CABTA

Investigate Indicators of Compromise (IOCs) using 20+ threat intelligence sources.\n\n

Comprehensive email security analysis for phishing detection.\n\n

Comprehensive malware analysis using hash-based threat intelligence and static analysis.\n\n

Analyze an executable with capa to detect capabilities and MITRE ATT&CK techniques.

Extract obfuscated and encoded strings from an executable using FLOSS.

Identify file type, packer, compiler, and protector using Detect It Easy (DIE).

Extract printable strings from a binary file.

Extract comprehensive metadata from a file for forensic analysis. Includes timestamps, permissions, hashes, magic bytes, entropy.

Carve embedded files from a binary using magic byte signatures. Detects PE, PDF, ZIP, OLE, JPEG, PNG, GIF, RAR embedded files.

Parse Windows Prefetch file for forensic analysis. Extracts execution count, timestamps, loaded DLLs.

Parse Windows LNK (shortcut) file for forensic analysis. Extracts target path, timestamps, MAC address, volume info.

Parse forensic timeline CSV files (Plaso/log2timeline, KAPE format). Analyzes temporal patterns and highlights suspicious activity.

Analyze exported Windows Event Log (EVTX exported as XML/CSV). Detects suspicious events: logon failures, privilege escalation, service installations, PowerShell execution, etc.

Extract and categorize strings from a binary file. Categorizes: URLs, IPs, file paths, registry keys, emails, API calls.

Check a URL against OpenPhish phishing feed.

Discover subdomains via Certificate Transparency logs (crt.sh).

Query Shodan InternetDB for exposed services (FREE, no API key).

Check ransomware group activity and recent victims via Ransomwatch.

Search Malpedia for malware family information.

Check an IOC against CIRCL MISP public threat feeds.

Search the dark web via Ahmia.fi search engine.

Check if a domain has employees compromised by info-stealer malware.

Get EPSS scores for top exploited CVEs or lookup a specific CVE.

Detect potential typosquatting/phishing domains for a target domain.

Search public paste sites for leaked credentials or data.

Comprehensive binary analysis - PE structure, sections, imports, exports, suspicious indicators, and entry point disassembly.

Disassemble instructions at the entry point of a PE/ELF binary. Uses capstone disassembler if available, falls back to raw bytes.

Detect functions in a PE binary using prologue/epilogue patterns. Identifies function boundaries without full disassembly.

Scan a file for shellcode patterns and suspicious byte sequences. Detects NOP sleds, common shellcode patterns, API hashing, etc.

Compare two binary files and report differences. Useful for analyzing malware variants or patched binaries.

Look up a file hash (MD5, SHA1, or SHA256) for malware intelligence.

Check domain reputation using free threat intelligence sources.

Check IP address reputation using free threat intelligence sources.

Check a URL against free threat intelligence sources.

Get download information for a known malware sample from MalwareBazaar.

Quick triage of a local file - compute hashes and check threat intel.

Generate a basic YARA rule skeleton from analysis report text.

Upload a mobile app (APK/IPA/APPX) to MobSF for analysis. Requires MobSF running (Docker: docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf).

Perform static analysis on an Android APK file without MobSF. Extracts permissions, activities, services, receivers, manifest data.

Get analysis report from MobSF for a previously scanned app.

Check if MobSF is running and accessible. Returns server status and API information.

Parse PCAP/PCAPNG files using Python struct module. Extracts packet summaries including src/dst IP, port, protocol, and size. This is a lightweight parser for quick triage - not a full protocol decoder.

Parse Zeek (Bro) TSV log files and detect suspicious patterns. Supports conn.log, dns.log, http.log, ssl.log, and files.log. Detects: long connections, unusual ports, DNS tunneling indicators, suspicious HTTP methods, expired/self-signed certs, etc.

Parse Suricata EVE JSON log files and extract alerts. Classifies alerts by severity and maps to MITRE ATT&CK tactics where possible.

Perform DNS lookups for a domain. Returns results for requested record types. Uses socket for A/AAAA records and nslookup/subprocess for other types.

Perform WHOIS lookup for a domain or IP address using raw WHOIS protocol over a socket connection. No external packages required.

Perform free GeoIP lookup using ip-api.com (no API key needed). Rate limited to 45 requests/minute on free tier. Returns country, region, city, ISP, AS number, and more.

Check if common ports are open on a host using socket connect with timeout. This is a passive TCP connect check only - no exploitation or scanning payloads.

Extract network Indicators of Compromise (IOCs) from free-form text. Extracts: IPv4 addresses, IPv6 addresses, domain names, URLs, email addresses, and defanged indicators (e.g., hxxp://, [.], [at]).

Resolve DNS records for a domain.

Perform reverse DNS lookup for an IP address.

Retrieve and analyze SSL/TLS certificate for a host.

Retrieve and analyze HTTP response headers for security assessment.

Enumerate subdomains using certificate transparency logs (crt.sh). Free service, no API key needed.

Check email security configuration for a domain. Checks SPF, DKIM, DMARC records.

Analyze Office documents for VBA macros using oletools.

Analyze RTF files for embedded objects and exploit indicators.

Analyze PE (Portable Executable) files for structure and suspicious indicators.

Scan a file with YARA rules for malware pattern matching.

Calculate multiple cryptographic hashes of a file.

Calculate Shannon entropy of a file and its PE sections if applicable.

Extract embedded objects from OLE files (Office documents).

Look up a URL, domain, or IP in URLhaus (abuse.ch). Free, no API key needed. Checks for known malicious URLs.

Look up a file hash in MalwareBazaar (abuse.ch). Free, no API key. Supports MD5, SHA1, SHA256.

Search ThreatFox (abuse.ch) for IOC information. Free, no API key. Supports IPs, domains, URLs, hashes.

Check if an IP is a known botnet C2 server via Feodo Tracker (abuse.ch). Free, no API key. Tracks Dridex, Emotet, TrickBot, QakBot C2s.

Check if an IP address is a known Tor exit node. Uses the official Tor Project exit node list.

Check an IP against multiple free blocklists. Checks: Spamhaus DROP, DShield, Blocklist.de, CI Army.

Get recent malware samples from MalwareBazaar. Free, no API key. Returns latest submitted samples.

Get recent IOCs from ThreatFox. Free, no API key. Returns latest reported IOCs.

Look up a CVE (Common Vulnerabilities and Exposures) by ID. Uses the NIST NVD API (free, no key for basic lookups).

Search for CVEs by keyword (product, vendor, description). Uses the NIST NVD API.

Check CISA Known Exploited Vulnerabilities (KEV) catalog. These are CVEs known to be actively exploited in the wild.

Get EPSS (Exploit Prediction Scoring System) score for a CVE. EPSS predicts the probability of a CVE being exploited in the next 30 days.

Check a host's SSL/TLS configuration for common vulnerabilities. Tests protocol versions, cipher suites, certificate issues.