This writing is based on what I learned while studying for OSWE. OSWE is an exam from OffSec that focuses on attacking web applications through white-box testing, which means analyzing the application’s source code. To make it easier for me to identify and map possible vulnerabilities, I use regular expressions, or regex, to search for interesting functions, patterns, and code.

This guide mainly focuses on using regex in VS Code and terminal tools.

Vulnerabilities That Can Be Searched Using Regex

Some common OSWE vulnerabilities can be searched by looking for related functions or patterns, such as:

  • SQL injection
  • Broken authentication
  • Command or code injection
  • Path traversal and LFI
  • Server-Side Template Injection
  • Cross-Site Scripting
  • Insecure deserialization
  • Unsafe string replacement
  • Weak whitelist validation
  • Weak blacklist validation

The regex will be different depending on the programming language, framework, coding style, and vulnerability being tested.

Vulnerabilities That Are Harder to Find Using Regex

Some vulnerabilities cannot be reliably found using regex, such as:

  • Business logic vulnerabilities
  • Broken Access Control
  • Race conditions
  • Workflow or state-related vulnerabilities

This is because there are too many possible ways these vulnerabilities can appear in an application.

Regex may help locate related code, but finding these vulnerabilities usually requires understanding the application flow, user roles, permissions, and how different features interact with each other.

Different programming languages and frameworks use different syntax and functions, so the regex and testing method must also be adjusted. A pattern that works for one codebase may not work for another. Regex is only a starting point manual code analysis is still required.

Cat All sources

First of All to make it easy sometimes im using this for terminal use, this is to cat all source code because sometimes in OSWE RDP run pretty slow. Sometimes we cant truly open Code Editor GUI we have two option then, if we dont want to cat all source, we can use grep -r to search to inside the file directly.

Auto Read All Extensions

Linux:

find . -type f -name "*.class" -exec sh -c '
for f do
    echo "== $f =="
    cat "$f"
done
' sh {} +

Windows:

Get-ChildItem -Recurse -File -Filter *.go | ForEach-Object {
    Write-Host "= $($_.FullName) ="
    Get-Content $_.FullName
}
  • SQL injection
  • Command/Code Injection
  • Path Traversal LFI
  • SSTI
  • XSS
  • insecure deserialization
  • str replace regex
  • whitelist regex (per vulnerabilities)
  • blacklist regex (per vulnerabilites)

Regex

Below is some regex i use for certain vulnerabilities and scenarios

SQL Injection

Its quite straightforward for SQLi the best way is by finding some string concatenation inside query.

  • find sql query → string concat with +/.

the best regex so far:

^(?!.*(\?|\$\d+|:\w+|@\w+|%s)).*\b(select|insert|update|delete)\b.*\b(from|where|set)\b.*["']\s*(\+|\.)\s*[$@A-Za-z_]

grep -Pir '(?i)^(?!.*(\?|\$\d+|:\w+|@\w+|%s)).*\b(select|insert|update|delete)\b.*\b(from|where|set)\b.*["'\'']\s*(\+|\.)\s*[$@A-Za-z_]' .

my alternative might be usefull:

(pg_query|mysqli_query|mysql_query|PDO->query|PDO->exec)\s*\(.(\$|\$_GET|\$_POST|\$_REQUEST).\)

(pg_query|mysqli_query|mysql_query|PDO->query|PDO->exec)\s*\(.*\.\s*\$.*\)

Broken Authentication

  • The objective is to find all API paths or routes in the source code.
  • Each programming language and framework may define routes differently.
  • In TypeScript, a route may look like:
function handler("/api/...", ...)
  • We can use grep to collect all matching API paths:
grep -r 'api handler("/api'
  • After collecting the routes, clean and format the results so they can be used as a payload list in Burp Suite Intruder.
  • In Python Frappe, a handler with allow_guest=true may be accessible without authentication.
  • In Go, routes can be extracted and saved into a clean file:
grep -e "/v" gateway/gateway.go | cut -d "(" -f 2 | cut -d "," -f 1 | cut -d "\"" -f 2 | sort > routes_clean.txt
  • The most important step is to test the collected paths in Burp Suite Intruder using different HTTP methods.
  • Check whether any endpoint can be accessed without valid authentication.
Payload set 1: GET, POST
Payload set 2: routes_clean.txt
Attack type: Cluster bomb

Command/Code Injection

Finding the execution command possibility in the source code.

command injection

(?i)\b(system|exec|popen|passthru|shell_exec|subprocess\.(Popen|call|run)|Runtime\.getRuntime\(\)\.exec|child_process\.(exec|execSync|spawn))\b

code injection

(?i)\b(eval|exec|assert|new\s+Function|setTimeout|setInterval|compile)\s*\(

(system|exec|subprocess|Runtime\.getRuntime).?\+.?(input|req|\$_)

SSTI

The flow of SSTI always like this:

user input → template render → no sanitization

what is the sanitization ?→ identify template not using sanitization

SSTI (Server Side Template Injection) - HackTricks

Below is the regex in different situation of language

php

\b(smarty|latte|mustache|blade|twig|plates|phplib|HTML_Template_PHPLIB|pattemplate)\b

python

\b(jinja2|tornado|mako|pystache|cheetah|bottle|chameleon)\b

NodeJs

\b(handlebars|Jsrender|pugjs|pug|nunjucks|vm2|isolated-vm|dustjs|twig|velocityjs|dot)\b

ruby

\b(erb|slim|erubi|erubis|haml)\b

java

\b(velocity|freemmarker|thymeleaf|pebble|jinjava|hubspot|hubl|el|groofy)\b

combined

\b(smarty|latte|mustache|blade|twig|plates|phplib|HTML_Template_PHPLIB|pattemplate|jinja2|tornado|mako|pystache|cheetah|bottle|chameleon|handlebars|Jsrender|pugjs|nunjucks|vm2|isolated-vm|dustjs|velocityjs|dot|erb|slim|erubi|erubis|haml|velocity|freemmarker|thymeleaf|pebble|jinjava|hubspot|hubl|el|groofy|razor|mojolicious)\b

.Net ⇒ Razor

Golang ⇒ template

Insecure Deserialization

Quite straightforward just finding this in source code guaranteed identify Insecure Deserialization.

serialize

unserialize

deserialize

jsonpickle

(?i)\b(unserialize|pickle\.loads|yaml\.load|readObject|BinaryFormatter\.Deserialize)\b

File Upload

Identify this word that manual check the source code.

upload

upload(

XSS

The flow of XSS should be:

user input → output → no escaping

regex php output

(echo|print|printf)\s*\(?.\$.\)?

(<script[^>]>.\$\w+.*<\/script>)

generic heuristic regex

(<[^>]+>\s*.*(\$|req\.|request\.|params|query|form|input|location|document\.URL))

(?i)(echo|print|response|res\.send|innerHTML|document\.write).*(\$\w+|request|req|params|query|location)

potential DOM Based

(?i)(echo|print|response|res\.send|innerHTML|document\.write).*(\$\w+|request|req|params|query|location)

Path Traversal LFI

try to find this in source code.

(?i)\b(include|require|include_once|require_once)\s*\(

Another Possible Vulnerabilites

  • String Replacement

Use this regex to find common string replacement functions:

(?i)\b(replace|replaceAll|str_replace|preg_replace|regexp_replace|re\.sub)\s*\(

Terminal example:

rg -n -i '\b(replace|replaceAll|str_replace|preg_replace|regexp_replace|re\.sub)\s*\(' .
  • Whitelist Validation

Use this regex to find code that only allows specific characters, values, extensions, or patterns:

(?i)\b(whitelist|allowlist|allowed|valid|permitted)\w*\b|(\^?\[[a-zA-Z0-9_\\\-]+\][+*?]?\$?)

It can help locate validation such as:

^[a-zA-Z0-9_]+$

Review whether the whitelist is incomplete or can be bypassed for the vulnerability being tested.

  • Blacklist Validation

Use this regex to find blocked characters, keywords, extensions, or functions:

(?i)\b(blacklist|blocklist|blocked|forbidden|denied|disallowed|sanitize|filter)\w*\b

To find common blacklist checks:

(?i)(includes|contains|indexOf|match|search|test)\s*\([^)]*(script|select|union|exec|system|\.\.|<|>|;|\|)

Blacklist validation should be reviewed carefully because attackers may bypass it using encoding, case changes, alternative syntax, or unexpected input formats.

Wrapping Up

Regex can make source code review faster, but it should not replace manual analysis. The main goal is still to understand how the application works, trace user input, and identify whether suspicious code can actually be exploited.

Different languages and frameworks will require different search patterns and testing methods. Treat these regex examples as a starting point, then adjust them based on the target codebase.