Video Screencast Help

Regular expressions with new line

Created: 03 Jul 2012 • Updated: 31 Oct 2012 | 3 comments
AMyers6671's picture
This issue has been solved. See solution.

We are trying to implement a regular expression to find passwords stored in the clear with Network Discover. We are using a regular expression to do so. The regex looks like this:

^.*(?=.{8,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%^&+=!]).*$

I won't claim to be a regex guru but I've gotten this to work on files if they have only one password on one line. If I put several test passwords on multiple lines it will not match anything. If I change the regex to read as this:

(?m-isx:^.*(?=.{8,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[@#0^&+=!]).*$)

I end up matching everything on every line of any text.

Any help here would be greatly appreciated.

Thanks,
Aaron

Comments 3 CommentsJump to latest comment

Mohammad Ashkaibi's picture

Hi Aaron

Honestly my experience in regex is with PGP rather than DLP. Once I opened a case with Tech Support because I wanted to know why using a certain regex (which I googled somewhere) gives "Invalid Condition" message in the PGP Universal server. The regex I tried to use is:

\b(?<!-)((4\d{3})|(5[1-5]\d{2})|(6011))([ -]?)\d{4}\5\d{4}\5\d{4}(?!-)\b|(\b)(?<!-)3[4,7]\d{13}(?!-)\b

I wanted to match outgoing emails with Visa credit card numbers in their bodies/titles. Support Engineer told me this is a 'Microsoft' style regex rather that 'Postgre' style so PGP UN couldn't accept it.

 

Please have a look at my fresh post related to this topic and I hope you find something useful:

https://www-secure.symantec.com/connect/forums/matching-visa-regex-and-pgp#comment-7897681

Good luck! yes

 

- Moh

DLP Solutions's picture

Aaron,

I am not sure what passwords you are looking for. If you are looking for passwords that are similar in format to waht is in a Linux Passwd file, then look at the template that is included on the system for Passwords.

 

That policy has a REGEX that might be helpful to you on how it detects passwords.

 

Good luck

 

Ronak

Please make sure to mark this as a solution

to your problem, when possible.

 

AMyers6671's picture

We were able to accomplish the task with the following regex

[\s][\w!@#$%^&*]{8}(?<=[\d][\w!@#$%^&*]{0,7})(?<=[a-z][\w!@#$%^&*]{0,7})(?<=[A-Z][\w!@#$%^&*]{0,7})(?<=[!@#$%^&*][\w!@#$%^&*]{0,7})[\s]

Thanks,
Aaron

If this post has helped you, please vote up or mark as solution to help others looking for the same data.

 

SOLUTION