Regular Expressions AKA RegEx, regexp, regexes, are often available to leverage without even realizing they are available.
What are RedEx? A set of matching a string of text which have subcomponents such as Literals & metacharacters Literals - just text char that describe what regex will match Metacharacters are special regex char that act as operators, telling the regex how to perform match
Examples of RegEx and what they perform
- . single char match
- * match 0 or more
- ¥ begins w/
- $ ends w/
- {5-9} range match
- _ beg & end string, (,), {}, ()
- can also use '_' to seperate items
- + match 1 or more in seq
- ? matches 0 or1 occurences
- l 'or'
- and '\'
- [] any char listed btwn brackets
- [¥] any except those listed in brackets
- '-' hypen - anything from a-z
- Boolean operators:
- \ = and
- l = or
- ~ = not
Simple Examples
- find orig from local ¥$
- permit any = .*
- ¥54$ can't handle prepended routes
- _54$ can handle prepended routes
- ¥85[¥0-5]$ will match range from 856-859
- ¥85[0123456789]$ matches 850,851 etc. thru 859
- ¥1_701_(_5646_/_1240_).* matches 1, 701, 5646, 1240
- regexp w/ logical 'and' _3550_(.*)2400_/_2400(.*)3500_
- match all prefixes transiting as300_300_
- match all prefixes transiting dir conn as200 = ¥200_
- config rtr to accept routes that transit AS123 & AS456_123(_.+)?_456_
- Display all rtes that didn't orig in your AS. 'sho ip bgp regex .+'
- Display all rtes that orig in your AS. 'sho ip bgp regex ¥$'
- regex for confeds
- () used to denote confed set, match using esc seq '\'
- math any prefix learned by confed peer '¥\(.*\)$'
- this wont match prefix localky orig in locl sub-as
- pull together ' (¥\(.*\)$)l(¥$
Use Cases: RegEx's have lots of use cases, here are some I have used
APIs - build patterns to help match, manage and edit text quickly
IT Automation tools such as:
- Red Hat Ansible
- Hashicorp Terraform has RegEx built-in the product itself and thus easy to use in daily tasks
Data Protection such as Commvault Metallic performing OneDrive discovery steps
Data Science including AI/ML - making sense of all the Big Data
Linux/UNIX - Awk and Sed to bring value to your searching
Logging - in such products as LogicMonitor query language uses RegEx as well as in Splunk and their query language
Programming languages such as:
- C++
- C#
- GoLang
- JAVA & JavaScript
- Perl - specifically Perl PCRE supports RegEx
- Python
- TCL/TK (AKA Tool Command Language)
Router configs - such as BGP Communities, BGP Confederation, Route-map Policy List
Some simple examples can be found above
Security software such as:
- CyberArk
- Fortinet FortiGate
VoIP Dial Plans could use RegEx to limit Long Distance calling
Etc..
RegEx Resources
Lots of free RegEx cheat sheets and resources are available on the interwebs. Just bring up your Presearch engine and search away for RegEx
Summary - As you can see we only touched on the surface RegEx. RegEx has lots of use in Information technology, can you envision hackers using RegEx to increase their productivity for site recon? Knowing the basis of RegEx will you expand how much you know about them?
