Regular Expressions 101

Save & Share

Flavor

  • PCRE2 (PHP >=7.3)
  • PCRE (PHP <7.3)
  • ECMAScript (JavaScript)
  • Python
  • Golang
  • Java 8
  • .NET 7.0 (C#)
  • Rust
  • Regex Flavor Guide

Function

  • Match
  • Substitution
  • List
  • Unit Tests

Tools

Sponsors
There are currently no sponsors. Become a sponsor today!
An explanation of your regex will be automatically generated as you type.
Detailed match information will be displayed here automatically.
  • All Tokens
  • Common Tokens
  • General Tokens
  • Anchors
  • Meta Sequences
  • Quantifiers
  • Group Constructs
  • Character Classes
  • Flags/Modifiers
  • Substitution
  • A single character of: a, b or c
    [abc]
  • A character except: a, b or c
    [^abc]
  • A character in the range: a-z
    [a-z]
  • A character not in the range: a-z
    [^a-z]
  • A character in the range: a-z or A-Z
    [a-zA-Z]
  • Any single character
    .
  • Alternate - match either a or b
    a|b
  • Any whitespace character
    \s
  • Any non-whitespace character
    \S
  • Any digit
    \d
  • Any non-digit
    \D
  • Any word character
    \w
  • Any non-word character
    \W
  • Non-capturing group
    (?:...)
  • Capturing group
    (...)
  • Zero or one of a
    a?
  • Zero or more of a
    a*
  • One or more of a
    a+
  • Exactly 3 of a
    a{3}
  • 3 or more of a
    a{3,}
  • Between 3 and 6 of a
    a{3,6}
  • Start of string
    ^
  • End of string
    $
  • A word boundary
    \b
  • Non-word boundary
    \B

Regular Expression
No Match

`
`
g

Test String

Code Generator

Language

Generated Code

using System; using System.Text.RegularExpressions; public class Example { public static void Main() { string pattern = @"\s([a-zA-Z]+://)*(\b([a-zA-Z][\w-]*\.){1,3}[a-zA-Z0-9]+|(\b((2[0-4]\d|25[0-5]|1\d\d|0\d\d|0\d|\d\d|\d)\.){3}(2[0-4]\d|25[0-5]|1\d\d|0\d\d|0\d|\d\d|\d)\b))(:\d+)*([\\\!\""\#\$\%\&\'\(\)\*\+\-\/\:\;\<\=\>\?\@\[\]\^\`\{\|\}\~\.\w])*(\,.+\.[a-z]+)*"; string input = @"they all call home to 194.68.59.34:2018, 192[.]168[.]1[.]1 hxxp://securedownload2.duckdns.org:7373/docs/ @JAMESWT_MHT abc://www.hhghg.ghgh.jkjkjk.jkjkj.jkjk #LokiBot @ hxxp://xupfile.duckdns.org:1133/$59,200.exe https://www.reverse.it/sam\ple/529b10d3faaa143c074d0f25ee75c8e9bad7f5982ead482d6c0c19a39d207b68?environmentId=100 … 255.2.3.4 194.68.59.34:2018, www.virustotal.com C2: hta.duckdns.org:7373/excel/fre.php http://www.virustotal.com/en/file/a94f7db23f64985f22a4250886db0d67e3cc1fbf59ef3d1bf9ffd28d3357d3f7/analysis/1511168707/ … dasdasd hxxp://172.106.75.131/temp/amazingdoz.exe dasdasd hxxp://172.1d06.75.131/temp/amazingdoz.exe https://www.virustotal.com/#/url/2512afa822b8cadbe9e2fa0ecda5ad55d6024b0694fecf265282a63ef88058cf/detection … hxxp://www.dk-fyn.dk/ebgate/ri.php hxxp://www.fourthtour.it/rus/tour/php.scr hxxp://www.foxydance.cz/repository/ri.php hxxp://www.sabineclaire.com/girasoli/ri.php,1212 sdfsdfsdsdfsdf https://www.reverse.it/sample/b57bd0dec0873bea8e47a16e1da41aafa817ae11d536c90cb7aec6d6686b686e?environmentId=100 … hxxp://www.sabineclaire.com/girasoli/ri.php sdf.bom fasdkj adsflk jasldk fjalskd fjslaskjdf lkaj dsfl So, I've got a matching set of Trojan.Nymeria samples https://www.virustotal.com/en/file/0e6ac6a1db6fdeb8d85edfdd9f33761b2877ae46399f30dee7335e1783ef53c9/analysis/ … … https://www.virustotal.com/en/file/9178e59b6e2227cccf137f5b3c259035d3750f2dfc3314f9e326fb0995a2862c/analysis/ … … https://www.virustotal.com/en/file/0eae5dd0655ca17db3c6b6c7fb921405d82533bb619b12de010b449de1322efd/analysis/ … … https://www.virustotal.com/en/file/394af1f36a36b631cfa48158314dc378c8dba5307f79d86d7262aaa86a694089/analysis/ … … they all call home to 194.68.59.34:2018"; foreach (Match m in Regex.Matches(input, pattern)) { Console.WriteLine("'{0}' found at index {1}.", m.Value, m.Index); } } }

Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for C#, please visit: https://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex(v=vs.110).aspx