regex101: PCRE (Legacy) Match Workspace

(?i)applies the following effective flags to the remainder of the pattern: gmi

i modifier: insensitive. Matches without distinguishing uppercase and lowercase letters

Group 1(%(25){0,}20|\s)*

*repeats the group contents below any number of times:

1st Alternative%(25){0,}20

%the literal % (37₁₀ / 45₈ / 25₁₆)

Group 2(25){0,}

{0,}repeats the group contents below any number of times:

25the literal text 25

20the literal text 20

2nd Alternative\s

\sany whitespace character

Group 3(%(25){0,}24|\$)

1st Alternative%(25){0,}24

%the literal % (37₁₀ / 45₈ / 25₁₆)

Group 4(25){0,}

{0,}repeats the group contents below any number of times:

25the literal text 25

24the literal text 24

2nd Alternative\$

\$the literal $ (36₁₀ / 44₈ / 24₁₆)

Group 5(%(25){0,}20|\s)*

*repeats the group contents below any number of times:

1st Alternative%(25){0,}20

%the literal % (37₁₀ / 45₈ / 25₁₆)

Group 6(25){0,}

{0,}repeats the group contents below any number of times:

25the literal text 25

20the literal text 20

2nd Alternative\s

\sany whitespace character

Group 7(%(25){0,}7B|{)

1st Alternative%(25){0,}7B

%the literal % (37₁₀ / 45₈ / 25₁₆)

Group 8(25){0,}

{0,}repeats the group contents below any number of times:

25the literal text 25

7Bthe literal text 7B (case insensitive)

2nd Alternative{

{the literal { (123₁₀ / 173₈ / 7B₁₆)

Group 9(%(25){0,}20|\s)*

*repeats the group contents below any number of times:

1st Alternative%(25){0,}20

%the literal % (37₁₀ / 45₈ / 25₁₆)

Group 10(25){0,}

{0,}repeats the group contents below any number of times:

25the literal text 25

20the literal text 20

2nd Alternative\s

\sany whitespace character

Group 11(%(25){0,}(6A|4A)|J)

1st Alternative%(25){0,}(6A|4A)

%the literal % (37₁₀ / 45₈ / 25₁₆)

Group 12(25){0,}

{0,}repeats the group contents below any number of times:

25the literal text 25

Group 13(6A|4A)

1st Alternative6A

2nd Alternative4A

2nd AlternativeJ

Group 14(%(25){0,}(6E|4E)|N)

Group 17(%(25){0,}(64|44)|D)

Group 20(%(25){0,}(69|49)|I)

Group 23(%(25){0,}20|\s)*

Group 25(%(25){0,}3A|:)

Character Class[\w\%]+

Group 27(%(25){1,}3A|:)

Group 29(%(25){1,}2F|\/)

Negated Character Class[^\n]+

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Search reference

Regular Expression

(?i)(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{)(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)[^\n]+

New

Sample Log4j strings:
${JNDI:LDAP://
${JNDI:LDAPS://
${JNDI:RMI://
${JNDI:DNS://
${JNDI:NIS://
${JNDI:IIOP://
${JNDI:CORBA://
${JNDI:NDS://
${JNDI:HTTPS://
${JNDI:HTTP://
 $ { JNDI :LDAPS://
  $  {  JNDI  :LDAPS://
${jNDi:l%252564ap://

JNDI = %6A%6E%64%69
jndi = %4A%4E%44%49

Multi-encoding log4j strings (without spaces):
%24%7B%6A%6E%64%69%3A%2F
%2524%257B%256A%256E%2564%2569%253A
%2524%257B%256A%256E%2564%2569%253A%252F
%252524%25257B%25256A%25256E%252564%252569%25253A%25252F

Multi-URL Encoded string characters:
(?i)
(%(25){0,}20|\s)*
(%(25){0,}24|$)
(%(25){0,}20|\s)*
(%(25){0,}7B|{)
(%(25){0,}20|\s)*
(%(25){0,}(6A|4A)|J)
(%(25){0,}(6E|4E)|N)
(%(25){0,}(64|44)|D)
(%(25){0,}(69|49)|I)
(%(25){0,}20|\s)*
(%(25){0,}3A|:)
(%(25){0,}2F|\/)
[\w\%]+
(%(25){0,}3A|:)
(%(25){0,}2F|\/)