Downloaded 24 times
![RegEx Basics: Literal Matches
Literal Matches
‘bat’ matches ‘bat’
12 special characters - ^ $ . | ? * + ( ) [ ]
These must be escaped ‘’ ‘$’
.
‘.at’ Matches ‘bat’, ‘cat’, and ‘hat’](https://image.slidesharecdn.com/regex-public-131204120546-phpapp01/85/Regex-101-6-320.jpg)
![RegEx Basics: Characture Classes
Character Classes
• -- [ ]
‘[bc]at’ will match ‘bat’ or ‘cat’
• --[^ ]
[^A-Z] will match any character that is not a capitol
letter](https://image.slidesharecdn.com/regex-public-131204120546-phpapp01/85/Regex-101-7-320.jpg)
![RegEx Basics: Shorthand Character Classes
Shorthand Character Classes
• d
Same as [0-9]
• D
Same as [^0-9]
• w
Same as [0-9A-Za-z_]
• W
Same as [^0-9A-Za-z_]
• s
tab, line feed, form feed, carriage return, and space
• S
Anything other than tab, line feed, etc.](https://image.slidesharecdn.com/regex-public-131204120546-phpapp01/85/Regex-101-8-320.jpg)
![RegEx Basics: Anchors
Anchors
• ^
Beginning of line
‘rpm -qa|grep ^ao’ would list all packages that start with
‘ao’
• $
End of line
‘[0-9][0-9][0-9]$’ would find all instances when a line
ended with 3 consecutive digits
• b b
Word boundary
‘bW.n*b’ looks for words that begin with ‘W’ followed by
any character followed by ‘n’ followed by zero or more
characters
‘Win’ ‘Windows’ ‘Won’ ‘Wonton’ ‘Winter’
‘Wonderland’ ‘Wonder’ all match](https://image.slidesharecdn.com/regex-public-131204120546-phpapp01/85/Regex-101-9-320.jpg)
![Uses: Searches (Cont.)
• DOM XSS
((src|href|data|location|code|value|action)s*["']]*
s*+?s*=)|((replace|assign|navigate|getResponseHea
der|open(Dialog)?|showModalDialog|eval|evaluate|e
xecCommand|execScript|setTimeout|setInterval)s*["'
]]*s*()
• DOM XSS
(locations*[[.])|([.[]s*["']?s*(arguments|dialogArg
uments|innerHTML|write(ln)?|open(Dialog)?|showMo
dalDialog|cookie|URL|documentURI|baseURI|referrer
|name|opener|parent|top|content|self|frames)W)|(
localStorage|sessionStorage|Database)](https://image.slidesharecdn.com/regex-public-131204120546-phpapp01/85/Regex-101-15-320.jpg)
![Uses: Searching Logs
• grep -v 156.132.142.[11-19]
/var/log/apache2/other_vhosts_access.log|grep
-v 156.132.103.*
• cat
/var/log/apache2/other_vhosts_access.log|grep
-o 's[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[09]{1,3}s' | sort -t . -k 3,3n -k 4,4n|uniq](https://image.slidesharecdn.com/regex-public-131204120546-phpapp01/85/Regex-101-16-320.jpg)
![Uses: VI Search and Replace
• SS#
:%s/d{3}-d{2}-d{4}/123-45-6789/g
• email
:%s/[0-9A-Za-z._%+-]+@[0-9A-Za-z._%+-]+.[AZa-z]{2,4}/john.doe@ao.uscourts.gov/g](https://image.slidesharecdn.com/regex-public-131204120546-phpapp01/85/Regex-101-17-320.jpg)
![Useful RegExes
• SS#
d{3}-d{2}-d{4}
• Phone#
((?d{3})?[ -.])?d{3}[ -.]d{4}
• IP Addresses
b((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).){3}
(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)b
• email
[0-9A-Z._%+-]+@[0-9A-Z._%+-]+.[A-Z]{2,4}
• Find Base64
(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?
• Credit Card# - HTML Tags - Dates](https://image.slidesharecdn.com/regex-public-131204120546-phpapp01/85/Regex-101-21-320.jpg)
Regex 101
This document provides an overview of regular expressions (RegEx). It explains what RegEx is, some basic RegEx syntax like character classes and anchors, and common uses of RegEx like searching logs and programming. Useful regular expressions are also included, such as for social security numbers, phone numbers, and email addresses. Questions are welcomed at the end.
More Related Content
Regex 101
- 1.
- 2. Overview • • • • What is RegEx RegExBasics Uses for RegEx Useful RegExpressions
- 3. What is RegEx? “Incomputing, a regular expression (abbreviated regex or regexp) is a sequence of characters that forms a search pattern, mainly for use in pattern matching with strings, or string matching, i.e. "find and replace"-like operations. “ - Wikipedia
- 4. • “Some people,when confronted with a problem, think ‘I know, I'll use regular expressions.’ Now they have two problems.” Jamie Zawinski
- 5. Why RegEx? • Toolsuse it: Nessus, Burp, W3AF • All programming languages use it • Excellent tool to have in the toolbox
- 6. RegEx Basics: LiteralMatches Literal Matches ‘bat’ matches ‘bat’ 12 special characters - ^ $ . | ? * + ( ) [ ] These must be escaped ‘’ ‘$’ . ‘.at’ Matches ‘bat’, ‘cat’, and ‘hat’
- 7. RegEx Basics: CharactureClasses Character Classes • -- [ ] ‘[bc]at’ will match ‘bat’ or ‘cat’ • --[^ ] [^A-Z] will match any character that is not a capitol letter
- 8. RegEx Basics: ShorthandCharacter Classes Shorthand Character Classes • d Same as [0-9] • D Same as [^0-9] • w Same as [0-9A-Za-z_] • W Same as [^0-9A-Za-z_] • s tab, line feed, form feed, carriage return, and space • S Anything other than tab, line feed, etc.
- 9. RegEx Basics: Anchors Anchors •^ Beginning of line ‘rpm -qa|grep ^ao’ would list all packages that start with ‘ao’ • $ End of line ‘[0-9][0-9][0-9]$’ would find all instances when a line ended with 3 consecutive digits • b b Word boundary ‘bW.n*b’ looks for words that begin with ‘W’ followed by any character followed by ‘n’ followed by zero or more characters ‘Win’ ‘Windows’ ‘Won’ ‘Wonton’ ‘Winter’ ‘Wonderland’ ‘Wonder’ all match
- 10. RegEx Basics: Non-Printable Non-printable •-- n New Line • -- r Carriage Return
- 11. RegEx Basics: Groups Groups •--( ) Defines the scope and precedence of operators ‘Write(ln)?’ matches ‘Write’ and ‘Writeln’ • -- | OR ‘Gr(a|e)y’ matches ‘Gray’ and ‘Grey’ ‘(ITSO|OITS)’ matches ‘ITSO’ or ‘OITS’
- 12. RegEx Basics: Quantification Quantification Showshow often a token or group is allowed to occur • ? Zero or one ‘a?’ will match ‘’ and ‘a’ • * Zero or more ‘a*’ will match ‘’ and ‘a’ and ‘aaaaaaaaa’
- 13. RegEx Basics: Quantification(Cont.) Quantification Shows how often a token or group is allowed to occur • + One or more ‘a+’ will match ‘a’ and ‘aaaaaaaaaaaa’ • {,} Minimum and Maximum ‘a{3,7}’ will match between 3 and 7 ‘a’
- 14.
- 15. Uses: Searches (Cont.) •DOM XSS ((src|href|data|location|code|value|action)s*["']]* s*+?s*=)|((replace|assign|navigate|getResponseHea der|open(Dialog)?|showModalDialog|eval|evaluate|e xecCommand|execScript|setTimeout|setInterval)s*["' ]]*s*() • DOM XSS (locations*[[.])|([.[]s*["']?s*(arguments|dialogArg uments|innerHTML|write(ln)?|open(Dialog)?|showMo dalDialog|cookie|URL|documentURI|baseURI|referrer |name|opener|parent|top|content|self|frames)W)|( localStorage|sessionStorage|Database)
- 16. Uses: Searching Logs •grep -v 156.132.142.[11-19] /var/log/apache2/other_vhosts_access.log|grep -v 156.132.103.* • cat /var/log/apache2/other_vhosts_access.log|grep -o 's[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[09]{1,3}s' | sort -t . -k 3,3n -k 4,4n|uniq
- 17. Uses: VI Searchand Replace • SS# :%s/d{3}-d{2}-d{4}/123-45-6789/g • email :%s/[0-9A-Za-z._%+-]+@[0-9A-Za-z._%+-]+.[AZa-z]{2,4}/john.doe@ao.uscourts.gov/g
- 18. Uses: Command Line opensslciphers|sed ‘s/:/n/g'|sort
- 19. Uses: Output Mangaling whileread line; do host $line; done < ips.txt | sed 's/ has address / / /g‘ > foo.txt
- 20. Uses: Programming • Sanitizinginput $name = preg_replace("/<s*?/?scripts*?>/i", "<script>", $name);
- 21. Useful RegExes • SS# d{3}-d{2}-d{4} •Phone# ((?d{3})?[ -.])?d{3}[ -.]d{4} • IP Addresses b((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).){3} (25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)b • email [0-9A-Z._%+-]+@[0-9A-Z._%+-]+.[A-Z]{2,4} • Find Base64 (?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)? • Credit Card# - HTML Tags - Dates
- 22.
- 23. Go forth andRegEx…
- 24. References • • • • • • Web Application Hacker'sHandbook http://regex.info/blog/2006-09-15/247#comment-3085 http://en.wikipedia.org/wiki/Regular_expression https://isc.sans.edu/regex.html http://www.regular-expressions.info/examples.html http://blog.spiderlabs.com/2013/02/easy-dom-basedxss-detection-via-regexes.html • https://en.wikipedia.org/wiki/Regular_expression • www.xkcd.com