Questions tagged [regex]
security concerns around regular expressions; using them as security-critical filters, processing user-supplied regexes, vulnerabilities in regex parsers, etc.
25 questions
8
votes
1
answer
2k
views
Why should one use globs over regex when doing filename pattern matching?
I see that some tools that have to match filenames only support regex and not globs. Would these tools be using globs improve their security?
Is there a security aspect to using globs over regex when ...
- 181
1
vote
1
answer
96
views
ReDOS - Vulnerability found, but DOS not possible
I have an API which is protected by AWS Cloudfront. I found a ReDos in one of my API Endpoints. The endpoint looks like this:
https://mywebsite.com/api/myendpoint?apikey=xxxx&namefilter=yyyy
The ...
- 11
1
vote
0
answers
64
views
Is it possible to bypass a html <> regex? [closed]
I need to bypass a regex filter that filters all between <>
I tried almost everything, so this is my last chance.
The regex look like this: result.replace(/<[^>]*>?/gm, '');
I need to ...
- 11
0
votes
4
answers
348
views
How to bypass regex block of request?
I was asked the following question at a job interview recently:
You need to reach a web server at the IP address 20.21.22.23 via browser using HTTP. Browser checks the IP address and blocks requests ...
- 1
0
votes
0
answers
244
views
Stopping a Subscription Bomb
Are there any methods for stopping a subscription bomb other than issuing a new email address? Creating gmail filters is only getting us so far as there are more emails coming in than we can keep up ...
- 21
2
votes
2
answers
6k
views
How do I bypass a regex filter that filters all html to avoid xss?
How do I bypass a regex filter that filters all html to avoid xss? I've tried using things like <img src="aa" onerror="alert(1)"> but still no luck. This is for a CTF ...
- 21
0
votes
2
answers
2k
views
Is it possible to exploit preg_match similar to preg_replace PHP? [closed]
I'm currently working on a website and want to prevent characters being inputted, i am using following code
if (!preg_match("/^[a-zA-Z0-9_!,()& -\/]*$/"
is it possible to exploit this ...
- 1
1
vote
3
answers
884
views
Mailcleaner - Fail2ban - mc-exim-filter configuration
I'm using Fail2ban on a Mailcleaner server which works pretty good, but I want to update it to ban hosts who want to spoof our addresses. I'm using the "original" mc-exim-filter, but I don't ...
- 13
3
votes
1
answer
932
views
Email pattern ReDoS
I would like to verify that the input from the user complies to the format of email address (in Java application).
On the following page there is verbose regex that should properly validate the email ...
- 131
0
votes
1
answer
3k
views
Source of RegEx examples of Secret Detection patterns in repositories?
Where can I find RegEx that can pattern match common secret strings?
I have a product that scans repos and commits and in case a developer tries to commit a secret (i.e. passwords, keys). It scans for ...
- 21
1
vote
1
answer
1k
views
Possible to bypass this regex for XSS?
When testing for XSS, is it at all possible to bypass the below regex? I doubt it because it only accepts uppercase and lowercase letters, but maybe?
/^[A-Za-z]+$/
0
votes
0
answers
112
views
Is it safe to pass user input through rails gsub?
Are there risks associated with using gsub on user input? Can it be used for regular expression DoS?
- 101
1
vote
0
answers
274
views
Regex DoS: Is OWASP's characterization of "evil regexes" complete?
OWASP defines "evil regex" (here) as follows:
Evil Regexes
A Regex is called "evil" if it can stuck on crafted input.
Evil Regex pattern contains:
Grouping with repetition
...
- 1,297
0
votes
1
answer
452
views
What is the following regex trying to protect against?
I am looking at a Java web application that compares all incoming request params and cookies against the following regex. If it matches, it is considered "an attack" and refuses the request. I'm ...
- 105
2
votes
0
answers
3k
views
OAuth access token/API key patterns for large web sites
First off, let me preface this post by saying I'm not a security expert.
I'm trying to build regular expressions to find OAuth 2.0 access tokens and API Keys for common web sites such as Google, ...
- 121
0
votes
0
answers
830
views
What is the risk of allowing user input in Python's 're' module
Some context
I'm currently building an application which lets user's set up dynamic, queries they can execute later. A great addition to this seems like a regex module, in which users can filter ...
- 872
0
votes
0
answers
4k
views
Boolean blind SQLi with sqlmap
I am trying to run sqlmap in order to find a flag for a CTF. The injection string is sent via a POST request in the parameter called search. The response is received as either 1, 2, or 3 (error codes),...
2
votes
0
answers
268
views
Can a Regex without characters [(+*{}? be dangerous?
I want to create some functionality for non dangerous regex.
I want to accept only very few regex cases where it is safe to assume that they are not malicious (but still giving the user some ...
0
votes
1
answer
124
views
How to filter HTML Event in Native PHP7
i want to creating xss filter for my own project, this is for html event filtering
preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed));
but considering to more ...
2
votes
1
answer
483
views
Is this regular expression vulnerable to DoS?
FindBugs flagged the following email address validation regex as vulnerable to DoS:
^[\w!#$%&'*+/=?`{|}~^-]+(?:\.[\w!#$%&'*+/=?`{|}~^-]+)*@(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,6}$
Here's an easier ...
- 1,667
44
votes
8
answers
45k
views
Is it possible to detect 100% of SQLi with a simple regex?
I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex.
In other words, using very simple PHP code as an example:
if (preg_match("/select/i", $input)) {
...
- 15.9k
1
vote
3
answers
3k
views
What are the common features to identify Brute-Force attack from Apache log file?
There are various methods to find attack patterns for different types of attacks. Apache-scalp is one such tool, but the rule set is not available to find the brute-force attack pattern via regular ...
- 11
1
vote
1
answer
251
views
Alternative forms for special characters in terminal
I was solving a problem on a popular hacking for fun website, when I got following idea:
Is it possible to represent - for example a '/' (just the slash) in the terminal (linux) in another way - for ...
- 13
96
votes
6
answers
22k
views
Is it safe to let a user type a regex as a search input?
I was in a mall a few days ago and I searched for a shop on an indication panel.
Out of curiosity, I tried a search with (.+) and was a bit surprised to get the list of all the shops in the mall.
I'...
- 2,924
2
votes
0
answers
2k
views
Brute force hex password with exactly two special characters using JohnTheRipper
I want to optimize the way I'm using John the Ripper. I have a password with a know length (9) that consists only of (lower-case) hex characters and exactly two special characters.
First I tried ...
- 121