Regular Expressions 101

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

Group 1(asp|aspx|jsp|php)

1st Alternativeasp

aspthe literal text asp (case sensitive)

2nd Alternativeaspx

aspxthe literal text aspx (case sensitive)

3rd Alternativejsp

jspthe literal text jsp (case sensitive)

4th Alternativephp

phpthe literal text php (case sensitive)

\?the literal ? (63₁₀ / 77₈ / 3F₁₆)

cmd=the literal text cmd= (case sensitive)

Character Class[a-z0-9%+\-]{3,20}

{3,20}matches between 3 and 20 characters from the set below:

a-zone character from a (97₁₀) to z (122₁₀) (case sensitive)

0-9one character from 0 (48₁₀) to 9 (57₁₀)

%the literal % (37₁₀ / 45₈ / 25₁₆)

+the literal + (43₁₀ / 53₈ / 2B₁₆)

\-the literal - (45₁₀ / 55₈ / 2D₁₆)

HTTPthe literal text HTTP (case sensitive)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

1the literal 1 (49₁₀ / 61₈ / 31₁₆)

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

Character Class[01]

0the literal 0 (48₁₀ / 60₈ / 30₁₆)

1the literal 1 (49₁₀ / 61₈ / 31₁₆)

Character Class["']?

?matches at most one character from the set below:

"the literal " (34₁₀ / 42₈ / 22₁₆)

'the literal ' (39₁₀ / 47₈ / 27₁₆)

200the literal text 200

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Detailed match information will be displayed here automatically.

Search reference

Regular Expression

\.(asp|aspx|jsp|php)\?cmd=[a-z0-9%+\-]{3,20} HTTP\/1\.[01]["']? 200

Test String
New

/helper.jsp?cmd=whoami HTTP/1.1 200
/cmd.aspx?cmd=whoami HTTP/1.1 404
/x.php?cmd=net%20user%20 HTTP/1.1 200
192.168.56.1 - - [15/Mar/2019:10:15:24 +0000] "GET /shells/simple1.php?cmd=ls+-la HTTP/1.1" 200

Regular Expression

Test StringNew

ExtractionProcessing...

Test String
New

Extraction
Processing...