Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [regex]

security concerns around regular expressions; using them as security-critical filters, processing user-supplied regexes, vulnerabilities in regex parsers, etc.

0
votes
1answer
28 views

How to filter HTML Event in Native PHP7

i want to creating xss filter for my own project, this is for html event filtering preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed)); but considering to more ...
1
vote
1answer
97 views

Is this regular expression vulnerable to DoS?

FindBugs flagged the following email address validation regex as vulnerable to DoS: ^[\w!#$%&'*+/=?`{|}~^-]+(?:\.[\w!#$%&'*+/=?`{|}~^-]+)*@(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,6}$ Here's an easier ...
34
votes
6answers
15k views

Is it possible to detect 100% of SQLi with a simple regex?

I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex. In other words, using very simple PHP code as an example: if (preg_match("/select/i", $input)) { ...
0
votes
0answers
115 views

What are the common features to identify Brute-Force attack from Apache log file?

There are various methods to find attack patterns for different types of attacks. Apache-scalp is one such tool, but the rule set is not available to find the brute-force attack pattern via regular ...
1
vote
1answer
69 views

Alternative forms for special characters in terminal

I was solving a problem on a popular hacking for fun website, when I got following idea: Is it possible to represent - for example a '/' (just the slash) in the terminal (linux) in another way - for ...
90
votes
6answers
16k views

Is it safe to let a user type a regex as a search input?

I was in a mall a few days ago and I searched for a shop on an indication panel. Out of curiosity, I tried a search with (.+) and was a bit surprised to get the list of all the shops in the mall. I'...
2
votes
0answers
310 views

Brute force hex password with exactly two special characters using JohnTheRipper

I want to optimize the way I'm using John the Ripper. I have a password with a know length (9) that consists only of (lower-case) hex characters and exactly two special characters. First I tried ...