Regular Expression · passage 2 of 3

Evil Regex

1 code block · Regular Expression/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Evil Regex contains: * Grouping with repetition * Inside the repeated group: * Repetition * Alternation with overlapping **Examples**: * `(a+)+` * `([a-zA-Z]+)*` * `(a|aa)+` * `(a|a?)+` * `(.*a){x}` for x \> 10 These regular expressions can be exploited with `aaaaaaaaaaaaaaaaaaaaaaaa!` (20 'a's followed by a '!').

aaaaaaaaaaaaaaaaaaaa!

For this input, the regex engine will try all possible ways to group the `a` characters before realizing that the match ultimately fails because of the `!`. This results in an explosion of backtracking attempts.

Every one of the 3 is a mark on the map. Named now: 1 to 3, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.