I have heard about regular expressions popping up on the exam a lot.
Why do you need to know about regular expressions for the cyber ops exam.
Well that's because they're used in programming languages.
IPX signatures and data search tools.
Regular expressions are a sequence of characters that define a search pattern.
Think of them as just a really easy way to summarize information.
So if you wanted to match all of the public IP addresses on the Internet in an IPX rule instead of listening
each of them you could use a regular expression to only match the desired IP addresses with a few lines
instead of thousands.
This would keep the rule short and well organized.
Let's take a look at how they can be used for IPX signature rules.
Let's say I wanted to block any traffic that had the word hello in the payload.
That may sound easy enough but there are many ways to answer the word Hello.
How would I know which characters were lowercase or uppercase to match every variant of the word.
Well if I used a regular expression like the one seen here with one line I can match the word hello
presented.
In any case here's another good example.
For if we wanted to match a h t t p u r i containing bad word in any form.
So now that you have a basic understanding of what the point of regular expressions are let's hop into
my Lumix lab and we'll use regular expressions to search within the Linux system.
So on my Linux machine on the desktop I have this file called malware.
And if I open it up I have some text that says malicious file.
And one two three four or five and I just threw in some tax just so that we had something within the
file to search for.
With our regular expressions I put my terminal and how you can search for characters within Linux as
with the Gruppe command the grop command stands for Global regular expression print saw say look for
anything with the Word file all lowercase and you have to put brackets around your regular expressions
when you're defining them.
In the file located on my desktop named malware.
So this is going to search this file for the word file case so as you can see it did not find the word
file in all lowercase and I showed you that the words malicious file were in the malware file on my
desktop.
So what are we missing here.
Well like the example I showed you with the word Halo and matching lowercase or uppercase if you remember
the word file had a uppercase Salumi just put uppercase and see if we find it this time.
So there you go.
It was able to search through that file and display the line with the word file in.
So if I didn't remember if it was lowercase or uppercase I could use square brackets and put both lowercase
in uppercase and then when to search for the word file it would check for both file starting with lowercase
an uppercase of.
So let's run this and see if it finds at this time.
And there you go
OK.
So Knox let's search for the numbers within the malware file.
So let's say What if I do one two three four five
and then what if I saw that one two three four five six you can see that it did not match.
Because when you're just defining the actual text it has to be exact.
But if I were to use square brackets and say 1 through 6 then it's going to look and show me and the
line that has any number 1 through 6.
So if I did like 6 through 9 as you can see it did not show any results because I did not match the
line.
Now I just want to show you a few other common regular expression commands.
The care command is used to map the beginning of a string.
So I could say look through this file and find anything that starts with male so inserts that file.
And since this line started with mail it displayed
well through A-L.
You can see it did not work because this is only for at the very beginning of the line in other hand
the regular expression is the dollar sign which matches the end of a line.
So I could say anything in this file and with the number five match as a regular expression as you can
see it matched the string of one two three four or five.
Now if I did four it's not going to work because it's starting from there right at the end and working
its way in.
So if I were to put four or five then that would be an acceptable match with the dollar sign.
Regular expression to match the end of any string
OK.
Now you should have a basic understanding of how you can use regular expressions.
I have included some links as resources with this lecture that you can use to review to help you prepare
for the exam.