search

augustd / burp-suite-software-version-checks

Burp extension to passively scan for applications revealing software version numbers
30 stars 17 forks source link

Fixed Tomcat Regex #52

Closed alexlauerman closed 6 years ago

alexlauerman commented 6 years ago

Test case of fixed regex is here: https://regex101.com/r/TfdeSA/1/ The original regex did not work in Burp, and also did not work in the regex tester.

Are there other test cases this regex should have worked for? If so, this change will break those. If not, it's possible a number of these are broken due to unescaped forward slashes.

augustd commented 6 years ago

I don't think it is technically required to escape forward slashes in Java regex. In particular, the unit tests detect the correct number of matches and a lot of these patterns would be broken if escaping was required.

I check all patterns against http://www.regexplanet.com/advanced/java/index.html before including them. I think the regex101.com example is flawed -it appears to be testing for PHP-flavored regex.

alexlauerman commented 6 years ago

I don't know what version of Software Version Reporter I was using, but I've updated the version and also loaded the new regex URL (this didn't happen automatically, although maybe I had to unload and reload the extension) . The tomcat regex is now working. I agree that with you on the link using the wrong regex format, and also if the unit tests are working, then it should be fine.