Score a vulnerability with CVSS v3.1, exactly as the FIRST specification computes it. Give a vector string (CVSS:3.1/AV:N/AC:L/...) or the eight base metrics; returns the base score, severity band, normalised vector, and the impact/exploitability sub-scores.

Pull every indicator out of a blob of text — a report, an alert, a mail — and return them sectioned and defanged, ready for a ticket: IPv4, IPv6, domains, URLs, emails, CVE ids, MD5/SHA-1/SHA-256. Defanged input (hxxp, [.], [at]) is refanged first, so pasting from another report works. Filenames are not mistaken for domains.

Defang or refang indicators in text: http→hxxp[://], dots→[.], @→[at], and back. Use before pasting live URLs into anything that auto-links.

Phishing triage on raw email headers: the Received chain in chronological order with per-hop delay, the originating public IP, SPF/DKIM/DMARC verdicts, and the mismatches that matter — From vs Return-Path domain, Reply-To pointing elsewhere (BEC), authentication failures, hops timestamped before the previous one.

Identify a hash by shape: bcrypt, Argon2, yescrypt, the Unix crypt family, LM:NT pairs, and hex-length MD5/NTLM, SHA-1, SHA-224/256/384/512 — with what that shape implies for cracking or reuse.

Decode a JWT's header and payload (no verification — it says so), show iat/nbf/exp as dates, and flag alg:none, missing alg, expiry, tokens that never expire, and long-lived tokens.

Turn any timestamp into every form an investigation needs: Unix epoch in s/ms/µs (detected by digit count), Windows FILETIME, ISO 8601, RFC 2822 dates, or 'now' — with UTC, weekday and relative time.

Peel a layered payload: run a chain of operations (base64_decode, base64_encode, hex_decode, hex_encode, url_decode, url_encode, html_decode, rot13) and see every intermediate result. Default chain is a single base64_decode. Stops at the first step that fails and says which.

Is this CVE exploited in the wild? Checks CISA's Known Exploited Vulnerabilities catalog: date added, the federal due date, whether it is used in ransomware campaigns, and the required action. Accepts any text containing CVE ids. The only tool here that touches the network; the catalog is cached for an hour.

The most recent This Week in Security episodes — what got exploited, what to patch, what it means for the systems you defend. Reads a public RSS feed.