Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I often come across sites that have way to many comments included in their source code, sometimes these comments offer valuable insight into whats happening in the code, the logic of functions, unused (but still present) 'features' and sometimes even vulnerabilties are documented in comments.

Given the wealth of information available I always take the time to review pages i find important, but in larger sites this becomes rather tedious to do.

Are there any available tools that will strip out (with a link back to the original page) all the comments found in the source code of a page?

I'm kinda thinking like the Notepad++ feature of 'Find text in files' which provides you with the line that matched and a path to the source.

Bonus points for ones that can parse comments in multiple languages (i see VB Script (and comments) included in pages sometimes)

share|improve this question

closed as off topic by bethlakshmi, Adi, AJ Henderson, Gilles, Rory Alsop May 26 '13 at 23:20

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

I fail to see how this is security related. What am I missing? – Christoffer May 15 '13 at 6:16
@Christoffer Developers sometimes use "dirty" hacks and they document them. Most of the time you get lucky and their hacks are vulnerable... – Dr.Ü May 15 '13 at 7:50
@Christoffer What Dr.Ü said! I'm testing from a security perspective, and as a way to map the application when testing. Sometimes its just helpful, other times people leave passwords, developer information, back-end config details, server IP's etc in the code. All of which are potentially useful to me as an attacker :) – NULLZ May 15 '13 at 9:21
I think it's not very security related. Your intended purpose maybe, but extracting comments in itself would be a stackoverflow question (or perhaps a superuser one, but I don't think it takes an entire tool as Adnan showed with his regex). – Luc May 15 '13 at 11:28
@Luc and yet its part of Burp Suite which is specifically designed to perform security testing of web applications. – NULLZ May 15 '13 at 12:06
up vote 9 down vote accepted

Well, it's not really a tool, but it'll get you started. This RegEx matches many kinds of comments (# comments, HTML comments, JavaScript comments, and VBScript comments).


And here's a demo

Note: Be sure to set the g and m flags

Update: I thought it'd be a good idea to mention some ways to use it.

You can use that RegEx with sed on httrack results. Another possibility is to pack this in a bash script where you pass the URL and catch it with $1 then wget/curl it and finally sed the page after prepending $1 to mark the file with the URL to the page.

share|improve this answer
+1 this is what I would do. curl piped to sed. – lynks May 15 '13 at 13:38
You get the prize, the Burp feature is, unfortunately, a Paid feature only :( – NULLZ May 16 '13 at 13:01
thank you thank you thank you! this regular expression saved me alot of work! only one problem is that it is selecting assuming that // inside strings are comments, but i think i can work with it – John The Ripper Jun 16 '13 at 21:54

what I use for this is burp suite. It has a "find comments" feature (documentation here) which can be used for this.

That said I'm not sure exactly how it works and so whether it'll find all comments including more obscure languages, but still a useful feature.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.