using System;
using System.Text.RegularExpressions;
public class Example
{
public static void Main()
{
string pattern = @"(?x)^
(?P<remote_host>\S+) \s+ # host %h
\S+ \s+ # indent %l (unused)
(?P<remote_user>\S+) \s+ # user %u
\[(?P<time_received>.*?)\] \s+ # time %t
""(?P<request>.*?)"" \s+ # request ""%r""
(?P<status>[0-9]+) \s+ # status %>s
(?P<response_bytes_clf>\S+) (?:\s+ # size %b (careful, can be '-')
""(?P<referrer>[^""?\s]*[^""]*)"" \s+ # referrer ""%{Referer}i""
""(?P<user_agent>.*? )"" (?:\s+ # user agent ""%{User-agent}i""
""[^""]*"" )?)? # optional argument (unused)
$";
string input = @"190.2.7.178 - - [21/Dec/2011:05:47:03 +0000] ""GET /gnu3/index.php?doc=../../../../../../../proc/self/environ%00 HTTP/1.1"" 404 273 ""-"" ""<?php system(\""id\""); ?>""
190.2.7.178 - - [21/Dec/2011:05:47:04 +0000] ""GET /gnu/index.php?doc=../../../../../../../proc/self/environ%00 HTTP/1.1"" 404 271 ""-"" ""<?php system(\""id\""); ?>""
190.2.7.178 - - [21/Dec/2011:05:47:04 +0000] ""GET /phpgwapi/setup/tables_update.inc.php?appdir=../../../../../../../proc/self/environ%00 HTTP/1.1"" 404 286 ""-"" ""<?php system(\""id\""); ?>""
190.2.7.178 - - [21/Dec/2011:05:47:05 +0000] ""GET /forum/install.php?phpbb_root_dir=../../../../../../../proc/self/environ%00 HTTP/1.1"" 404 274 ""-"" ""<?php system(\""id\""); ?>""
190.2.7.178 - - [21/Dec/2011:05:47:06 +0000] ""GET /includes/calendar.php?phpc_root_path=../../../../../../../proc/self/environ%00 HTTP/1.1"" 404 275 ""-"" ""<?php system(\""id\""); ?>""
190.2.7.178 - - [21/Dec/2011:05:47:06 +0000] ""GET /includes/setup.php?phpc_root_path=../../../../../../../proc/self/environ%00 HTTP/1.1"" 404 273 ""-"" ""<?php system(\""id\""); ?>""
190.2.7.178 - - [21/Dec/2011:05:47:07 +0000] ""GET /inc/authform.inc.php?path_pre=../../../../../../../proc/self/environ%00 HTTP/1.1"" 404 275 ""-"" ""<?php system(\""id\""); ?>""
190.2.7.178 - - [21/Dec/2011:05:47:07 +0000] ""GET /include/authform.inc.php?path_pre=../../../../../../../proc/self/environ%00 HTTP/1.1"" 404 278 ""-"" ""<?php system(\""id\""); ?>""
190.2.7.178 - - [21/Dec/2011:05:47:08 +0000] ""GET /index.php?nic=../../../../../../../proc/self/environ%00 HTTP/1.1"" 200 4399 ""-"" ""<?php system(\""id\""); ?>""
190.2.7.178 - - [21/Dec/2011:05:47:11 +0000] ""GET /index.php?sec=../../../../../../../proc/self/environ%00 HTTP/1.1"" 200 4399 ""-"" ""<?php system(\""id\""); ?>""
123.125.71.79 - - [28/Apr/2012:08:12:57 +0100] ""GET /robots.txt HTTP/1.1"" 404 268 ""-"" ""Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)""
157.56.95.126 - - [28/Apr/2012:10:23:02 +0100] ""GET /robots.txt HTTP/1.1"" 404 268 ""-"" ""msnbot/2.0b (+http://search.msn.com/msnbot.htm)""
157.56.95.126 - - [28/Apr/2012:10:23:02 +0100] ""GET / HTTP/1.1"" 200 4399 ""-"" ""msnbot/2.0b (+http://search.msn.com/msnbot.htm)""
110.75.173.193 - - [28/Apr/2012:11:57:26 +0100] ""GET / HTTP/1.1"" 200 4399 ""-"" ""Yahoo! Slurp China""";
RegexOptions options = RegexOptions.Multiline;
foreach (Match m in Regex.Matches(input, pattern, options))
{
Console.WriteLine("'{0}' found at index {1}.", m.Value, m.Index);
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for C#, please visit: https://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex(v=vs.110).aspx