OWASP - User contributions [en]

Regular Expression Security Cheatsheet

2016-10-05T12:11:40Z

Httpsonly: /* Introduction */

= Regular Expression Security Cheatsheet =

== Introduction ==

This cheatsheet can be effectively used by security specialists and programmers to reveal unwanted constructions in regular expressions, which can cause bypass of written rules. 
Despite original work was focused on finding "weak places" in regular expressions of Intrusion Detection Systems (WAFs), it can be effectively applied to any other code.
 
 

== Cheatsheet ==

Due to the fact, that OWASP's MediaWiki styling could not compete to Markdown, I decided not to include full table here, but provide a link to GitHub repository instead:
=== [https://github.com/attackercan/regexp-security-cheatsheet https://github.com/attackercan/regexp-security-cheatsheet] ===
 

== SAST ==

In order to save time for security practitioners, Static Application Security Testing tool was written. You can use the following code to analyse all regular expressions from your PHP project: 
<code>
grep -iorP "reg_\w+\s*\((\s*['\"](.*?)['\"])," * > regexp.txt && php index.php --file="./regexp.txt"
</code>

SAST can be downloaded from here:
=== [https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser] ===
 

=Authors and Primary Editors=

Vladimir Ivanov 
[http://twitter.com/httpsonly @httpsonly]

Regular Expression Security Cheatsheet

2016-10-05T12:11:32Z

Httpsonly: /* Introduction */

= Regular Expression Security Cheatsheet =

== Introduction ==

This cheatsheet can be effectively used by security specialists and programmers to reveal unwanted constructions in regular expressions, which can cause bypass of their rules. 
Despite original work was focused on finding "weak places" in regular expressions of Intrusion Detection Systems (WAFs), it can be effectively applied to any other code.
 
 

== Cheatsheet ==

Due to the fact, that OWASP's MediaWiki styling could not compete to Markdown, I decided not to include full table here, but provide a link to GitHub repository instead:
=== [https://github.com/attackercan/regexp-security-cheatsheet https://github.com/attackercan/regexp-security-cheatsheet] ===
 

== SAST ==

In order to save time for security practitioners, Static Application Security Testing tool was written. You can use the following code to analyse all regular expressions from your PHP project: 
<code>
grep -iorP "reg_\w+\s*\((\s*['\"](.*?)['\"])," * > regexp.txt && php index.php --file="./regexp.txt"
</code>

SAST can be downloaded from here:
=== [https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser] ===
 

=Authors and Primary Editors=

Vladimir Ivanov 
[http://twitter.com/httpsonly @httpsonly]

Regular Expression Security Cheatsheet

2016-10-05T12:11:18Z

Httpsonly: /* Introduction */

= Regular Expression Security Cheatsheet =

== Introduction ==

This cheatsheet can be effectively used by security specialists and programmers to reveal unwanted constructions in their regular expressions, which can cause bypass of their rules. 
Despite original work was focused on finding "weak places" in regular expressions of Intrusion Detection Systems (WAFs), it can be effectively applied to any other code.
 
 

== Cheatsheet ==

Due to the fact, that OWASP's MediaWiki styling could not compete to Markdown, I decided not to include full table here, but provide a link to GitHub repository instead:
=== [https://github.com/attackercan/regexp-security-cheatsheet https://github.com/attackercan/regexp-security-cheatsheet] ===
 

== SAST ==

In order to save time for security practitioners, Static Application Security Testing tool was written. You can use the following code to analyse all regular expressions from your PHP project: 
<code>
grep -iorP "reg_\w+\s*\((\s*['\"](.*?)['\"])," * > regexp.txt && php index.php --file="./regexp.txt"
</code>

SAST can be downloaded from here:
=== [https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser] ===
 

=Authors and Primary Editors=

Vladimir Ivanov 
[http://twitter.com/httpsonly @httpsonly]

Regular Expression Security Cheatsheet

2016-10-05T12:11:12Z

Httpsonly: /* Cheatsheet */

= Regular Expression Security Cheatsheet =

== Introduction ==

This cheatsheet can be effectively used by security specialists and programmers to reveal unwanted constructions in their regular expressions, which can cause bypass of their rules. 
Despite original work was focused on finding "weak places" in regular expressions of Intrusion Detection Systems (WAFs), it can be effectively applied to any other code.
 

== Cheatsheet ==

Due to the fact, that OWASP's MediaWiki styling could not compete to Markdown, I decided not to include full table here, but provide a link to GitHub repository instead:
=== [https://github.com/attackercan/regexp-security-cheatsheet https://github.com/attackercan/regexp-security-cheatsheet] ===
 

== SAST ==

In order to save time for security practitioners, Static Application Security Testing tool was written. You can use the following code to analyse all regular expressions from your PHP project: 
<code>
grep -iorP "reg_\w+\s*\((\s*['\"](.*?)['\"])," * > regexp.txt && php index.php --file="./regexp.txt"
</code>

SAST can be downloaded from here:
=== [https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser] ===
 

=Authors and Primary Editors=

Vladimir Ivanov 
[http://twitter.com/httpsonly @httpsonly]

Regular Expression Security Cheatsheet

2016-10-05T12:10:51Z

Httpsonly: /* Other Cheatsheets */

= Regular Expression Security Cheatsheet =

== Introduction ==

This cheatsheet can be effectively used by security specialists and programmers to reveal unwanted constructions in their regular expressions, which can cause bypass of their rules. 
Despite original work was focused on finding "weak places" in regular expressions of Intrusion Detection Systems (WAFs), it can be effectively applied to any other code.
 

== Cheatsheet ==

Due to the fact, that OWASP's MediaWiki styling could not compete to Markdown, I decided not to include full table here, but provide a link to GitHub repository instead:
=== [https://github.com/attackercan/regexp-security-cheatsheet https://github.com/attackercan/regexp-security-cheatsheet] ===

== SAST ==

In order to save time for security practitioners, Static Application Security Testing tool was written. You can use the following code to analyse all regular expressions from your PHP project: 
<code>
grep -iorP "reg_\w+\s*\((\s*['\"](.*?)['\"])," * > regexp.txt && php index.php --file="./regexp.txt"
</code>

SAST can be downloaded from here:
=== [https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser] ===
 

=Authors and Primary Editors=

Vladimir Ivanov 
[http://twitter.com/httpsonly @httpsonly]

Regular Expression Security Cheatsheet

2016-10-05T12:10:39Z

Httpsonly: /* Introduction */

= Regular Expression Security Cheatsheet =

== Introduction ==

This cheatsheet can be effectively used by security specialists and programmers to reveal unwanted constructions in their regular expressions, which can cause bypass of their rules. 
Despite original work was focused on finding "weak places" in regular expressions of Intrusion Detection Systems (WAFs), it can be effectively applied to any other code.
 

== Cheatsheet ==

Due to the fact, that OWASP's MediaWiki styling could not compete to Markdown, I decided not to include full table here, but provide a link to GitHub repository instead:
=== [https://github.com/attackercan/regexp-security-cheatsheet https://github.com/attackercan/regexp-security-cheatsheet] ===

== SAST ==

In order to save time for security practitioners, Static Application Security Testing tool was written. You can use the following code to analyse all regular expressions from your PHP project: 
<code>
grep -iorP "reg_\w+\s*\((\s*['\"](.*?)['\"])," * > regexp.txt && php index.php --file="./regexp.txt"
</code>

SAST can be downloaded from here:
=== [https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser] ===
 

=Authors and Primary Editors=

Vladimir Ivanov 
[http://twitter.com/httpsonly @httpsonly]

== Other Cheatsheets ==
{{Cheatsheet_Navigation}}

[[Category:Cheatsheets]]

Regular Expression Security Cheatsheet

2016-10-05T12:10:26Z

Httpsonly: /* https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser */

= Regular Expression Security Cheatsheet =

== Introduction ==

This cheatsheet can be effectively used by security specialists and programmers to reveal unwanted constructions in their regular expressions, which can cause bypass of their rules. 
Despite original work was focused on finding "weak places" in regular expressions of Intrusion Detection Systems (WAFs), it can be effectively applied to any other code.

== Cheatsheet ==

Due to the fact, that OWASP's MediaWiki styling could not compete to Markdown, I decided not to include full table here, but provide a link to GitHub repository instead:
=== [https://github.com/attackercan/regexp-security-cheatsheet https://github.com/attackercan/regexp-security-cheatsheet] ===

== SAST ==

In order to save time for security practitioners, Static Application Security Testing tool was written. You can use the following code to analyse all regular expressions from your PHP project: 
<code>
grep -iorP "reg_\w+\s*\((\s*['\"](.*?)['\"])," * > regexp.txt && php index.php --file="./regexp.txt"
</code>

SAST can be downloaded from here:
=== [https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser] ===
 

=Authors and Primary Editors=

Vladimir Ivanov 
[http://twitter.com/httpsonly @httpsonly]

== Other Cheatsheets ==
{{Cheatsheet_Navigation}}

[[Category:Cheatsheets]]

Regular Expression Security Cheatsheet

2016-10-05T12:10:10Z

Httpsonly: /* https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser */

= Regular Expression Security Cheatsheet =

== Introduction ==

This cheatsheet can be effectively used by security specialists and programmers to reveal unwanted constructions in their regular expressions, which can cause bypass of their rules. 
Despite original work was focused on finding "weak places" in regular expressions of Intrusion Detection Systems (WAFs), it can be effectively applied to any other code.

== Cheatsheet ==

Due to the fact, that OWASP's MediaWiki styling could not compete to Markdown, I decided not to include full table here, but provide a link to GitHub repository instead:
=== [https://github.com/attackercan/regexp-security-cheatsheet https://github.com/attackercan/regexp-security-cheatsheet] ===

== SAST ==

In order to save time for security practitioners, Static Application Security Testing tool was written. You can use the following code to analyse all regular expressions from your PHP project: 
<code>
grep -iorP "reg_\w+\s*\((\s*['\"](.*?)['\"])," * > regexp.txt && php index.php --file="./regexp.txt"
</code>

SAST can be downloaded from here:
=== [https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser] ===

=Authors and Primary Editors=

Vladimir Ivanov 
[http://twitter.com/httpsonly @httpsonly]

== Other Cheatsheets ==
{{Cheatsheet_Navigation}}

[[Category:Cheatsheets]]

Regular Expression Security Cheatsheet

2016-10-05T12:10:02Z

Httpsonly: /* Authors and Primary Editors */

= Regular Expression Security Cheatsheet =

== Introduction ==

This cheatsheet can be effectively used by security specialists and programmers to reveal unwanted constructions in their regular expressions, which can cause bypass of their rules. 
Despite original work was focused on finding "weak places" in regular expressions of Intrusion Detection Systems (WAFs), it can be effectively applied to any other code.

== Cheatsheet ==

Due to the fact, that OWASP's MediaWiki styling could not compete to Markdown, I decided not to include full table here, but provide a link to GitHub repository instead:
=== [https://github.com/attackercan/regexp-security-cheatsheet https://github.com/attackercan/regexp-security-cheatsheet] ===

== SAST ==

In order to save time for security practitioners, Static Application Security Testing tool was written. You can use the following code to analyse all regular expressions from your PHP project: 
<code>
grep -iorP "reg_\w+\s*\((\s*['\"](.*?)['\"])," * > regexp.txt && php index.php --file="./regexp.txt"
</code>

SAST can be downloaded from here:
=== [https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser] ===

(c) Vladimir Ivanov
@httpsonly

=Authors and Primary Editors=

Vladimir Ivanov 
[http://twitter.com/httpsonly @httpsonly]

== Other Cheatsheets ==
{{Cheatsheet_Navigation}}

[[Category:Cheatsheets]]

Regular Expression Security Cheatsheet

2016-10-05T12:09:26Z

Httpsonly: /* DRAFT CHEAT SHEET - WORK IN PROGRESS */

= Regular Expression Security Cheatsheet =

== Introduction ==

This cheatsheet can be effectively used by security specialists and programmers to reveal unwanted constructions in their regular expressions, which can cause bypass of their rules. 
Despite original work was focused on finding "weak places" in regular expressions of Intrusion Detection Systems (WAFs), it can be effectively applied to any other code.

== Cheatsheet ==

Due to the fact, that OWASP's MediaWiki styling could not compete to Markdown, I decided not to include full table here, but provide a link to GitHub repository instead:
=== [https://github.com/attackercan/regexp-security-cheatsheet https://github.com/attackercan/regexp-security-cheatsheet] ===

== SAST ==

In order to save time for security practitioners, Static Application Security Testing tool was written. You can use the following code to analyse all regular expressions from your PHP project: 
<code>
grep -iorP "reg_\w+\s*\((\s*['\"](.*?)['\"])," * > regexp.txt && php index.php --file="./regexp.txt"
</code>

SAST can be downloaded from here:
=== [https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser https://github.com/attackercan/regexp-security-cheatsheet/tree/master/RegexpSecurityParser] ===

(c) Vladimir Ivanov
@httpsonly

=Authors and Primary Editors=

TODO

== Other Cheatsheets ==
{{Cheatsheet_Navigation}}

[[Category:Cheatsheets]]