A few days ago I noticed a twit referring to http://jex.im/regulex/, a home page for a cute engine that visualizes regular expressions. It is great!
If you struggle with regular expressions, or just want to toy around this is an excellent tool for learning and testing purposes; it may be also a good way to enrich forensic / investigation reports.
Let’s see what it can do by feeding it a few examples:
Track data
In my old post from 2012 about POS malware I mentioned a sample D9A3FB2BFAC89FEA2772C7A73A8422F2 that contains regular expressions used to parse track data; here they are:
- Track 1
- ((b|B)[0-9]{13,19}\^[A-Za-z\s]{0,30}\/[A-Za-z\s]{0,30}\^(0[7-9]|1[0-5])((0[1-9])|(1[0-2]))[0-9\s]{3,50}[0-9]{1})
- Track 2
- ([0-9]{15,16}[D=](0[7-9]|1[0-5])((0[1-9])|(1[0-2]))[0-9]{8,30})
Feeding them to Regulex gives us the following results:
- Track 1
- Track 2
When converted by Regulex, they make a lot of sense and are very readable.
Using an example regex to validate email presented on http://www.regular-expressions.info/email.html:
[a-z0-9!#$%&’*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&’*+/=?^_`{|}~-]+)*@ (?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+(?:[A-Z]{2}|com|org|net|edu|gov|mil| biz|info|mobi|name|aero|asia|jobs|museum)\b
we can get the following diagram:
Awesome, isn’t it ?
