Questions tagged [regex]

security concerns around regular expressions; using them as security-critical filters, processing user-supplied regexes, vulnerabilities in regex parsers, etc.

Filter by
Sorted by
Tagged with
0
votes
0answers
7 views

Guacamole Fail2Ban Regex [migrated]

I am trying some regex code into /etc/fail2ban/filter.d/guacamole.conf and can't grep the syslog errors. For example \bAuthentication attempt from \[<HOST>(?:,.*)?\] for user ".*" ...
-2
votes
1answer
83 views

Source of RegEx examples of Secret Detection patterns in repositories?

Where can I find RegEx that can pattern match common secret strings? I have a product that scans repos and commits and in case a developer tries to commit a secret (i.e. passwords, keys). It scans for ...
0
votes
0answers
48 views

Regular expression Denial of Service (ReDoS) case

In my application code, one person noticed that one line with regular expression is vulnerable to a Regular expression Denial of Service (ReDoS) attack. I did not have much contact with this topic, ...
1
vote
1answer
98 views

Possible to bypass this regex for XSS?

When testing for XSS, is it at all possible to bypass the below regex? I doubt it because it only accepts uppercase and lowercase letters, but maybe? /^[A-Za-z]+$/
0
votes
0answers
34 views

Is it safe to pass user input through rails gsub?

Are there risks associated with using gsub on user input? Can it be used for regular expression DoS?
1
vote
0answers
106 views

Regex DoS: Is OWASP's characterization of “evil regexes” complete?

OWASP defines "evil regex" (here) as follows: Evil Regexes A Regex is called "evil" if it can stuck on crafted input. Evil Regex pattern contains: Grouping with repetition ...
0
votes
1answer
127 views

What is the following regex trying to protect against?

I am looking at a Java web application that compares all incoming request params and cookies against the following regex. If it matches, it is considered "an attack" and refuses the request. I'm ...
1
vote
0answers
890 views

OAuth access token/API key patterns for large web sites

First off, let me preface this post by saying I'm not a security expert. I'm trying to build regular expressions to find OAuth 2.0 access tokens and API Keys for common web sites such as Google, ...
0
votes
0answers
365 views

What is the risk of allowing user input in Python's 're' module

Some context I'm currently building an application which lets user's set up dynamic, queries they can execute later. A great addition to this seems like a regex module, in which users can filter ...
0
votes
0answers
990 views

Boolean blind SQLi with sqlmap

I am trying to run sqlmap in order to find a flag for a CTF. The injection string is sent via a POST request in the parameter called search. The response is received as either 1, 2, or 3 (error codes),...
2
votes
0answers
168 views

Can a Regex without characters [(+*{}? be dangerous?

I want to create some functionality for non dangerous regex. I want to accept only very few regex cases where it is safe to assume that they are not malicious (but still giving the user some ...
0
votes
1answer
34 views

How to filter HTML Event in Native PHP7

i want to creating xss filter for my own project, this is for html event filtering preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed)); but considering to more ...
1
vote
1answer
288 views

Is this regular expression vulnerable to DoS?

FindBugs flagged the following email address validation regex as vulnerable to DoS: ^[\w!#$%&'*+/=?`{|}~^-]+(?:\.[\w!#$%&'*+/=?`{|}~^-]+)*@(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,6}$ Here's an easier ...
37
votes
7answers
23k views

Is it possible to detect 100% of SQLi with a simple regex?

I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex. In other words, using very simple PHP code as an example: if (preg_match("/select/i", $input)) { ...
0
votes
1answer
710 views

What are the common features to identify Brute-Force attack from Apache log file?

There are various methods to find attack patterns for different types of attacks. Apache-scalp is one such tool, but the rule set is not available to find the brute-force attack pattern via regular ...
1
vote
1answer
82 views

Alternative forms for special characters in terminal

I was solving a problem on a popular hacking for fun website, when I got following idea: Is it possible to represent - for example a '/' (just the slash) in the terminal (linux) in another way - for ...
95
votes
6answers
18k views

Is it safe to let a user type a regex as a search input?

I was in a mall a few days ago and I searched for a shop on an indication panel. Out of curiosity, I tried a search with (.+) and was a bit surprised to get the list of all the shops in the mall. I'...
2
votes
0answers
733 views

Brute force hex password with exactly two special characters using JohnTheRipper

I want to optimize the way I'm using John the Ripper. I have a password with a know length (9) that consists only of (lower-case) hex characters and exactly two special characters. First I tried ...