Regex CTF Challenges

Regex challenges come in several forms: bypassing a regex-based filter, exploiting ReDoS (Regular Expression Denial of Service), or crafting a string that matches/avoids a complex pattern.

Understanding Regex in CTF Context

Regex challenges usually fall into one of:

1. Filter bypass: find input that passes a regex check but does something unintended
2. ReDoS: craft input that causes catastrophic backtracking, timing oracle
3. Regex golf: write the shortest regex matching specific strings
4. Pattern matching: extract data from complex patterns

Challenge Types

# Vulnerable server code:
import re
user_input = request.args.get('cmd')
if re.search(r'rm|cat|ls|flag', user_input):
    return "Blocked!"
os.system(user_input)

Regex Matching Reference

import re

# Common patterns:
re.search(r'flag\{[a-f0-9_]+\}', text)  # hex flag format
re.findall(r'\b[A-Za-z0-9+/]{20,}={0,2}\b', text)  # base64
re.findall(r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}', text)  # IPv4
re.findall(r'[0-9a-f]{32}', text)  # MD5 hash
re.findall(r'[0-9a-f]{64}', text)  # SHA-256 hash

# Non-greedy vs greedy:
re.findall(r'<.*?>', html)   # non-greedy (finds each tag)
re.findall(r'<.*>', html)    # greedy (finds from first < to last >)

# Groups:
m = re.search(r'flag\{(\w+)\}', "The flag{secret} is here")
if m:
    print(m.group(1))  # → "secret"

Checklist

• Filter bypass: find alternative commands/syntax
• ReDoS: craft input with (a+)+ or similar to cause backtracking
• Timing oracle: measure response time differences
• Regex jail: craft input that's valid regex AND valid Python
• Data extraction: re.findall with flag format pattern

Last updated on Aug 1, 2025