Regex Quick Reference

(from http://regexr.com)

Character classes

.		any character except newline
\w \d \s	word, digit, whitespace
\W \D \S	not word, digit, whitespace
[abc]		any of a, b, or c
[^abc]		not a, b, or c
[a-g]		character between a & g

Anchors

^abc$		start / end of the string
\b \B		word, not-word boundary

Escaped characters

\. \* \\	escaped special characters
\t \n \r	tab, linefeed, carriage return
\u00A9		unicode escaped ©

Groups & Lookaround

(abc)		capture group
\1		backreference to group #1
(?:abc)		non-capturing group
(?=abc)		positive lookahead
(?!abc)		negative lookahead

Quantifiers & Alternation

a* a+ a?	0 or more, 1 or more, 0 or 1
a{5} a{2,}	exactly five, two or more
a{1,3}		between one & three
a+? a{2,}?	match as few as possible
ab|cd		match ab or cd

Full reference of patterns supported by DarkLight is available on this apache.org site

Match a URL

((http[s]?|ftp):\/)?\/?([^:\/\s]+)((\/\w+)*\/)([\w\-\.]+[^#?\s]+)(.*)?(#[\w\-]+)?
  • Sample: The web address is http://support.darklightcyber.com/doku.php/start:overview#darklight_overview
  • Capture Groups:
    1. http:/
    2. http
    3. support.darklightcyber.com
    4. /
    5. doku.php/start:overview
    6. #darklight_overview

Match a common E-mail address

Note: If you need to capture a domain longer than six characters (like ".restaurant") then adjust the 4 at the end.

([a-z0-9]+[_a-z0-9\.-]*[a-z0-9]+)@([a-z0-9-]+(?:\.[a-z0-9-]+)*(\.[a-z]{2,4}))
  • Sample: Our address is support@darklightcyber.com
  • Capture Groups:
    1. support
    2. darklightcyber.com
    3. .com

Match an IP Address

((?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])\.?){2})\.(?:((?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9]))\.)((?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])))(?::(\d{1,5}))?
  • Sample: The IP address is 192.168.5.12:9200
  • Capture Groups:
    1. 192.168
    2. 5
    3. 12
    4. 9200
  • tips/regex-cheatsheet
  • Last modified: 2019/03/29 23:21