wildcard masks, binary netmasks, and RFC classifications.
Operational Context & Threat Landscape
Network micro-segmentation, firewall rule authoring, and penetration test scope validation depend on precise subnet boundaries. Miscalculating a CIDR boundary can lead to unintentional scanning of out-of-scope production assets or creating overly permissive firewall rules allowing lateral movement.
Key Capabilities
- • Dual-stack IPv4 (CIDR /0 to /32) and IPv6 (/0 to /128) subnet decomposition
- • Calculates Network Address, Broadcast Address, First/Last Usable Hosts, and Total Host counts
- • Cisco ACL wildcard mask generation (inverted subnet mask)
- • Visual 32-bit binary netmask division highlighting Network vs Host bits
- • RFC Classification: RFC 1918 Private, RFC 3927 Link-Local, RFC 4193 ULA, Multicast, Loopback
Step-by-Step Usage Workflow
- 1 Enter an IPv4 CIDR (e.g. '10.240.0.0/21') or IPv6 CIDR (e.g. '2001:db8::/64') into the CIDR input field.
- 2 Alternatively, use the quick preset buttons for Class C /24, Class A /16, or IPv6 /64.
- 3 Inspect the computed network summary card, usable host range, and binary bit distribution.
- 4 Copy the Wildcard Mask for Cisco/Juniper firewall configurations or the Usable Host Range for Nmap/Masscan scope definitions.
Input Syntax & Sample Data
Valid CIDR string: 'IP/prefix' (e.g., '192.168.10.0/24', '172.16.0.0/12', '10.0.0.0/8', '2001:db8:acad::/48').10.240.0.0/21
Output Interpretation & Remediation Guidance
- Network Address: 10.240.0.0 - Broadcast Address: 10.240.7.255 - Usable Host Range: 10.240.0.1 - 10.240.7.254 - Total Hosts: 2,048 - Usable Hosts: 2,046 - Subnet Mask: 255.255.248.0 - Wildcard Mask: 0.0.7.255 - Scope: RFC 1918 Private Network - Binary Mask: 11111111.11111111.11111000.00000000
Use the Usable Host Range to restrict automated vulnerability scanners. Use the Wildcard Mask directly in Cisco access-list commands. Notice that /31 subnets (RFC 3021) are designated for point-to-point links and have 2 usable addresses with no broadcast address.
Zero-Knowledge Guarantee: Zero network requests. All subnet mathematics are executed entirely in your browser using bitwise logic.
Ready to inspect or execute with this tool?
Open CIDR & Subnet Calculator
Payload Encoder / Decoder
Multi-Layer Transformer RFC 4648 / RFC 3986
Encoders & Obfuscation
•
Route:
#tools/encoder-decoder
Executive Summary: Multi-format CyberChef-style transformer for Base64, Hexadecimal, URL encoding, HTML entities, ROT13, Binary bitstreams, and single/multi-byte XOR ciphers.
Operational Context & Threat Landscape
Adversaries constantly obfuscate command-line arguments, PowerShell scripts, web shells, and C2 beacons using multi-layered encoding schemes (e.g. Base64 inside URL-encoding, or XOR with a static 1-byte key). Rapid deobfuscation is critical for security analysts decoding exploit payloads in proxy logs, web application firewalls (WAF), and endpoint telemetry.
Key Capabilities
- • Encodes & decodes Base64, Base64URL, Hexadecimal (raw, space, 0x, \x), URL (RFC 3986), HTML entities, ROT13, and 8-bit Binary
- • Single-byte and multi-byte XOR cipher encryption/decryption with key brute-forcing
- • Auto-detection heuristic engine identifying encoding schemes automatically
- • Multi-stage pipeline chaining for nested or obfuscated malware payloads
- • Preserves raw byte values and displays printable ASCII with non-printable hex indicators
Step-by-Step Usage Workflow
- 1 Paste encoded or obfuscated text into the Input Payload area.
- 2 Select the source transformation (e.g. 'Base64 Decode', 'Hex Decode', 'URL Decode', 'XOR Decrypt').
- 3 If using XOR, provide the secret key in ASCII or Hex notation.
- 4 Click 'Transform Payload' or use the auto-detect function to view decoded output.
- 5 Use the 'Chain to Input' button to perform secondary decoding passes on nested payloads.
Input Syntax & Sample Data
Raw strings, Base64 strings, Hex dumps, URL-encoded query strings, or binary text.cG93ZXJzaGVsbC5leGUgLW5vcCAtZSAgLVdjIFtoaWRkZW5d
Output Interpretation & Remediation Guidance
powershell.exe -nop -e -Wc [hidden]
Look for secondary encoding inside the output (such as another Base64 blob following `-e` or `-EncodedCommand`). In PowerShell, encoded commands are UTF-16LE formatted. In XOR analysis, look for common plaintext markers such as 'MZ', 'HTTP', 'cmd.exe', or 'This program cannot be run in DOS mode'.
Zero-Knowledge Guarantee: All decoding and cryptographic transforms run in client-side memory. Sensitive payload data is never sent to remote servers.
Ready to inspect or execute with this tool?
Open Payload Encoder / Decoder
HTTP Header & User-Agent Analyzer
OWASP Posture Audit RFC 6797 / RFC 7230 / OWASP Top 10
Web & Security Auditing
•
Route:
#tools/header-analyzer
Executive Summary: Audit HTTP response security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy, CORS) and dissect User-Agent strings for vulnerability scanners and bots.
Operational Context & Threat Landscape
Missing security headers expose web applications to Clickjacking, cross-site scripting (XSS), MIME-type confusion attacks, and insecure transport downgrade. Furthermore, web server access logs often contain spoofed or automated User-Agents from vulnerability scanners (Nmap, Nikto, Sqlmap, Burp Suite) that SOC analysts must identify quickly.
Key Capabilities
- • Deep audit of HSTS, Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy
- • Comprehensive Security Grade calculation (A+ to F) with detailed remediation recommendations
- • Detects dangerous header disclosures (Server, X-Powered-By, X-AspNet-Version)
- • User-Agent dissection identifying browser engine, OS architecture, bot type, and scanner fingerprints
- • Pre-configured OWASP-compliant secure configuration templates ready to copy into Nginx/Apache
Step-by-Step Usage Workflow
- 1 To analyze headers: Paste raw HTTP response headers into the 'HTTP Response Headers' tab.
- 2 To analyze a User-Agent: Paste the User-Agent string into the 'User-Agent Dissector' tab.
- 3 Click 'Audit Headers' or 'Dissect User-Agent'.
- 4 Review the calculated security grade, pass/fail status for each security header, and highlighted vulnerabilities.
- 5 Copy the recommended hardened headers into your reverse proxy configuration.
Input Syntax & Sample Data
Raw HTTP header text (key: value pairs) or a single User-Agent string.HTTP/1.1 200 OK Server: Apache/2.4.41 (Ubuntu) X-Powered-By: PHP/7.4.3 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Type: text/html; charset=UTF-8
Output Interpretation & Remediation Guidance
Security Grade: C+ (Moderate Risk) - HSTS: PASS (max-age=31536000, includeSubDomains) - X-Frame-Options: PASS (SAMEORIGIN) - Content-Security-Policy (CSP): FAIL (Missing - High XSS Exposure) - X-Content-Type-Options: FAIL (Missing 'nosniff') - Information Disclosure Warning: 'Server' and 'X-Powered-By' leak exact OS and PHP version.
Immediately add 'Content-Security-Policy' and 'X-Content-Type-Options: nosniff'. Strip the 'Server' and 'X-Powered-By' headers in your reverse proxy to prevent automated vulnerability scanners from targeting known PHP/Apache CVEs.
Zero-Knowledge Guarantee: Header text and User-Agent strings are evaluated purely in-browser.
Ready to inspect or execute with this tool?
Open HTTP Header & User-Agent Analyzer
SSL/TLS Certificate Quick-Checker
X.509 Cryptography RFC 5280 / RFC 8446
Network & Recon
•
Route:
#tools/cert-checker
Executive Summary: Inspect X.509 TLS certificates, validity countdowns, Subject Alternative Names (SANs), full trust chains, negotiated cipher suites, and diagnose self-signed or OT certificates.
Operational Context & Threat Landscape
Expired or misconfigured TLS certificates cause catastrophic service outages, break encrypted telemetry pipelines, and expose users to man-in-the-middle (MITM) attacks. In industrial OT/SCADA environments, plant gateways often use self-signed certificates or private CAs that require specific certificate thumbprint validation.
Key Capabilities
- • Full X.509 certificate parsing: Subject DN, Issuer DN, Serial Number, Signature Algorithm, Key Length
- • Subject Alternative Name (SAN) extraction for infrastructure and subdomain asset discovery
- • Live Days-Until-Expiry countdown timer with color-coded warning thresholds
- • TLS Version & Cipher Suite negotiation analysis (identifies weak DES/3DES/RC4/CBC ciphers)
- • Certificate Chain inspection and OT self-signed certificate fingerprinting
Step-by-Step Usage Workflow
- 1 Enter a target domain or IP and port (e.g. 'cloudflare.com:443' or '192.168.10.50:8443').
- 2 Alternatively, paste a raw PEM-encoded certificate block (`-----BEGIN CERTIFICATE-----...`).
- 3 Click 'Check Certificate'.
- 4 Inspect the validity dates, issuer authority, SAN list, and security warnings.
- 5 Verify the SHA-256 certificate fingerprint against your known infrastructure baseline.
Input Syntax & Sample Data
Hostname/IP:Port (e.g. 'google.com:443') or PEM-encoded X.509 certificate text.magen-defense.internal:443
Output Interpretation & Remediation Guidance
- Common Name (CN): magen-defense.internal - Issuer: Let's Encrypt Authority X3 / Private Root CA - Valid From: 2026-01-01 00:00:00 UTC - Valid To: 2026-12-31 23:59:59 UTC (130 days remaining) - Subject Alternative Names (SANs): magen-defense.internal, *.magen-defense.internal, api.magen-defense.internal - Key: RSA 2048-bit (SHA-256 with RSA) - SHA-256 Fingerprint: 3e9d8f... - Status: VALID / TRUSTED
Ensure certificates with under 30 days remaining are renewed immediately. Check SANs to uncover shadow infrastructure or unexpected aliases. For OT devices, compare the SHA-256 fingerprint with the factory-provisioned key to detect rogue rogue MITM proxies.
Zero-Knowledge Guarantee: Remote TLS queries establish a direct connection without logging or storing certificate details.
Ready to inspect or execute with this tool?
Open SSL/TLS Certificate Quick-Checker
MAC OUI & OT Rogue Device Mapper
IEEE OUI Database IEEE 802 / IEEE 802.1Q
Network & Recon
•
Route:
#tools/mac-lookup
Executive Summary: Offline, in-memory MAC OUI lookup and OT rogue device detector for air-gapped industrial networks, SCADA plants, and SOC incident triage.
Operational Context & Threat Landscape
Attackers or unauthorized contractors who connect unauthorized laptops, rogue Wi-Fi access points, or malicious Raspberry Pi drops to OT/SCADA control networks often use standard commercial NICs or randomized MAC addresses. Quickly mapping MAC addresses to vendors and spotting Locally Administered Addresses (LAAs) is essential for perimeter defense.
Key Capabilities
- • Complete in-memory IEEE OUI registry covering MA-L (24-bit), MA-M (28-bit), and MA-S (36-bit) allocations
- • Industrial OT Vendor Profiling: Identifies Siemens S7, Rockwell Automation, Schneider Electric, Moxa, ABB, Omron, Yokogawa, and Phoenix Contact
- • Locally Administered Address (LAA) / MAC Randomization detector (inspects U/L bit)
- • Multicast vs Unicast frame destination flag evaluation
- • Supports all MAC formats: `00:1A:2B:3C:4D:5E`, `00-1A-2B-3C-4D-5E`, `001a.2b3c.4d5e`, `001A2B3C4D5E`
Step-by-Step Usage Workflow
- 1 Enter one or more MAC addresses (one per line or comma-separated) into the MAC lookup input.
- 2 Click 'Lookup MAC Vendor'.
- 3 Review the identified manufacturer, IEEE registry tier, and OT equipment category.
- 4 Check for 'LAA / Randomized MAC' or 'Rogue IT Device in OT' warning badges.
Input Syntax & Sample Data
Standard MAC notations: Colon-separated, hyphen-separated, Cisco dot-notation, or 12-character raw hex.00:1B:1B:3A:45:67 02:42:AC:11:00:02 00:80:F4:11:22:33
Output Interpretation & Remediation Guidance
1. 00:1B:1B:3A:45:67 -> Vendor: Siemens AG (OT/ICS Automation - SIMATIC S7 PLC) 2. 02:42:AC:11:00:02 -> Vendor: Locally Administered (Randomized / Virtual Container / Docker) 3. 00:80:F4:11:22:33 -> Vendor: Telemecanique / Schneider Electric (Modicon PLC)
If a commercial laptop NIC (e.g. Intel, Apple, Realtek) or a Locally Administered (Randomized) MAC appears on a strictly isolated SCADA Level 1/Level 2 control network (Purdue Model), trigger an immediate rogue device investigation.
Zero-Knowledge Guarantee: Fully air-gapped and local. The complete IEEE OUI registry is compiled in-memory; no external lookups are performed.
Ready to inspect or execute with this tool?
Open MAC OUI & OT Rogue Device Mapper
Sigma to SIEM & YARA Studio
Detection Engineering Sigma Standard v2.0 / pySigma / YARA v4
Threat Intel & Defense
•
Route:
#tools/sigma-converter
Executive Summary: Convert Sigma detection rule YAML into Splunk SPL, Microsoft Sentinel/Defender KQL, Elastic DSL/EQL/Lucene, and IBM QRadar AQL, or generate custom YARA malware rules.
Operational Context & Threat Landscape
Sigma is the open generic signature format for SIEM detection rules. Threat intelligence reports often release detection engineering rules in Sigma YAML. SOC engineers must rapidly convert these generic rules into the specific query dialect used by their SIEM (Splunk, Microsoft Sentinel, Elasticsearch, QRadar) or build YARA signatures for endpoint file scanning.
Key Capabilities
- • Translates Sigma YAML rules into Splunk SPL, Microsoft Sentinel/Defender KQL, Elasticsearch DSL/EQL/Lucene, and IBM QRadar AQL
- • pySigma compiler integration with customized logsource field mapping
- • Interactive YARA Rule Generator with string modifiers (`nocase`, `wide`, `ascii`, `xor`), hex patterns, and conditions
- • Pre-loaded Sigma library with attack detections for LSASS dumping, PowerShell obfuscation, and scheduled tasks
- • Syntax linting and validation of Sigma YAML structure
Step-by-Step Usage Workflow
- 1 Paste your Sigma YAML rule into the editor or select a pre-loaded attack template.
- 2 Select your target SIEM backend (e.g. Splunk SPL, Microsoft Sentinel KQL, Elastic Lucene, QRadar AQL).
- 3 Click 'Convert Sigma Rule' to generate the compiled SIEM query.
- 4 To generate a YARA rule: Switch to the 'YARA Studio' tab, specify string/hex markers and condition, and click 'Generate YARA'.
Input Syntax & Sample Data
Valid Sigma Rule YAML or target string patterns for YARA generation.title: Suspicious PowerShell Download
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\powershell.exe'
CommandLine|contains:
- 'DownloadString'
- 'Net.WebClient'
condition: selection
Output Interpretation & Remediation Guidance
// Microsoft Sentinel / Defender KQL:
DeviceProcessEvents
| where FolderPath endswith @"\powershell.exe" or ProcessCommandLine has_any ("DownloadString", "Net.WebClient")
// Splunk SPL:
index=* (Image="*\\powershell.exe" AND (CommandLine="*DownloadString*" OR CommandLine="*Net.WebClient*"))
Copy the compiled query directly into your SIEM hunt window or detection pipeline. Verify the field mappings (e.g. `Image` vs `FolderPath`) against your SIEM schema.
Zero-Knowledge Guarantee: Rule translation runs in ephemeral workers with zero rule persistence.
Ready to inspect or execute with this tool?
Open Sigma to SIEM & YARA Studio
Threat Database (IOC Vault)
Local SQLite Vault STIX / TAXII / FTS5
Threat Intel & Defense
•
Route:
#tools/database
Executive Summary: Search, filter, inspect, and export all stored IOCs, threat intelligence indicators, and historical audit scans from the local SQLite repository.
Operational Context & Threat Landscape
During incident response engagements, analysts process thousands of indicators across multiple tool runs. Having a unified, air-gapped local threat database allows SOC analysts to query past sightings, correlate recurring threat actors, and export clean blocklists for firewall and EDR deployment.
Key Capabilities
- • Full-Text Search (FTS5) across indicator values, tags, adversary names, and notes
- • Filter by IOC category (IPv4, IPv6, Domain, URL, Hash, CVE) and confidence rating
- • Tracks First-Seen and Last-Seen timestamps with audit scan linkage
- • One-click Export to CSV and JSON formats for blocklist syndication
- • Local SQLite engine with high-performance indexed queries
Step-by-Step Usage Workflow
- 1 Open the Threat Database view to see the summary dashboard of total stored IOCs.
- 2 Use the Search bar to find specific IP addresses, domains, malware family tags, or CVEs.
- 3 Filter indicators by Type (IP, Domain, Hash) using the dropdown filter.
- 4 Click on any indicator row to inspect full metadata, sighting count, and associated notes.
- 5 Click 'Export CSV' to download a clean indicator feed for firewall or EDR ingestion.
Input Syntax & Sample Data
Search query strings, keyword tags, or filter selections.malware-c2-rat OR CVE-2024
Output Interpretation & Remediation Guidance
14 Matching IOCs found: 4 Domains, 6 IPs, 3 Hashes, 1 CVE. Confidence: High (90%).
Exported indicators can be fed into firewall IP blocklists or SIEM lookup tables. Review First-Seen and Last-Seen dates to determine if an indicator is part of an ongoing active intrusion or historical campaign.
Zero-Knowledge Guarantee: Data is stored locally in your SQLite database (`magen_iocs.db`). No telemetry or indicators are shared externally.
Ready to inspect or execute with this tool?
Open Threat Database (IOC Vault)
OT & SCADA Timestamp Decoder
Industrial Automation IEEE 1815 (DNP3) / IEC 60870-5-104 / IEC 61850
Network & Recon
•
Route:
#tools/ot-time
Executive Summary: Decode DNP3 48-bit time sync, Modbus 32-bit register pairs (ABCD/CDAB/BADC/DCBA), and IEC 60870-5-104 / IEC 61850 CP56Time2a 7-byte substation telemetry timestamps.
Operational Context & Threat Landscape
In critical infrastructure (electric power grids, substations, water utilities, oil & gas pipelines), SCADA historians and RTUs record operational events using specialized binary timestamp formats. Investigating cyber-physical attacks (like Industroyer or BlackEnergy) requires reconstructing sequence-of-events (SOE) logs with sub-millisecond precision.
Key Capabilities
- • Decodes DNP3 48-bit time sync (Group 50 Variation 1/3) milliseconds since UNIX epoch
- • Modbus 32-bit register timestamp decoding with all 4 word/byte endian combinations (ABCD, CDAB, BADC, DCBA)
- • IEC 60870-5-104 / IEC 61850 CP56Time2a 7-byte timestamp dissection
- • Evaluates CP56Time2a telemetry status flags: Invalid (IV), Substituted (SU), Summer Time (SU/DST)
- • Outputs human-readable UTC timestamp and ISO 8601 string
Step-by-Step Usage Workflow
- 1 Select the industrial protocol tab: 'DNP3 (48-bit)', 'Modbus (32-bit Registers)', or 'CP56Time2a (7-Byte Substation)'.
- 2 Enter the raw hex bytes (e.g. `00 80 4D 5B 8D 01` for DNP3 or `1A 2B 3C 4D 5E 6F 70` for CP56Time2a).
- 3 If using Modbus, select the PLC register endian order (ABCD, CDAB, BADC, or DCBA).
- 4 Click 'Decode OT Timestamp'.
- 5 Inspect the parsed UTC date, time with millisecond precision, and clock synchronization status flags.
Input Syntax & Sample Data
Hex string (space-separated or contiguous) or integer milliseconds/seconds value.00 80 4D 5B 8D 01 (DNP3 48-bit Hex)
Output Interpretation & Remediation Guidance
- Protocol: DNP3 48-Bit Timestamp - Raw Milliseconds: 1708688400000 ms - UTC Time: 2024-02-23 11:40:00.000 UTC - ISO 8601: 2024-02-23T11:40:00.000Z - Sync Quality: Synchronized (Internal clock valid)
Compare decoded SOE event timestamps between substation relays and the control center SCADA historian. If the CP56Time2a 'Invalid (IV)' flag is set, the RTU lost GPS time synchronization, indicating potential GPS spoofing or loss of NTP connectivity.
Zero-Knowledge Guarantee: Zero network exposure. Timestamp decoding mathematics run entirely in local memory.
Ready to inspect or execute with this tool?
Open OT & SCADA Timestamp Decoder
Firewall ACL & Policy Anomaly Engine
Policy Anomaly Engine NIST SP 800-41 / IETF RFC 3021
Network & Recon
•
Route:
#tools/acl-checker
Executive Summary: Multi-vendor firewall policy parser (Cisco, Fortinet, Palo Alto, Juniper, HP, Netgear, TP-Link, CSV), 5-tuple flow simulator, and shadow/redundancy anomaly detector.
Operational Context & Threat Landscape
Enterprise and industrial firewalls accumulate thousands of rules over time. Shadowed rules (unreachable rules blocked by earlier broad rules), redundant rules, and overly permissive 'permit any any' rules weaken security postures and create compliance violations during NIST/NERC-CIP audits.
Key Capabilities
- • Multi-vendor firewall syntax parser: Cisco IOS/ASA, Fortinet FortiOS, Palo Alto PAN-OS, Juniper Junos, HP/Aruba ProCurve, Netgear ProSafe, TP-Link JetStream, and CSV
- • 5-Tuple Flow Simulator (Source IP, Destination IP, Protocol, Source Port, Dest Port) with Longest Prefix Match (LPM)
- • Automated Policy Anomaly Detection: Shadowed rules, Redundant rules, Overlapping rules, and Excessive Any-Any rules
- • Zero-allocation streaming parser handling large rulebases with high performance
- • Detailed step-by-step rule evaluation path explanation for packet flows
Step-by-Step Usage Workflow
- 1 Select your firewall vendor format from the dropdown (or use Cisco / Fortinet / Palo Alto / CSV).
- 2 Paste your firewall access-list or security rule configuration into the Rules editor.
- 3 To simulate a packet flow: Enter Source IP, Destination IP, Protocol (TCP/UDP/ICMP), and Ports in the Flow Simulator pane.
- 4 Click 'Simulate Flow' to see exactly which rule fires first and whether traffic is PERMITTED or DENIED.
- 5 Click 'Run Policy Audit' to scan the entire rulebase for shadowed and redundant rules.
Input Syntax & Sample Data
Native vendor firewall configuration syntax or CSV table format.access-list 101 permit ip 10.0.0.0 0.255.255.255 192.168.1.0 0.0.0.255 access-list 101 deny tcp 10.10.10.0 0.0.0.255 192.168.1.0 0.0.0.255 eq 22 access-list 101 permit tcp any any eq 80 access-list 101 deny ip any any
Output Interpretation & Remediation Guidance
Policy Audit Report:
- CRITICAL ANOMALY: Rule #2 ('deny tcp 10.10.10.0/24 to 192.168.1.0/24 eq 22') is SHADOWED by Rule #1 ('permit ip 10.0.0.0/8 to 192.168.1.0/24'). Rule #2 will NEVER be evaluated!
- Evaluation: SSH traffic from 10.10.10.5 will be PERMITTED by Rule #1 instead of denied.
Shadowed rules represent critical configuration mistakes where an intended deny policy is nullified by an earlier permissive rule. Reorder rules so that more specific subnet/port restrictions precede broader network permits.
Zero-Knowledge Guarantee: Firewall configuration rules and internal IP topology details remain strictly confidential and are processed in local memory.
Ready to inspect or execute with this tool?
Open Firewall ACL & Policy Anomaly Engine
PCAP & Industrial OT/IT Dissector
WebAssembly Dissector PCAP / PCAPNG / Modbus / DNP3
Network & Recon
•
Route:
#tools/pcap-extractor
Executive Summary: Zero-dependency packet extraction engine and OT/IT protocol dissector for Modbus TCP, DNP3, DNS, HTTP, and secret string carving with in-browser WebAssembly.
Operational Context & Threat Landscape
Packet captures (PCAPs) contain raw network truth during cyber incidents. However, uploading proprietary PCAPs to external cloud analyzers leaks sensitive credentials, network architecture, and customer data. Magen provides an in-browser WebAssembly packet dissection engine that triages network traffic with zero server upload.
Key Capabilities
- • Client-side WebAssembly packet processing supporting `.pcap` and `.pcapng` capture files
- • Industrial OT Protocol Dissection: Modbus TCP (Function Codes, Unit IDs, Register Ranges, Exceptions) and DNP3 (Function Codes, Objects, IIN flags)
- • IT Protocol Dissection: DNS queries/answers and HTTP request/response streams
- • Secret String Carving: Extracts embedded passwords, API keys, and IOCs from raw payload bytes
- • Filter packet streams by protocol, IP address, or port number
Step-by-Step Usage Workflow
- 1 Drag and drop a `.pcap` or `.pcapng` file into the upload dropzone (or paste Base64/Hex stream).
- 2 The WebAssembly engine will immediately parse the capture in local memory.
- 3 Explore the Packet Stream table, viewing Frame #, Timestamp, Source/Destination, Protocol, and Summary.
- 4 Click on any packet row to inspect the protocol dissection tree and raw hex bytes.
- 5 Switch to the 'Carved Strings / Secrets' tab to review extracted credentials, URLs, and suspicious keywords.
Input Syntax & Sample Data
`.pcap` or `.pcapng` binary files, hex dumps, or base64-encoded packet dumps.[Drop capture file: modbus_write_register_attack.pcap]
Output Interpretation & Remediation Guidance
Dissected Packets (Sample): - Packet #14: Modbus TCP | Unit ID: 1 | Func: 0x06 (Write Single Register) | Register: 40001 | Value: 0x2710 (10000 RPM) - Packet #15: Modbus TCP | Response OK - Carved Secret: Basic YWRtaW46U2NhZGFQYXNzIQ== -> 'admin:ScadaPass!'
Look for unauthorized Modbus Write commands (Function 0x06 or 0x10) targeting safety-critical PLC registers. Check the Carved Secrets tab for plaintext basic authentication headers or Telnet credentials sent over unencrypted links.
Zero-Knowledge Guarantee: Zero data leakage. Packet capture bytes are processed directly inside your browser's WebAssembly sandbox.
Ready to inspect or execute with this tool?
Open PCAP & Industrial OT/IT Dissector
Default Credentials & Port Catalog
Air-Gapped Catalog MITRE ATT&CK T1078 / CWE-255
Threat Intel & Defense
•
Route:
#tools/default-creds
Executive Summary: Air-gapped database of factory default credentials, protocol mappings, and reverse lookup engine for OT/SCADA, PLCs, RTUs, switches, and enterprise BMCs.
Operational Context & Threat Landscape
Factory default credentials are one of the most common Initial Access and Lateral Movement vectors (MITRE ATT&CK T1078). Equipment in industrial plants and server rooms (PLCs, smart switches, IPMI/iLO/iDRAC management controllers) frequently remain configured with factory passwords.
Key Capabilities
- • Thousands of factory default credentials covering 150+ enterprise and OT/ICS hardware vendors
- • Dual-direction search: Search by Vendor/Model to get credentials, or reverse-lookup a Password/Port to find matching vulnerable devices
- • Default Service Port Resolver mapping port numbers (e.g. 502, 20000, 44818, 47808) to industrial protocols
- • Air-gapped local database with instant FTS5 search indexing
- • Device Categorization: PLCs, RTUs, Firewalls, Switches, BMCs, Security Cameras, HMIs
Step-by-Step Usage Workflow
- 1 To find credentials for a device: Type the vendor or model name (e.g. 'Siemens', 'Cisco', 'Schneider', 'Dell iDRAC') in the search bar.
- 2 To reverse-lookup a credential: Enter a common username/password (e.g. 'admin/admin', 'cisco/cisco') to see which hardware models match.
- 3 To identify an unknown open port: Enter the port number into the Port Resolver to discover the default industrial or enterprise protocol.
- 4 Review the associated default protocols, port numbers, and hardening remediation steps.
Input Syntax & Sample Data
Vendor name, device model, port number, or username/password string.Vendor: 'Moxa' OR Port: '502'
Output Interpretation & Remediation Guidance
Matching Entries: - Vendor: Moxa | Model: NPort 5110 / 5150 Device Server | User: admin | Pass: moxa | Protocol: HTTP / Telnet (Port 80/23) - Port 502: Modbus TCP (Industrial Automation Protocol - Typically unauthenticated)
Ensure any device discovered with factory credentials during an audit has its default password immediately replaced with a high-entropy credential stored in an enterprise PAM solution.
Zero-Knowledge Guarantee: The credential database is stored entirely in local SQLite memory. Searches are never transmitted over the Internet.
Ready to inspect or execute with this tool?
Open Default Credentials & Port Catalog
JWT Inspector & Security Workbench
JOSE Workbench RFC 7519 / RFC 7515 / RFC 7516
Web & Security Auditing
•
Route:
#tools/jwt-inspector
Executive Summary: Dual-execution JWT decoder, vulnerability linter (alg:none, key confusion, injection vectors), cryptographic verifier (HMAC/RSA/ECDSA), and offline dictionary cracker.
Operational Context & Threat Landscape
JSON Web Tokens (JWTs) are the de facto standard for stateless authentication in modern cloud microservices and APIs. Misconfigurations—such as accepting `alg: 'none'`, weak HMAC shared secrets, or vulnerability to RSA-to-HMAC key confusion attacks (CVE-2015-9235)—allow attackers to forge authentication tokens and escalate privileges to admin.
Key Capabilities
- • Visual color-coded token decomposition: Red Header (JOSE), Purple Payload (Claims), Blue Signature
- • Vulnerability Linter checking for `alg: none`, weak HMAC keys, Key Confusion (CVE-2015-9235), and header injection (`jku`, `jwk`, `x5u`)
- • Cryptographic signature verification for HS256/384/512, RS256/384/512, ES256/384/512, and Ed25519
- • High-speed offline dictionary cracker testing weak HMAC secrets in local browser memory
- • Interactive claim decoder displaying human-readable timestamps (`iat`, `exp`, `nbf` countdowns)
Step-by-Step Usage Workflow
- 1 Paste the raw encoded JWT token (`header.payload.signature`) into the JWT Token input field.
- 2 Inspect the color-coded decoded JSON Header and Payload claims.
- 3 Review the 'Vulnerability Audit' pane for identified security risks.
- 4 To verify the cryptographic signature: Select the algorithm, provide the secret key or public PEM key, and click 'Verify Signature'.
- 5 To test for weak secrets: Click 'Run Offline Dictionary Attack' in the Cracker tab.
Input Syntax & Sample Data
Standard JWT format: `eyJhbGciOi...eyJzdWIi...signature`.eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTYiLCJuYW1lIjoiQWRtaW4iLCJyb2xlIjoiYWRtaW4iLCJleHAiOjE3NzE4NDAwMDB9.k_b5gP...
Output Interpretation & Remediation Guidance
- Algorithm: HS256 (HMAC-SHA256)
- Payload Claims: { "sub": "123456", "name": "Admin", "role": "admin", "exp": 1771840000 (Active) }
- Vulnerability Linter:
* Algorithm Integrity: SECURE (Uses HS256, not none)
* Expiration Check: VALID (Token expires in 142 days)
* Dangerous Headers: NONE (`jku`/`jwk` absent)
Ensure tokens use asymmetric RS256/ES256 signatures or strong, 256-bit+ random HMAC keys. Never accept tokens with `alg: none` or allow client-controlled `jku` header URLs without strict domain allowlisting.
Zero-Knowledge Guarantee: All token decoding, claim parsing, verification, and dictionary cracking runs locally in JavaScript.
Ready to inspect or execute with this tool?
Open JWT Inspector & Security Workbench
Email Auth & Phishing Analyzer
RFC Compliance RFC 7208 (SPF) / RFC 7489 (DMARC) / RFC 6376 (DKIM)
Web & Security Auditing
•
Route:
#tools/email-auth
Executive Summary: Live DNS resolver and static RFC record linter for SPF, DMARC, DKIM, and MX records with automated spoofability risk matrix evaluation.
Operational Context & Threat Landscape
Business Email Compromise (BEC) and domain spoofing phishing attacks cost organizations billions of dollars annually. Proper configuration of SPF, DKIM, and DMARC is the foundation of domain reputational defense, ensuring that threat actors cannot forge emails claiming to originate from your organization.
Key Capabilities
- • Live DNS query resolver for SPF TXT records, DMARC (`_dmarc.domain`), DKIM selectors, and MX mail exchangers
- • Static RFC Syntax Linter checking SPF mechanism syntax, modifier validity, and DMARC tag structure
- • 10-DNS-Lookup Limit Enforcement (RFC 7208 section 4.6.4) detecting SPF PermError lookup exhaustion
- • DMARC Enforcement Audit: Flags weak `p=none` monitoring policies vs hardened `p=quarantine` or `p=reject`
- • Automated Spoofability Risk Score with step-by-step remediation templates
Step-by-Step Usage Workflow
- 1 To query live records: Enter a domain name (e.g. 'example.com') in the Domain field and click 'Analyze Domain DNS'.
- 2 To lint draft records: Switch to the 'Static Record Linter' tab, paste your SPF or DMARC string, and click 'Lint Record'.
- 3 Review the calculated Spoofability Risk Score and breakdown cards for SPF, DMARC, and MX records.
- 4 Check for critical warnings like missing DMARC, `p=none`, or SPF lookup limit exceeded (> 10 lookups).
- 5 Copy the recommended hardened policy records to your authoritative DNS server.
Input Syntax & Sample Data
Domain name (e.g. 'company.com') or raw DNS TXT record strings (`v=spf1 ...`, `v=DMARC1 ...`).example-defense.org
Output Interpretation & Remediation Guidance
- Domain: example-defense.org - SPF Record: v=spf1 include:_spf.google.com ~all (PASS - 3 DNS lookups, SoftFail) - DMARC Record: v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-defense.org; pct=100 (HARDENED) - MX Records: aspmx.l.google.com (Priority 1), alt1.aspmx.l.google.com (Priority 5) - Spoofability Risk: LOW (Protected against unauthorized sender domain spoofing)
Domains with `p=none` allow attackers to send spoofed emails that land directly in victim inboxes. Migrate policies through `p=quarantine` and ultimately enforce `p=reject` with 100% percentage rollout (`pct=100`).
Zero-Knowledge Guarantee: DNS resolution queries are performed directly through standard public DNS resolvers.
Ready to inspect or execute with this tool?
Open Email Auth & Phishing Analyzer
BGP / ASN Route Mapper
RPKI Origin Validation RFC 4271 / RFC 6480 / RFC 6811
Network & Recon
•
Route:
#tools/bgp-mapper
Executive Summary: Ultra-fast hybrid IP-to-ASN resolution via Team Cymru DNS, RPKI origin validation (ROA), deep RIR RDAP/PeeringDB enrichment, and firewall rule generation.
Operational Context & Threat Landscape
Adversaries host bulletproof hosting infrastructure, C2 servers, and phishing nodes in specific Autonomous Systems (ASNs). Furthermore, BGP route hijacking and misconfigurations can reroute corporate traffic through hostile nations. Analyzing IP-to-ASN routes and verifying RPKI Route Origin Authorization (ROA) is vital for threat attribution and network perimeter defense.
Key Capabilities
- • Sub-millisecond IP-to-ASN mapping via Team Cymru DNS query protocol
- • RPKI Route Origin Validation (ROA): Classifies route status as Valid, Invalid (unauthorized ASN), or Not Found
- • RIR RDAP Intelligence: Regional registry (ARIN, RIPE, APNIC, LACNIC, AFRINIC) allocation date, country, and registry entity
- • PeeringDB & IXP Infrastructure context: Facility locations and peering exchange presence
- • Automated Firewall Rule Generator: Creates ready-to-paste iptables, Cisco ACL, pfSense, and Junos rules blocking malicious ASNs
Step-by-Step Usage Workflow
- 1 Enter an IP address (e.g. '8.8.8.8'), CIDR block (e.g. '1.1.1.0/24'), or ASN number (e.g. 'AS15169') in the query bar.
- 2 Click 'Lookup BGP & ASN Route'.
- 3 Review the origin Autonomous System Number, AS Name, BGP announced prefix, Country, and RIR Registry.
- 4 Inspect the RPKI Origin Validation badge to confirm routing authenticity.
- 5 To block this entire autonomous system, switch to the 'Firewall Rules' tab and copy the generated ACL syntax.
Input Syntax & Sample Data
IPv4 address, IPv6 address, CIDR prefix, or ASN format (`AS12345` or `12345`).185.220.101.5
Output Interpretation & Remediation Guidance
- IP: 185.220.101.5 - Origin ASN: AS205100 (F3 Netze e.V.) - BGP Announced Prefix: 185.220.101.0/24 - Country: DE (Germany) - RIR: RIPE NCC (Allocated: 2017-09-12) - RPKI Status: VALID (Authorized ROA published) - Category: Known Bulletproof / Tor Exit Relay Node
Use the origin ASN to attribute threat actors and identify bulletproof hosting providers. Generate firewall rules blocking the entire ASN if the network is repeatedly used for malicious campaigns.
Zero-Knowledge Guarantee: Queries use lightweight Team Cymru DNS mapping.
Ready to inspect or execute with this tool?
Open BGP / ASN Route Mapper
File Entropy & Magic Byte Analyzer
Shannon Entropy H(X) Shannon Information Theory / PE / ELF / Mach-O
Malware & Forensics
•
Route:
#tools/file-entropy
Executive Summary: Inspect binary files client-side via WebAssembly for Shannon entropy variation, 100+ magic byte carving, extension masquerading, and PE packer heuristics.
Operational Context & Threat Landscape
Malware authors use packers (UPX, Themida, VMProtect) and custom encrypters to obfuscate malicious executable code from static antivirus signatures. Packed and encrypted files exhibit abnormally high Shannon entropy ($H > 7.2$ bits/byte). Furthermore, phishing lures often disguise executable binaries with fake document extensions (`invoice.pdf.exe`).
Key Capabilities
- • WebAssembly-powered Shannon Entropy calculation ($H = -\sum p_i \log_2 p_i$) with interactive sliding-window chunk graph
- • 100+ File Signature Database: Identifies PE Executables, ELF, Mach-O, ZIP, RAR, 7z, PDF, Office OLE/OOXML, PCAP, and ICS firmware
- • Malware Packing Heuristics: Flags UPX, Themida, and encrypted payload injections
- • Extension Masquerading Detection: Alerts when a file's internal magic header conflicts with its filename extension
- • Zero-Upload Privacy: Inspects multi-gigabyte binary files directly in browser memory without sending a single byte to any server
Step-by-Step Usage Workflow
- 1 Drag and drop any binary file, executable, document, or firmware image into the file dropzone.
- 2 The WebAssembly worker will instantly analyze the file header and calculate entropy across file chunks.
- 3 Review the calculated Overall Shannon Entropy score ($0.0$ to $8.0$ bits/byte).
- 4 Examine the Chunk Entropy Distribution chart to pinpoint specific encrypted or packed sections (e.g. `.text` vs `.rsrc`).
- 5 Inspect the Magic Bytes Signature table to verify file format authenticity and check for extension masquerading warnings.
Input Syntax & Sample Data
Any local binary file (`.exe`, `.dll`, `.elf`, `.bin`, `.pdf`, `.zip`, `.pcap`, `.img`, etc.).[Drop sample: suspicious_invoice_downloader.exe]
Output Interpretation & Remediation Guidance
- File Size: 1,248,512 bytes (1.19 MB) - Magic Header: 4D 5A 90 00 -> PE32 Executable (Windows GUI) - Overall Entropy: 7.78 / 8.00 bits/byte (VERY HIGH - Packed or Encrypted) - Packer Heuristic: POSITIVE (UPX / Section header '.upx1' detected) - Extension Match: MATCH (Executable file with .exe extension) - Assessment: SUSPICIOUS / MALICIOUS PACKER DETECTED
A Shannon entropy score exceeding $7.2$ in standard executables strongly suggests binary packing, encryption, or compressed payloads. In document formats (like PDF or Office), high entropy in isolated chunks may indicate embedded shellcode or encrypted exploits.
Zero-Knowledge Guarantee: 100% Client-Side Privacy. Your files are processed strictly within your local browser WebAssembly memory sandbox. No files leave your machine.
Ready to inspect or execute with this tool?
Open File Entropy & Magic Byte Analyzer
SNMPv3 Config Linter & Active Prober
NIST SP 800-41 / RFC 3414 USM Baseline / Cisco / PAN-OS / FortiOS / SolarWinds
Network & Recon
•
Route:
#tools/snmp-lint
Executive Summary: Dual-engine offline configuration linter and active UDP 161 network auditor. Evaluates network device configurations against NIST SP 800-41, CIS Benchmarks, and RFC 3414 cryptographic baselines while auditing live network endpoints for SNMPv1/v2c fallback and unauthenticated SNMPv3 exposure.
Operational Context & Threat Landscape
SNMPv1 and SNMPv2c transmit community strings in cleartext plaintext across management networks, leaving switches, routers, and firewalls vulnerable to eavesdropping, network reconnaissance, and unauthorized reconfiguration. Even when SNMPv3 is deployed, misconfigurations—such as utilizing `noAuthNoPriv`, weak MD5 hashing, DES 56-bit encryption, or omitting Control Plane Policing (CoPP)—severely compromise network infrastructure.
Key Capabilities
- • Multi-Vendor Configuration Linter: Static AST parsing and validation for Cisco IOS/XE/XR, Fortinet FortiOS, Palo Alto PAN-OS, and SolarWinds Orion
- • USM Security Baseline Verification: Enforces `authPriv` with SHA-256/384/512 auth and AES-128/192/256 privacy ciphers
- • Active UDP 161 Network Prober: Probes live endpoints for default community strings (public/private) and SNMPv3 discovery engine responses
- • Control Plane & ACL Auditing: Flags missing management ACL bindings, unrestricted MIB views (RFC 3415 VACM), and missing rate limiting
- • Remediation CLI Generator: Generates ready-to-paste vendor-specific hardening commands for every flagged issue
Step-by-Step Usage Workflow
- 1 Choose your mode: Offline Configuration Linter or Active Network Prober.
- 2 For configuration analysis: Select target vendor (Cisco, Fortinet, Palo Alto, or SolarWinds) and paste your configuration snippet.
- 3 Click Audit Configuration to execute static AST security checks against CIS and NIST baselines.
- 4 Review findings categorized by severity (Critical, High, Medium, Info) with exact line references and remediation CLI commands.
- 5 For active probing: Specify target IP address and UDP port 161 to test live firewall reachability and SNMP response flags.
Input Syntax & Sample Data
Cisco IOS-XE / NX-OS SNMP Configuration Snippetsnmp-server community public RO snmp-server group SECGROUP v3 priv snmp-server user netadmin SECGROUP v3 auth sha MyAuthPass123 priv des WeakPrivPass456
Output Interpretation & Remediation Guidance
[CRITICAL] Plaintext SNMPv2c Community String Active Line 1: 'snmp-server community public RO' Remediation: 'no snmp-server community public' [HIGH] Insecure DES Encryption Algorithm Configured Line 3: User 'netadmin' utilizes DES (56-bit key length) Remediation: Upgrade privacy algorithm to AES-256: 'snmp-server user netadmin SECGROUP v3 auth sha ... priv aes 256 ...' [MEDIUM] Missing SNMP Access Control List (ACL) Remediation: Bind SNMP access to dedicated out-of-band management subnet ACL
All modern network security frameworks (including NIST SP 800-41 and CIS Controls) mandate disabling SNMPv1 and SNMPv2c entirely. Where SNMPv3 is deployed, authPriv mode with SHA-256 authentication and AES-128/256 encryption is the required cryptographic minimum.
Zero-Knowledge Guarantee: Configuration scripts, community strings, and user passwords are processed offline in your browser or isolated backend worker without external data transmission.
Ready to audit your SNMP network configurations?
Open SNMPv3 Config Linter
Suricata & Snort Rule Forge Studio
Suricata 7 / Snort 3 / Snort 2.9 AST Transpiler / Hyperscan Fast Pattern
Threat Intel & Defense
•
Route:
#tools/rule-forge
Executive Summary: Automate Network Intrusion Detection System (NIDS) signature authoring from PCAP packet captures, hex payloads, and PCRE expressions. Features real-time AST transpilation between Suricata 7, Snort 3, and Snort 2.9 dialects, Shannon entropy content scoring, fast_pattern optimization, and sandboxed replay verification.
Operational Context & Threat Landscape
Crafting high-fidelity NIDS rules during live incident triage requires balancing signature specificity against sensor performance. Sub-optimal rules cause packet drops, excessive CPU utilization, or catastrophic Regular Expression Denial of Service (ReDoS). Furthermore, enterprise SOCs frequently maintain mixed sensor fleets running Suricata 7 and Snort 3, necessitating error-free rule translation across dialect boundaries.
Key Capabilities
- • Bidirectional AST Transpiler: Instantly translates keywords and buffer modifiers across Suricata 7 (`http.uri`), Snort 3 (`http_uri`), and legacy Snort 2.9 (`uricontent`)
- • Automated PCAP Extraction: Ingests `.pcap` captures to extract network flows (IPs, ports, protocols, HTTP headers, payloads) into structured rule options
- • Hyperscan Fast Pattern Optimization: Identifies lowest-entropy content patterns to assign `fast_pattern` for optimal hardware acceleration
- • PCRE ReDoS & Entropy Safety: Flags catastrophic backtracking regular expressions and scores payload Shannon entropy
- • Interactive Replay Benchmarking: Simulates rule execution against test payloads in real-time with zero external engine dependency
Step-by-Step Usage Workflow
- 1 Select your input method: PCAP File Upload, Raw Payload Hex/ASCII, or Existing NIDS Signature.
- 2 For PCAPs: Drop your `.pcap` capture to parse connection metadata, TCP stream payloads, and candidate strings.
- 3 Configure rule metadata: Specify action (`alert`, `drop`), message text, SID, revision, and classtype (e.g. `trojan-activity`).
- 4 Customize match criteria: Select candidate content strings, apply buffer modifiers, or add PCRE expressions.
- 5 Switch between Suricata 7, Snort 3, and Snort 2.9 tabs to copy the transpiled rule, or click Test Rule to verify execution.
Input Syntax & Sample Data
Raw C2 Beacon Telemetry StreamPOST /api/v1/telemetry HTTP/1.1 Host: malware-c2-beacon.top User-Agent: WinHTTP-Direct/1.0 X-Session-Token: 0xDEADBEEF1337 Content-Length: 32 payload=encrypted_hex_stream_data
Output Interpretation & Generated Signatures
# Suricata 7 Signature alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC WinHTTP Beacon Observed"; flow:established,to_server; content:"POST"; http.method; content:"/api/v1/telemetry"; http.uri; fast_pattern; content:"Host|3a 20|malware-c2-beacon.top"; http.header; classtype:trojan-activity; sid:2048991; rev:1;) # Snort 3 Signature alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC WinHTTP Beacon Observed"; flow:established,to_server; content:"POST",http_method; content:"/api/v1/telemetry",http_uri,fast_pattern; content:"Host|3a 20|malware-c2-beacon.top",http_header; classtype:trojan-activity; sid:2048991; rev:1;)
Marking the lowest-entropy and most specific string with `fast_pattern` ensures the Hyperscan engine checks that substring first across multi-gigabit packet streams, avoiding expensive secondary option evaluations.
Zero-Knowledge Guarantee: PCAP dissection, signature transpilation, and pattern benchmarking execute 100% locally in your browser memory without uploading raw packet traces.
Ready to author and transpile NIDS signatures?
Open Suricata & Snort Rule Forge
Ransomware Identifier & IR Triage Studio
SQLite FTS5 / Magic Bytes No More Ransom / MITRE ATT&CK / NIST SP 800-61
Malware & Forensics
•
Route:
#tools/ransom-id
Executive Summary: Rapid, offline-first identification of ransomware strains and threat actor campaigns. Correlates encrypted file extensions, ransom note filenames and text contents via SQLite FTS5 BM25 search, and binary header/footer byte markers against an offline knowledge base of 800+ known ransomware strains, decryptor tools, and incident response runbooks.
Operational Context & Threat Landscape
During active ransomware attacks, incident responders must immediately establish the ransomware strain, ascertain if public decryptors exist (e.g., from No More Ransom), identify threat actor TTPs, and execute containment procedures before offline backups or Active Directory domain controllers are destroyed.
Key Capabilities
- • Multi-Factor Confidence Scoring: Evaluates extension matching, ransom note filename, note body text, and file header/footer magic markers simultaneously
- • SQLite FTS5 BM25 Search: Performs ranked full-text semantic searching across ransom note templates, onion negotiation links, and BTC/XMR payment addresses
- • Decryptor Availability Catalog: Instantly identifies if a decryptor is available from verified sources (No More Ransom, CISA, Bitdefender, Kaspersky)
- • Threat Group & MITRE Profiling: Links identified strains to known threat actor groups (LockBit 3.0, BlackCat/ALPHV, Akira, Royal), CVEs, and ATT&CK tactic IDs
- • Prioritized Incident Response Runbook: Generates immediate containment steps including hypervisor isolation and backup protection
Step-by-Step Usage Workflow
- 1 Collect available incident artifacts: encrypted file extension (e.g. `.lockbit`), ransom note filename (e.g. `Restore-My-Files.txt`), or note text content.
- 2 Paste the ransom note content or drag-and-drop an encrypted file to extract header and footer byte markers.
- 3 Click Identify Ransomware Strain to trigger composite multi-factor correlation across the offline database.
- 4 Review the match confidence score, family profile, threat group attribution, and encryption algorithms (e.g. AES-256 + RSA-4096, ChaCha20).
- 5 Execute immediate triage actions: check decryptor download links and follow the incident containment checklist.
Input Syntax & Sample Data
Ransom Note Artifact & ExtensionExtension: .lockbit Note File: restore-my-files.txt Note Content: "All your files have been stolen and encrypted by LockBit 3.0. Decryption tool is available only through our Tor portal: http://lockbitapt...onion"
Output Interpretation & IR Guidance
[CONFIDENCE: 98% MATCH] Family: LockBit 3.0 (Black) Threat Actor: FIN11 / LockBit Supporter Group Encryption: AES-256-CBC + Curve25519 (Hybrid) Decryptor Available: Partial / Key Recovery Tool (Free) MITRE ATT&CK: T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery) Immediate Action: 1. Disconnect all vSphere/Hyper-V hosts and ESXi management NICs. 2. Prevent lateral movement via SMB (Port 445) and WMI (Port 135). 3. Secure volume shadow copies and offline immutable backups.
Never negotiate or pay ransoms without consulting specialized legal and incident response counsel. Immediate network segmentation and snapshot preservation are paramount during the first 60 minutes of detection.
Zero-Knowledge Guarantee: Sensitive ransom notes containing victim names, executive emails, or internal IP addresses are analyzed strictly inside your local workstation or private backend instance without cloud leakage.
Ready to identify a ransomware strain?
Open Ransomware Identifier
In-Browser Maldoc Extractor & WASM Sandbox
Pure WebAssembly (WASM) MS-CFBF / MS-OVBA / OOXML / BIFF8 XLM / Ole10Native
Malware & Forensics
•
Route:
#tools/maldoc-extractor
Executive Summary: Zero-dependency malicious document extractor running inside a completely air-gapped browser WebAssembly sandbox. Dissects Microsoft Office documents (OLE2/CFBF and OOXML), decompresses MS-OVBA compressed VBA source code, extracts Excel 4.0 (XLM) formulas from BIFF8 records, carves embedded `\x01Ole10Native` executable payloads, and scores static heuristics without executing code.
Operational Context & Threat Landscape
Weaponized Office documents (`.doc`, `.docm`, `.xls`, `.xlsm`, `.rtf`) remain a premier initial access vector for targeted malware delivery. Threat actors evade standard scanners by hiding VBA macros inside OLE2 compound files, embedding legacy Excel 4.0 XLM macro sheets, or packing malicious `.exe` / `.dll` payloads inside embedded `\x01Ole10Native` compound streams.
Key Capabilities
- • Pure WebAssembly Parsing: Uses compiled pure Go WebAssembly to dissect compound files safely without executing native binaries or risking host infection
- • CFBF & OOXML Deconstruction: Dissects both legacy Compound File Binary Format (`.doc`, `.xls`) and modern ZIP-based OpenXML packages (`.docm`, `.xlsm`)
- • MS-OVBA VBA Macro Decompressor: Decompresses raw VBA project streams directly to plain-text source code, defeating basic macro obfuscation
- • BIFF8 Excel 4.0 XLM Formula Parser: Scans legacy workbook streams for hidden XLM sheets containing malicious formula calls (`=EXEC()`, `=URLDownloadToFile()`)
- • Ole10Native Binary Carving: Carves embedded PE executables, DLLs, and VBS scripts with one-click safe ZIP export
- • Static Heuristics Engine: Evaluates suspicious APIs (`Shell`, `AutoOpen`, `WScript.Shell`, `CreateObject`, `PowerShell`, `certutil`) with severity rating
Step-by-Step Usage Workflow
- 1 Drag and drop any suspicious Office document (`.doc`, `.docm`, `.xls`, `.xlsm`, `.ppt`, `.rtf`) into the upload dropzone, or click one of the built-in synthetic test samples.
- 2 The WebAssembly engine parses the internal compound structures instantly in browser memory.
- 3 Inspect the Overview dashboard for document format type, MD5/SHA-256 hashes, detected streams, and macro indicators.
- 4 View decompressed VBA macro code and Excel 4.0 formula streams with syntax highlighting and suspicious API flags.
- 5 If an embedded `\x01Ole10Native` object is detected, inspect carved metadata and export the sanitized ZIP bundle for further analysis.
Input Syntax & Synthetic Samples
Office Documents (.doc, .docm, .xls, .xlsm, .rtf)[Drop file: invoice_mar_2026.docm (Size: 48,210 bytes)] Built-in synthetic test fixtures available: - Sample 1: OLE2 Legacy Word with VBA Macro (sample_ole2_vba.doc) - Sample 2: OOXML Macro-Enabled Document (sample_ooxml_macro.docm) - Sample 3: OLE10Native Embedded PE Dropper (sample_ole10native_pe.doc) - Sample 4: Excel 4.0 (XLM) Hidden Sheet Macro (sample_xlm_hidden.xls)
Output Interpretation & Forensic Assessment
[THREAT LEVEL: HIGH - MALICIOUS HEURISTICS DETECTED] Document Type: Microsoft Word 97-2003 (OLE2 / CFBF) Streams Extracted: 6 (VBA project, Dir, Macros/ThisDocument) Suspicious APIs Detected: - AutoOpen() -> Automatic execution on document launch (MITRE T1204.002) - WScript.Shell -> Shell execution capability (MITRE T1059.005) - URLDownloadToFileA -> Remote stage 2 binary fetch (MITRE T1105) Embedded Objects: - \x01Ole10Native: Dropper payload carved (invoice_payload.exe, 18,432 bytes, PE32)
Decompressing macro streams without invoking the Office execution environment provides guaranteed safety against macro detonation, zero-day Office CVEs, and dropper execution.
Zero-Knowledge Guarantee: All parsing, decompressing, and carving runs in an isolated browser WebAssembly memory sandbox. No Microsoft Office APIs are invoked, no macros are executed, and no document contents leave your browser.
Ready to dissect a suspicious Office document?
Open In-Browser Maldoc Extractor
3 min read