Ceplin Terminal Copyright (c) Ceplin This product includes the Go runtime and standard library, compiled into every Ceplin binary and into the Ceplin Command Identifier's engine.wasm. The identifier also serves Go's wasm_exec.js. Go, https://go.dev Copyright 2009 The Go Authors Licensed under a BSD-style licence (BSD 3-Clause); the full text is in LICENSE-GO. This product includes software derived from CyberChef. CyberChef — The Cyber Swiss Army Knife https://github.com/gchq/CyberChef Copyright Crown Copyright 2016 Licensed under the Apache License, Version 2.0 Derived material, and the changes made to it: magic.go The operation-detection table — the `checks` declared on CyberChef's FromBase64, FromBase32, FromHex, FromBase85, URLDecode, Gunzip, ZlibInflate and RawInflate operations — together with the Shannon entropy calculation and the structure of speculative execution. Changes: rewritten in Go. The operation set is limited to the decoders this tool implements rather than CyberChef's full catalogue. Byte signatures are matched as bytes rather than as regular expressions, because Go's regexp operates on UTF-8 and a signature such as 0x1F 0x8B 0x08 cannot be expressed as one. Language detection by chi-squared against per-language byte frequencies is replaced by scoring against this tool's own artefact shapes. Chain depth is two rather than three. codecs.go The choice and naming of the decode() and encode() modes (From Base58, From Base62, From Base45, From Binary, From Octal, From Decimal, From Hexdump, From HTML Entity, From Quoted Printable, Unescape Unicode Characters, Unescape string, From Punycode, JWT Decode, ROT13, ROT47, Atbash Cipher, Reverse, A1Z26 Cipher Decode, From Morse Code, From Braille, XOR Brute Force, From Base92, Decode NetBIOS Name, Citrix CTX1 Decode, Change IP format, Strings, Bacon Cipher Decode, Entropy, Fang URL, Remove null bytes, Remove whitespace, From UNIX Timestamp, Windows Filetime to UNIX Timestamp, To Base64, Show Base64 offsets, To Hex, URL Encode, To Hexdump, Defang URL, MD5, SHA1 and SHA2), the Base58, Base62, Base92 and Braille alphabets, the Citrix CTX1 algorithm, and the input patterns decode(auto) uses to decide which to try, which are the `checks` on those operations. Changes: rewritten in Go. Each operation takes bytes and returns bytes with its options fixed at CyberChef's defaults, since a mode takes no arguments; separators are read loosely rather than chosen. XOR Brute Force keeps the single most readable key, scored as magic.go scores, rather than listing every key. A copy of the Apache License, Version 2.0 is in LICENSE-APACHE-2.0. Ceplin Systems is not affiliated with, endorsed by, or sponsored by GCHQ. Any reference to CyberChef describes derivation and interoperability only. This product includes icons from the GNOME icon theme (gnome-icon-theme) and related GNOME artwork published on Wikimedia Commons, used by the classic themes and kept in cmd/server/static/classic/. GNOME icon theme https://gitlab.gnome.org/GNOME/gnome-icon-theme Jakub Steiner, Andreas Nilsson and the GNOME artists Licensed under the GNU General Public License, version 2 The individual files and their authors are listed in cmd/server/static/classic/LICENSES.txt. A copy of the GNU General Public License, version 2 is in LICENSE-GPL-2.0, and is served beside the icons at /static/classic/COPYING. The icons are separate files, served unmodified; their SVG source is the file served. This product includes the VT323 font, used by the 1982 theme and kept in cmd/server/static/1982/ as vt323.woff2. VT323 https://github.com/google/fonts/tree/main/ofl/vt323 Copyright 2011, The VT323 Project Authors (peter.hull@oikoi.com) Licensed under the SIL Open Font License, Version 1.1 The license is in cmd/server/static/1982/OFL.txt and is served beside the font at /static/1982/OFL.txt. The font file is the Latin subset published by Fontsource (@fontsource/vt323 5.1.0), unmodified. This product includes data/binaries.json.gz, the index behind whatis(), built by tools/binindex/build.py from the projects below. The commit of each source is recorded inside the index ("sources"). xCyclopedia — https://github.com/strontic/xcyclopedia MIT License, Copyright (c) 2020 strontic Used: file description, product, company, original file name, folder, signer, file version and MD5 / SHA-1 / SHA-256 of Windows EXE and DLL files. VirusTotal fields not included. tldr-pages — https://github.com/tldr-pages/tldr Creative Commons Attribution 4.0 International (CC BY 4.0, https://creativecommons.org/licenses/by/4.0/), Copyright (c) the tldr-pages team and contributors Used: English page summaries and up to three examples per page. Changes: markdown removed, placeholders unwrapped, short/long option pairs reduced to the long form. LOLDrivers — https://github.com/magicsword-io/LOLDrivers LOLRMM — https://github.com/magicsword-io/LOLRMM Apache License 2.0, MagicSword Used: driver category, ATT&CK id, file metadata and sample hashes (LOLDrivers); tool name, website and first sentence of the description (LOLRMM). LOLBAS — https://github.com/LOLBAS-Project/LOLBAS (GPL-3.0) GTFOBins — https://github.com/GTFOBins/GTFOBins.github.io (GPL-3.0) Facts only: binary names, abuse categories / function names, the option names each documented abuse uses, and ATT&CK ids. No descriptions, commands or other text from either project is included; whatis() links to the project's page for the write-up. The Command Identifier web site (identify-web/) also shows each project's documented commands, with LOLBAS's descriptions and GTFOBins' notes, under GPL-3.0, from identify-web/data/abuse.json.gz. That file is read only when the site is built; no program embeds it. Sigma — https://github.com/SigmaHQ/sigma Detection Rule License (DRL) 1.1, the SigmaHQ rule authors (https://github.com/SigmaHQ/Detection-Rule-License) Used: a count of the rules whose detection names each binary, and the process_creation rules (title, level, author, ATT&CK tags, detection, condition), which identify() evaluates against a command line. As the DRL requires, every match identify() shows names the rule's author, and links to the rule. Microsoft PowerShell reference — https://github.com/MicrosoftDocs/PowerShell-Docs Creative Commons Attribution 4.0 International (CC BY 4.0, https://creativecommons.org/licenses/by/4.0/), Copyright (c) Microsoft Corporation Used: the Windows PowerShell 5.1 cmdlet pages - each cmdlet's synopsis, aliases, and the first sentence of each parameter's description - and about_PowerShell_exe, the first sentence describing each switch of powershell.exe, for identify(). Changes: markdown removed, text shortened to one sentence. Microsoft .NET API reference — https://github.com/dotnet/dotnet-api-docs Creative Commons Attribution 4.0 International (CC BY 4.0, https://creativecommons.org/licenses/by/4.0/), Copyright (c) .NET Foundation and Contributors Used: the summary of each type and member in Microsoft.Win32, System, System.Diagnostics, System.DirectoryServices, System.IO, System.IO.Compression, System.Net, System.Net.Http, System.Net.Sockets, System.Reflection, System.Runtime.InteropServices, System.Security.Cryptography, System.Security.Principal and System.Text, for identify(). Changes: XML markup removed, cross-references reduced to their names. MITRE ATT&CK® — https://github.com/mitre/cti © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Licence: The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of use: https://attack.mitre.org/resources/legal-and-branding/terms-of-use/ Used: the name and first sentence of each Enterprise technique, shown beside the technique ids identify() reports. Microsoft Windows commands reference — https://github.com/MicrosoftDocs/windowsserverdocs Creative Commons Attribution 4.0 International (CC BY 4.0, https://creativecommons.org/licenses/by/4.0/), Copyright (c) Microsoft Corporation Used: each command's opening description and the first sentence of each parameter's description, for identify() and get_man(). Changes: markdown and HTML removed, text shortened to one sentence. This product includes data/netscaler.json.gz, the NetScaler ADC CLI index behind identify(), built by tools/nsindex/build.py from: NITRO Go SDK (adc-nitro-go) https://github.com/citrix/adc-nitro-go Copyright Citrix Systems, Inc. Licensed under the Apache License, Version 2.0 Each configuration resource's command group, the comment on its type and the first sentence of the comment on each of its fields. NetScaler ADC Ansible collection (ansible-collection-netscaleradc) https://github.com/netscaler/ansible-collection-netscaleradc Copyright (c) Cloud Software Group, Inc. Licensed under the MIT License From the NITRO resource map: the operations each resource supports, its secret parameters and primary key. From module documentation: the description of resources and parameters the SDK leaves undescribed. Changes: descriptions reduced to their first sentence and whitespace collapsed; a generator placeholder ("Configuration for 0 resource.") dropped rather than shown. The commits used are recorded in the index. This product includes data/cmdlets.json.gz, the cmdlet reference for PowerShell modules beyond PowerShell itself, behind identify() and man(), built by tools/cmdletindex/build.py from: Windows Server PowerShell reference (Windows Server 2025 modules) — https://github.com/MicrosoftDocs/windows-powershell-docs Exchange PowerShell and Microsoft Teams PowerShell references — https://github.com/MicrosoftDocs/office-docs-powershell Microsoft Graph PowerShell reference (v1.0) — https://github.com/MicrosoftDocs/microsoftgraph-docs-powershell Creative Commons Attribution 4.0 International (CC BY 4.0, https://creativecommons.org/licenses/by/4.0/), Copyright (c) Microsoft Corporation Used: each cmdlet's synopsis and the first sentence of each parameter's description, and parameter aliases. Changes: markdown removed, text shortened to one sentence; notes, availability lines and unfilled template text ("{{ Fill in the Description }}") left out; a page whose title differs from its file name filed under its file name (Get-NetIntentStatus.md is titled New-NetIntentStatus). The commits used are recorded in the index. This product includes data/fortios.json.gz, the FortiOS (FortiGate) CLI index behind identify(), built by tools/fortiindex/build.py from: FortiOS Terraform provider (terraform-provider-fortios) https://github.com/fortinetdev/terraform-provider-fortios Copyright Fortinet, Inc. Licensed under the Mozilla Public License, v. 2.0 (https://mozilla.org/MPL/2.0/) From its resource documentation: each resource's description and the first sentence of each argument's, nested tables included. From its source: which arguments are marked sensitive, and the REST path each resource uses, which names the CLI path ("config system admin"). Changes: markdown removed, descriptions reduced to their first sentence; Terraform's own arguments left out. The commit used is recorded in the index. The data file is MPL-2.0 covered material. It is in this source repository as data/fortios.json.gz, and a copy is published with the ceplin binaries at https://ceplang.org/download/fortios.json.gz. This product includes data/iosxe.json.gz, the Cisco IOS XE configuration index behind identify(), built by tools/iosindex/build.py from: Cisco IOS XE Terraform provider (terraform-provider-iosxe) https://github.com/CiscoDevNet/terraform-provider-iosxe Copyright Cisco Systems, Inc. Licensed under the Mozilla Public License, v. 2.0 (https://mozilla.org/MPL/2.0/) From its resource definitions: each resource's path in the IOS XE native model and each attribute's path below it, read as the CLI's keywords. From its resource documentation: each attribute's description and which are sensitive. Changes: markdown removed, descriptions reduced to their first sentence; the CLI help's range prefix and text that describes nothing ("Choices:", "Range:", "DEPRECATED.") left out. The commit used is recorded in the index. The data file is MPL-2.0 covered material. It is in this source repository as data/iosxe.json.gz, and a copy is published with the ceplin binaries at https://ceplang.org/download/iosxe.json.gz. Cisco's YANG models themselves (Cisco API License) are not used. This product includes data/junos.json.gz, the Junos configuration index behind identify(), built by tools/junosindex/build.py from: Juniper Junos YANG models (Juniper/yang) https://github.com/Juniper/yang Copyright Juniper Networks, Inc. Licensed under the Apache License, Version 2.0 (the repository's licence; the model files also carry Juniper's copyright line) From the configuration modules of the junos, junos-es, junos-ex and junos-qfx families: the configuration tree (containers, lists and their keys, leaves), groupings expanded and choices dissolved as the CLI does, each node's description, and the junos:cli-feature "nokeyword" mark. Changes: descriptions whitespace-collapsed; the four families merged into one tree, each distinct subtree stored once. The release and commit used are recorded in the index. This product includes data/aws.json.gz, the AWS CLI index behind identify(), built by tools/awsindex/build.py from: AWS Command Line Interface (aws/aws-cli, branch v2) https://github.com/aws/aws-cli Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. Licensed under the Apache License, Version 2.0 From the service models it carries (awscli/botocore/data): each service's, operation's and input member's documentation. From its own sources, read as data: botocore's name transform and its exceptions, the services and parameters the CLI renames, the commands the CLI adds itself (s3 cp, configure set, eks update-kubeconfig, logs tail ...) with their options, and the global options (awscli/data/cli.json). Changes: HTML and headings removed, entities decoded, whitespace collapsed, descriptions reduced to their first sentence. The commit used is recorded in the index. This product includes data/az.json.gz, the Azure CLI index behind identify(), built by tools/azindex/build.py from: Azure CLI (Azure/azure-cli) https://github.com/Azure/azure-cli Copyright (c) Microsoft Corporation Licensed under the MIT License From its command modules and core, read as data: each command's and group's help (short-summary, and the parameters it describes), the parameters of each argument context and of each generated command, with their help, and where none describes a command or an option, its function's docstring. Azure CLI extensions (Azure/azure-cli-extensions, Azure/azure-devops-cli-extension) https://github.com/Azure/azure-cli-extensions https://github.com/Azure/azure-devops-cli-extension Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT License From the extensions' modules, read as data the same way: the commands and options they add (az devops, az repos, az quantum ...), kept apart from the core's and tagged with their own reference. Knack (microsoft/knack) https://github.com/microsoft/knack Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT License The help of the global options (--output, --query, --debug, ...). Changes: markdown and whitespace collapsed, descriptions reduced to their first sentence; text after a substitution left out. The commits used are recorded in the index. MIT License (this text, with the copyright lines above, also covers xCyclopedia and the NetScaler ADC Ansible collection): Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. This product includes data/clis.json.gz, the docker and kubectl index behind identify(), built by tools/cliref/build.py from: Docker CLI (docker/cli) https://github.com/docker/cli Copyright 2012-2017 Docker, Inc. Licensed under the Apache License, Version 2.0 Its NOTICE: "Docker. Copyright 2012-2017 Docker, Inc. This product includes software developed at Docker, Inc. (https://www.docker.com)." From its generated command reference (docs/reference/commandline): each command's description, its aliases, and the options table; the docker command's own options as the global ones. Docker Compose (docker/compose) and Docker Buildx (docker/buildx) https://github.com/docker/compose https://github.com/docker/buildx Copyright Docker, Inc. Licensed under the Apache License, Version 2.0 Docker Compose's NOTICE: "Docker Compose V2. Copyright 2020 Docker Compose authors. This product includes software developed at Docker, Inc. (https://www.docker.com)." From each plugin's generated command reference (docs/reference): the docker compose and docker buildx commands' descriptions, aliases and options. Kubernetes website (kubernetes/website) https://github.com/kubernetes/website Copyright The Kubernetes Authors Licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0, https://creativecommons.org/licenses/by/4.0/) From the generated kubectl reference (content/en/docs/reference/kubectl/generated): each command's description and options; the inherited (parent) options as the global ones. Licensed work; attribution: The Kubernetes Authors, from the Kubernetes documentation, no changes beyond those below. kubectl (kubernetes/kubectl) https://github.com/kubernetes/kubectl Copyright The Kubernetes Authors Licensed under the Apache License, Version 2.0 The aliases each command declares (create pdb is create poddisruptionbudget), read from its source as text. Changes: markup removed, whitespace collapsed, descriptions reduced to their first sentence. The commits used are recorded in the index. This product includes data/public_suffix_list.dat.gz, the Public Suffix List, unmodified apart from gzip compression, used by psl.go to find the registrable domain of a name ("sub.example.co.uk"[domain]). Public Suffix List https://publicsuffix.org/ Mozilla Foundation and contributors Licensed under the Mozilla Public License, v. 2.0 (https://mozilla.org/MPL/2.0/); the licence notice is at the head of the file itself, and a copy of the file is published with the ceplin binaries at https://ceplang.org/download/public_suffix_list.dat.gz. This product includes data/man.json.gz, the manual pages behind man(), built by tools/binindex/man.py. Each page is the source's own text cut into sections (synopsis, description, options, examples, see also), markup removed and hard-wrapped lines rejoined; the commit of each source is recorded inside. Microsoft Windows commands reference — https://github.com/MicrosoftDocs/windowsserverdocs Microsoft PowerShell reference (5.1) — https://github.com/MicrosoftDocs/PowerShell-Docs Creative Commons Attribution 4.0 International (CC BY 4.0, https://creativecommons.org/licenses/by/4.0/), Copyright (c) Microsoft Corporation Used: each command's and cmdlet's page in full. toybox — https://github.com/landley/toybox Zero-clause BSD licence (0BSD), Copyright (C) 2006, 2019 Rob Landley Used: the help text of each command outside toys/pending and toys/example, for Linux commands. tldr-pages — https://github.com/tldr-pages/tldr Creative Commons Attribution 4.0 International (CC BY 4.0, https://creativecommons.org/licenses/by/4.0/), Copyright (c) the tldr-pages team and contributors Used: summaries and all examples. Changes: markdown removed, placeholders unwrapped, short/long option pairs reduced to the long form. hashlookup() queries CIRCL hashlookup, or the deployment's own instance when CPLN_HASHLOOKUP_URL is set. Its results are shown with the provider named. CIRCL hashlookup — https://hashlookup.circl.lu Computer Incident Response Center Luxembourg (CIRCL) Data licensed under Creative Commons Attribution 4.0 (CC BY 4.0). Includes the NIST National Software Reference Library (NSRL) and package hashes from Ubuntu, CentOS, Fedora EPEL, Kali, openSUSE, OpenBSD, Snap and CDNJS. Response format: draft-dulaunoy-hashlookup-format.