// include the latest version of the regex crate in your Cargo.toml
extern crate regex;
use regex::Regex;
fn main() {
let regex = Regex::new(r#"^([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\s)([a-zA-Z0-9_.\[\]\(\)\-:\s]{1,})\s(ModSecurity:\sWarning.\s)([a-zA-Z0-9\"\/\_\.\[\]\(\)\-:\s]{1,})(\s\[severity "CRITICAL"\]\s)([a-zA-Z0-9\"\/\_\.\[\]\(\)\-:\s]{1,})\s("OWASP_CRS\/)"#).unwrap();
let string = "129.232.250.201 [Tue Apr 30 14:01:54 2019] [error] [pid 23850] apache2_util.c(271) [client 196.40.111.5:39554 ] - [client 196.40.111.5] ModSecurity: Warning. Matched phrase \"bin/bash\" at ARGS_NAMES:/bin/bash. [file \"/opt/modsecurity/owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf\"] [line \"503\"] [id \"932160\"] [msg \"Remote Command Execution: Unix Shell Code Found\"] [data \"Matched Data: bin/bash found within ARGS_NAMES:/bin/bash: /bin/bash\"] [severity \"CRITICAL\"] [ver \"OWASP_CRS/3.1.0\"] [tag \"application-multi\"] [tag \"language-shell\"] [tag \"platform-unix\"] [tag \"attack-rce\"] [tag \"OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION\"] [tag \"WASCTC/WASC-31\"] [tag \"OWASP_TOP_10/A1\"] [tag \"PCI/6.5.2\"] [hostname \"dedi-staging15.jnb1.host-h.net\"] [uri \"/test/\"] [unique_id \"XMg5MoHo@skAAF0qGI4AAAAE\"]";
// result will be a tuple containing the start and end indices for the first match in the string
let result = regex.captures(string);
let (start, end) = match result {
Some((s, e)) => (s, e),
None => {
// ...
}
};
println!("{}", &string[start, end]);
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Rust, please visit: https://docs.rs/regex/latest/regex/