regexploit

What it is and what it does

Regexploit is a command-line security scanner that detects regular expressions vulnerable to ReDoS (Regular Expression Denial of Service) attacks. It analyzes regex patterns to determine their worst-case backtracking complexity and generates concrete malicious input strings that trigger catastrophic backtracking, causing the regex engine to hang or consume excessive CPU.

The tool operates in multiple modes: interactive (stdin), batch file processing, and automatic extraction from Python, JavaScript, TypeScript, C#, JSON, and YAML source files. It can also scan all compiled regexes in an installed Python environment. For each vulnerable pattern found, it reports the complexity level (cubic, exponential, etc.), identifies the repeated character causing the issue, and provides a concrete exploit string. The package has been used to identify ReDoS vulnerabilities in production libraries including CPython's urllib, Pillow, httplib2, and ua-parser.

Use it for:

• Scan your codebase before deployment to find regexes that could be exploited by attackers sending crafted input.
• Audit third-party Python packages installed in your environment for known ReDoS vulnerabilities.
• Validate regex patterns during code review to catch performance regressions before they reach production.
• Generate proof-of-concept exploit strings to demonstrate ReDoS impact to stakeholders or for security testing.
• Analyze JavaScript/TypeScript regex patterns in Node.js projects for denial-of-service risks.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Regexploit analyzes regular expressions to identify those vulnerable to Regular Expression Denial of Service (ReDoS) attacks and generates example malicious input strings that trigger catastrophic backtracking.

Yes, if you work with untrusted regex patterns or need to audit code for ReDoS vulnerabilities. The tool is lightweight, has no dependencies, and fills a specific security niche. However, maintenance is dormant (last release March 2021), so treat it as a stable utility rather than an actively developed project. Not necessary for typical development workflows that don't expose regex engines to adversarial input.

Install

regexploit on PyPI

pip install regexploit

uv add regexploit

poetry add regexploit

Installing regexploit

Before you install

Low install friction with no runtime dependencies. The package is dormant (last release March 2021, last commit February 2024), so maintenance is minimal; it remains functional for its narrow purpose but receives no active development.

License in practice

Licensed under Apache 2.0 (permissive), allowing free use, modification, and distribution with minimal restrictions—suitable for both open-source and commercial projects.

Quickstart

pip install regexploit

regexploit
# Enter regex at prompt, e.g.: v\w*_\w*_\w*$
# Output shows worst-case complexity and example malicious input

# Or scan installed Python modules:
regexploit-python-env

Requires Python 3.8 or later. NodeJS 12+ is required only if extracting regexes from JavaScript/TypeScript code.

Verify before relying

• Whether the tool's ReDoS detection algorithm covers all known ReDoS patterns or has documented limitations.
• Performance characteristics when analyzing very large regex collections or complex patterns.

Package facts

Evidence: regexploit-1.0.0-py3-none-any.whl

Tags

More Security packages