Regular Expressions Cheat Sheet

Regex used in grep, sed, awk, Python re, Burp, and most editors. Master the building blocks, then combine for payloads.

Basics

• Literal match cat matches “cat” anywhere
• Any single char . → c.t matches “cat”, “cbt”
• Start / end anchors ^foo (line starts), foo$ (line ends)
• Word boundary \bcat\b = standalone “cat” (not “scatter”)

Character Classes

• Set of chars [abc] any of a/b/c
• Range [a-z], [0-9], [A-F]
• Negation [^0-9] = not a digit
• Shorthand: \d digit, \w word char, \s whitespace (uppercase = negation: \D, \W, \S)

Quantifiers

• Zero or more c*t → “t”,”ct”,”cct”
• One or more c+t → “ct”,”cct”
• Zero or one (optional) colou?r → “color”,”colour”
• Exactly N \d{3} three digits
• N or more \d{3,} / between \d{3,5}

Grouping & Alternation

• Group (ab)+ → “ab”,”abab”
• Alternation cat|dog matches cat or dog
• Capturing vs non-capturing (?:...) non-capture
• Backreference (\w+)\s\1 matches repeated word “foo foo”

Lazy vs Greedy

• Greedy .*</div> grabs up to LAST </div>
• Lazy .*?</div> stops at first
• Use lazy when parsing between two close markers

Lookaround (PCRE/Python/JS, not grep -E by default)

• Positive lookahead foo(?=bar) — foo only if followed by bar
• Negative lookahead foo(?!bar) — foo not followed by bar
• Positive lookbehind (?<=>/ ) foo — extract after a marker

Common Security-Grep Patterns

• API keys / secrets
  • (?i)(api[_-]?key|secret|token|password)\s*[:=]\s*['"]?[a-z0-9_\-]{12,} (grep -Pi)
• URLs
  • https?://[a-z0-9._/-]+
• IPs \b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b
• Emails [a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}
• Base64 tokens [A-Za-z0-9+/]{40,}={0,2} (filter false positives [A-Za-z0-9+/=]{40,})
• AWS keys AKIA[0-9A-Z]{16}
• Private key block -----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----
• Phone \(?\d{3}\)?[\s.-]\d{3}[\s.-]\d{4}
• File paths /[a-zA-Z0-9_./-]{3,}\.(php|aspx|ashx|jsp|sql|bak) (lightweight)

Grep/Sed/Awk Regex Gotchas

• grep BRE vs ERE: use grep -E or grep -P
  • grep -EriN "user|pass" file
  • grep -P for lookarounds in ripgrep-less systems (rg = RIPGREP supports PCRE with -P)
• sed: sed -rn 's/secret=([^ ]+)/\1/p' file
• awk: awk -F'['{print $2}' for CSV-ish splits
• ripgrep: rg --pcre2 "token[=:]\s*\K[a-zA-Z0-9]{32}"

Testing

• Test online: regex101.com (Python/PCRE/JS flavors), regexper.com (visual graph)
• Mind escape: shell double-quotes need \\d; single-quote keeps it literal — prefer single quotes in shell