Workshop · T

Triage toolkit

Small questions that come up in every case: what does this blob decode to, is this address ours, is that domain pretending to be us, what is in this token.

Written for Mutant v2.6.1. Every program and output on this page is that release’s own file.

Preview. This module is not published yet: it opens once every builtin it uses has cleared review at the pinned release.

beginner

Decode and classify

Peel encodings off a payload, then sort addresses into internal and external.

1. Decode a payload

   Current

   1// Workshop extra - Decode an obfuscated payload2//3// Malware hides commands behind layers of encoding. Peel them off with builtins.4// Encoders return a string; decoders return (bytes, err). Input: none.5 6putln("=== Decode payload ===");7 8// Imagine you found this base64 blob inside a script.9let command = "Invoke-Mimikatz -DumpCreds";10let blob = base64_encode(command);11putln("found (base64):", blob);12 13let revealed, err = base64_decode(blob);14putln("decoded       :", to_string(revealed));15 16// Every encoder/decoder composes the same way - hex, url, gzip, zlib.17putln("hex('hi')     :", hex_encode("hi"));18let back, e2 = hex_decode("6869");19putln("hex decode    :", to_string(back));

   Step 1 of 4 · lines 1–4 One rule worth remembering: encoders return a string; decoders return a value and an error, because input can be malformed.

   Previous step Next step
   Continue Skip stage

   Step through to the end to continue.

2. Build it

   Locked

   Finish or skip the stage above to open this one.

3. What a /29 is

   Locked

   Finish or skip the stage above to open this one.

4. Triage addresses

   Locked

   Finish or skip the stage above to open this one.

5. Check yourself

   Locked

   Finish or skip the stage above to open this one.

intermediate

Look-alikes and tokens

Score domains for how close they are to a brand, and read a JWT without trusting it.

1. Spot look-alike domains

   Locked

   Finish or skip the stage above to open this one.

2. Read a JWT

   Locked

   Finish or skip the stage above to open this one.

3. Check yourself

   Locked

   Finish or skip the stage above to open this one.

4. Run them yourself

   Locked

   Finish or skip the stage above to open this one.

Read further

• Mutant Cookbook