Scribd
Upload
34 views2 pages

Regex Cheat Sheet: Anchors Special Characters

This regular expression cheat sheet provides summaries of common regular expression patterns used in digital forensics and incident response (DFIR). It includes regular expressions to match hashes, IP addresses, MAC addresses, email addresses, URLs, and Windows/directory file paths. Character classes, quantifiers, anchors, and other regex tokens are also defined.

Uploaded by

Dhanraj chavan
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
34 views2 pages

Regex Cheat Sheet: Anchors Special Characters

This regular expression cheat sheet provides summaries of common regular expression patterns used in digital forensics and incident response (DFIR). It includes regular expressions to match hashes, IP addresses, MAC addresses, email addresses, URLs, and Windows/directory file paths. Character classes, quantifiers, anchors, and other regex tokens are also defined.

Uploaded by

Dhanraj chavan
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 2

RegEx Cheat Sheet

Anchors Special Characters


^ Start of line \ Escape character
\A Start of string \n New line
$ End of line \r Carriage return
\Z End of string \r Tab
\b Word boundary \v Vertical tab
\B Not word boundary \f Form feed
\< Start of word \a Alarm
\> End of word [\b] Backspace
\e Escape
Character Classes
\c Control character Ranges
\s White space . Any character except new line
\S Not white space (a|b) a or b
\d Digit (…) Group
\D Not digit (?:…) Passive Group
\w Word [^abc] Not a or b or c
\W Not word [a-q] Lowercase letter between a
and q
\xhh Hex character
[A-Q] Uppercase letter between A
and Q
Quantifiers [0-7] Digit between 0 and 7
* 0 or more
+ 1 or more Assertions
? 0 or 1 (?=) Lookahead assertion
{3} Exactly 3 (?!) Negative lookahead
{3,} 3 or more (?<=) Lookbehind assertion
{3,5} 3, 4, or 5 + (?!=) or (?<!) Negative Lookbehind
(?()) If Then Condition
Pattern Modifiers (?()|) If Then Else Condition
g Global match (?#) Comment
i Case insensitive
s String as single line Metacharacters . * + ? ^ $ [ () { . \
m Multiple lines (Escape These!)
U Ungreedy pattern

http://networkdefense.io - http://regextraining.com
Common DFIR RegEx
Common Hash Formats
MD5 [a-fA-F0-9]{32} SHA256 [a-fA-F0-9]{64}
SHA1 [a-fA-F0-9]{40} SHA512 [a-fA-F0-9]{128}

IP Addresses
IPv4 (Simple) (?:\d{1,3}\.){3}\d{1,3}
IPv4 (Accurate) (?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-
9]|[01]?[0-9][0-9]?)
IPv6 (?:[a-fA-F0-9]{1,4}:){7}[a-fA-F0-9]{1,4}

MAC Address
MAC [0-9A-F]{2}([-:]?)(?:[0-9A-F]{2}\1){4}[0-9A-F]{2}

Encoding / Data Format


Base64 ^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$
Hex /^#?([a-f0-9]{6}|[a-f0-9]{3})$/

E-Mail
Address /^([a-z0-9_\.-]+)@([\da-z\.-]+)\.([a-z\.]{2,6})$/

URLs
Constituent parts of (?i)(?<URL>(?<scheme>https?)://(?<domain>[^/:]+(?<=\.(?<TL
HTTP/HTTPS URL - D>[^/:]+)))(?(?=:):(?<port>\d{1,5})|)(?(?=/)(?<URI>/[^/]+)+(?<f
Insensitive inline modifier ile>/[^.]+\.\S+)?))

Constituent parts of (<URL>(?<scheme>[hH][tT]{2}[pP][sS]?)://(?<domain>[^/:]


HTTP/HTTPS URL - No +(?<=\.(?<TLD>[^/:]+)))(?(?=:):(?<port>\d{1,5})|)(?(?=/)(?<U
modifier RI>/[^/]+)+(?<file>/[^.]+\.\S+)?))

Directory/File Path
Drive (?x)(?>\b[a-z]:|\\\\[a-z0-9 %._~-]{1,63}\\[a-z0-9 $%._~-]{1,80})\\
Folder (?>[^\\/:*?"<>|\x00-\x1F]{0,254}[^.\\/:*?"<>|\x00-\x1F]\\)*
File (?>[^\\/:*?"<>|\x00-\x1F]{0,254}[^.\\/:*?"<>|\x00-\x1F])?
Standard Path (?>\b[a-z]:|\\\\[a-z0-9 %._~-]{1,63}\\[a-z0-9 $%._~-
]{1,80})\\(?>[^\\/:*?"<>|\x00-\x1F]{0,254}[^.\\/:*?"<>|\x00-
\x1F]\\)*(?>[^\\/:*?"<>|\x00-\x1F]{0,254}[^.\\/:*?"<>|\x00-\x1F])?
Windows Path [a-z]:\\(?>[^\\/:*?"<>|\x00-\x1F]{0,254}[^.\\/:*?"<>|\x00-
\x1F]\\)*(?>[^\\/:*?"<>|\x00-\x1F]{0,254}[^.\\/:*?"<>|\x00-\x1F])?

http://networkdefense.io - http://regextraining.com

You might also like