Sunday, February 07, 2010

Forensic Regexes

The other day on the #volatility channel we were discussing how it might be nice to have a list of Perl Regex for common things like IP addresses etc. Here are a few items we came up with:

IP Address: (?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)

MAC Address: ([a-fA-F0-9]{2}\:){5}[a-fA-F0-9]{2}

URL: (http|https|ftp|mail)\:[\/\w.]+

Email: [A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4}

You can find some other Regex expressions on the SANS blog however the regex expression for IP addresses matches items like 999.999.999.999, which we know is not a valid IP address.

There's a nice post by geek00l listed at the bottom of the SANS post which links to other interesting posts.

Other references of interest:
Regex Reference

What would you like to add to the list?


Anonymous said...

which we know is not a valid ip address

Jamie Levy said...

thanks for the fix.

Jeff - KK4ETK said...

Three good REGEX builders are:


Regex Creator

Rad Software Regular Expression Designer

All three have strengths, and it really depends on what you're doing.

Jamie Levy said...

@Kiddo thanks for the links :-)

cdf123 said...

Here's the ones I've used, broken into nice bite-sized pieces, I put these in an include file and source it.

my $REG0TO255="(2([0-4][0-9]|5[0-5])|1[0-9]?[0-9]|[1-9][0-9]?|[0-9])";
my $REGIP = $REG0TO255 . "(\\." . $REG0TO255 . "){3}";

my $REGVAL="(255|254|252|248|240|224|192|128|0)";
my $REGMASK = "((255\.){3}" . $REGVAL . "|(255\.){2}" . $REGVAL . "(\.0){1}|(255\.){1}" . $REGVAL . "(\.0){2}|" . $REGVAL . '(\.0){3})';

my $REGCIDR = '(3[0-2]|[12][0-9]|[0-9])';

Jamie Levy said...

@cdf123 Cool! Thanks for sharing :-)