{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security/2"}],"enrichment":{"capability":"Regexploit analyzes regular expressions to identify those vulnerable to Regular Expression Denial of Service (ReDoS) attacks and generates example malicious input strings that trigger catastrophic backtracking.","skillfed_tags":["security-audit","regex-analysis","denial-of-service"],"use_cases":["Scan your codebase before deployment to find regexes that could be exploited by attackers sending crafted input.","Audit third-party Python packages installed in your environment for known ReDoS vulnerabilities.","Validate regex patterns during code review to catch performance regressions before they reach production.","Generate proof-of-concept exploit strings to demonstrate ReDoS impact to stakeholders or for security testing.","Analyze JavaScript/TypeScript regex patterns in Node.js projects for denial-of-service risks."],"what_it_does":"Regexploit is a command-line security scanner that detects regular expressions vulnerable to ReDoS (Regular Expression Denial of Service) attacks. It analyzes regex patterns to determine their worst-case backtracking complexity and generates concrete malicious input strings that trigger catastrophic backtracking, causing the regex engine to hang or consume excessive CPU.\n\nThe tool operates in multiple modes: interactive (stdin), batch file processing, and automatic extraction from Python, JavaScript, TypeScript, C#, JSON, and YAML source files. It can also scan all compiled regexes in an installed Python environment. For each vulnerable pattern found, it reports the complexity level (cubic, exponential, etc.), identifies the repeated character causing the issue, and provides a concrete exploit string. The package has been used to identify ReDoS vulnerabilities in production libraries including CPython's urllib, Pillow, httplib2, and ua-parser.","worth_installing":"Yes, if you work with untrusted regex patterns or need to audit code for ReDoS vulnerabilities. The tool is lightweight, has no dependencies, and fills a specific security niche. However, maintenance is dormant (last release March 2021), so treat it as a stable utility rather than an actively developed project. Not necessary for typical development workflows that don't expose regex engines to adversarial input."},"id":"regexploit","links":{"html":"https://skillfed.io/packages/regexploit","md":"https://skillfed.io/packages/regexploit.md","pypi":"https://pypi.org/project/regexploit/"},"maintenance":{"status":"dormant"},"meta":{"latest_release":"2021-03-11","license_spdx":null,"license_treatment":"permissive","name":"regexploit","python_support":"supports_current","summary":"Find regular expressions vulnerable to ReDoS"},"popularity":{"monthly_downloads":334127,"position":7494,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"1.0.0"}