AI
Regex Basics: Anchors and Wildcards
Adam explained that regex is a state machine. Literal matches find exact strings like “hello”. Word boundaries (\b) prevent false positives such as “supercomputer” matching “computer”. Anchors ^ and $ force strings to start or end with a pattern. The period . acts as a wildcard for any character except newline. Developers often forget to escape it with \, leading to bypasses. Character sets like [A-Z] and quantifiers like +?*{n,m} allow flexible matching. Groups () extract subpatterns.
PostMessage and Open Redirect Flaws
Adam used postMessage as an example. A regex checking the origin https?://www\.trusted\.com lacked a $ anchor. An attacker could register www.trusted.com.attacker.com and send malicious data. Missing \ before the period allowed wwwXtrusted.com. In open redirects, a regex allowing (www\.)?trusted\.com without ^ passed URLs like trusted.com.evil.com. Ben shared a $14,000 account takeover from a missing slash check in a redirect path.
CORS and SSRF Bypasses
Adam covered CORS preflight checks. A regex with an unescaped period allowed domains like xlinkedin.com to read API responses. Missing $ let evil.com be appended. For SSRF, a regex expecting linkedin.com but using . as wildcard let xlinkedin.com point to localhost. Adding a ^ and escaping the period fixed it. Ben noted that even with a fixed regex, attackers can use an open redirect on the allowed domain to reach internal services.
GitHub Recon with Regex
Ben explained his shift from traditional subdomain tools to GitHub regex searches. He uses patterns like [a-z0-9-]+\.site\.com to find subdomains behind wildcard certificates. By adding keywords like api or dev, he extracts context. One search found a Jfrog instance leaking source code for a $5,000 bounty. Another revealed a Dutch company’s API routes and username generation scheme worth $5,000. He also found four Spring Boot actuator heap dumps at $3,000 each by searching for leaked paths.
Code Review and Tool Building
Adam showed regex for static analysis: find echo $_GET[ or system( to spot XSS and RCE. Searching for base64 strings [A-Za-z0-9+/]+= catches credentials. He built “creatures of habit”, a tool that crawls GitHub packages to extract routes from Flask, Laravel, and other frameworks, generating wordlists for brute-force. Ben added that many companies open-source internal frameworks, so you can download their code and hunt for vulnerabilities.
Q&A
How do you parse actuator heap dumps? Ben runs strings on the dump then pipes through grep with regex to find JWT tokens, bearer tokens, and cookie values. ▶ 49:02
Notable Quotes
this catches so many developers out and it leads to very interesting results Adam Langley · ▶ 08:29
And that got $14,000 I believe Ben Sadeghipour · ▶ 27:37
somebody I promise you has leaked it on GitHub but you just got to be able to find it with a good reax Ben Sadeghipour · ▶ 40:26
Key Takeaways
- Missing anchors and unescaped periods cause most regex bypasses in web security.
- GitHub regex searches uncover subdomains, API routes, and secrets not found by standard tools.
- Regex in static analysis can find XSS, RCE, and credentials in source code.
About the Speaker(s)
Ben Sadeghipour, better known as NahamSec, is an ethical hacker, content creator, and keynote speaker. Over his career, Ben has uncovered thousands of security vulnerabilities for major organizations, including Amazon, Apple, Zoom, Meta, Google, and the U.S. Department of Defense. As a top-ranked bug bounty hunter, he is deeply passionate about cybersecurity education, regularly sharing his knowledge through his popular YouTube channel and speaking at major conferences like DEFCON and BSides. Beyond his personal achievements, Ben is committed to building the security community, organizing events that foster collaboration, innovation, and the next generation of offensive security professionals.
For over 20 years, Adam Langley has balanced the worlds of application security and web development. He currently serves as the CTO of HackingHub and the Director of BSides Exeter. Over the past five years, he has combined his expertise to create and deliver gamified educational content, aimed at teaching the next generation of ethical hackers and developers about web application security.