> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2023/web-exploitation/regex.md).

# Regex

<figure><img src="/files/i6BBXCzVBtSKN73vNxNu" alt=""><figcaption></figcaption></figure>

### What is Regex?

A regular expression (regex) is a sequence of characters that defines a search pattern. It is mainly used for pattern matching in strings, such as finding, replacing, or validating text. Regex is supported in almost every programming language, including Python, Java, C++ and JavaScript. Think of regex as a **search pattern** — like a more powerful version of Ctrl+F. Instead of searching for an exact word, you describe *what you're looking for* using special characters.

There's a lot of patterns in where you can find here:

{% embed url="<https://www.geeksforgeeks.org/dsa/write-regular-expressions/>" %}

For example:

```
\d{3}-\d{3}-\d{4}
```

This means: *"3 digits, a dash, 3 digits, a dash, 4 digits"* → matches `123-456-7890`

### ReDos

Regular Expression Denial of Service (ReDoS) is a type of attack that exploits the fact that certain regular expressions can take an extremely long time to process, causing applications or services to become unresponsive or crash.&#x20;

```
(a+)+ 
```

Two quantifiers, same characters, infinite ambiguity, because we're trying to match a+ while also having another +, we have this backtracking infinite loop.

### Solving It

<figure><img src="/files/5lvisMOYSz7ziLw4sz2a" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/j0KwCEiCAAGVZi2Xprw1" alt=""><figcaption></figcaption></figure>