InQuest / iocextract

Defanged Indicator of Compromise (IOC) Extractor.
https://inquest.readthedocs.io/projects/iocextract/
GNU General Public License v2.0
505 stars 91 forks source link

URL bracket regex is too loose #2

Closed rshipp closed 6 years ago

rshipp commented 6 years ago
CDATA[^h00ps://online\(.)americanexpress\(.)com/myca/.*?request_type=authreg_acctAccountSummary]]>

Should stop at the first character not in [\w-\[\]\(\)] when looking backwards. In this case the ^.

Even tighter, we can stop at the first character not in [\w] if it's before a ://.