Regex Extensions
Fortify engineers have developed and implemented extensions to the normal regular expression (regex) syntax. When building a regular expression, you can use the tags and operators described below.
Regular Expression Tags
-
[STATUSCODE]
-
[BODY]
-
[ALL]
-
[URI]
-
[HEADERS]
-
[COOKIES]
-
[STATUSLINE]
-
[STATUSDESCRIPTION]
-
[SETCOOKIES]
-
[METHOD]
-
[REQUESTLINE]
-
[VERSION]
-
[POSTDATA]
-
[TEXT]
Regular Expression Operators
-
AND
-
OR
-
NOT
-
[ ]
-
( )
Examples
-
To detect a response in which (a) the status line contains a status code of "200" and (b) the phrase "logged out" appears anywhere in the message body, use the following regular expression:
[STATUSCODE]200 AND [BODY]logged\sout
-
To detect a response indicating that the requested resource resides temporarily under a different URI (redirection) and having a reference to the path "/Login.asp" anywhere in the response, use the following:
[STATUSCODE]302 AND [ALL]Login.asp
-
To detect a response containing either (a) a status code of "200" and the phrase "logged out" or "session expired" anywhere in the body, or (b) a status code of "302" and a reference to the path "/Login.asp" anywhere in the response, use the following regular expression:
( [STATUSCODE]200 AND [BODY]logged\sout OR [BODY]session\sexpired ) OR
( [STATUSCODE]302 AND [ALL]Login.asp )Note: You must include a space (ASCII 32) before and after an "open" or "close" parenthesis; otherwise, the parenthesis will be erroneously considered as part of the regular expression.
-
To detect a redirection response where "login.aspx" appears anywhere in the redirection Location header, use the following regular expression:
[STATUSCODE]302 AND [HEADERS]Location:\slogin.aspx
-
To detect a response containing a specific string (such as "Please Authenticate") in the Reason-Phrase portion of the status line, use the following regular expression:
[STATUSDESCRIPTION]Please\sAuthenticate
See Also