--- id: regexploit version: "1.0.0" license: unclear license_treatment: permissive maintenance: dormant --- # regexploit — Find regular expressions vulnerable to ReDoS License: permissive · Maintenance: dormant · Downloads: 334.1K/mo ## What it is and what it does Regexploit is a command-line security scanner that detects regular expressions vulnerable to ReDoS (Regular Expression Denial of Service) attacks. It analyzes regex patterns to determine their worst-case backtracking complexity and generates concrete malicious input strings that trigger catastrophic backtracking, causing the regex engine to hang or consume excessive CPU. The tool operates in multiple modes: interactive (stdin), batch file processing, and automatic extraction from Python, JavaScript, TypeScript, C#, JSON, and YAML source files. It can also scan all compiled regexes in an installed Python environment. For each vulnerable pattern found, it reports the complexity level (cubic, exponential, etc.), identifies the repeated character causing the issue, and provides a concrete exploit string. The package has been used to identify ReDoS vulnerabilities in production libraries including CPython's urllib, Pillow, httplib2, and ua-parser. Use it for: - Scan your codebase before deployment to find regexes that could be exploited by attackers sending crafted input. - Audit third-party Python packages installed in your environment for known ReDoS vulnerabilities. - Validate regex patterns during code review to catch performance regressions before they reach production. - Generate proof-of-concept exploit strings to demonstrate ReDoS impact to stakeholders or for security testing. - Analyze JavaScript/TypeScript regex patterns in Node.js projects for denial-of-service risks. ## Worth the install? AI-flagged interpretation of the facts above — verify before relying. Regexploit analyzes regular expressions to identify those vulnerable to Regular Expression Denial of Service (ReDoS) attacks and generates example malicious input strings that trigger catastrophic backtracking. Yes, if you work with untrusted regex patterns or need to audit code for ReDoS vulnerabilities. The tool is lightweight, has no dependencies, and fills a specific security niche. However, maintenance is dormant (last release March 2021), so treat it as a stable utility rather than an actively developed project. Not necessary for typical development workflows that don't expose regex engines to adversarial input. ## Install pip install regexploit uv add regexploit poetry add regexploit ## Installing regexploit Before you install: Low install friction with no runtime dependencies. The package is dormant (last release March 2021, last commit February 2024), so maintenance is minimal; it remains functional for its narrow purpose but receives no active development. License in practice: Licensed under Apache 2.0 (permissive), allowing free use, modification, and distribution with minimal restrictions—suitable for both open-source and commercial projects. Quickstart: pip install regexploit regexploit # Enter regex at prompt, e.g.: v\w*_\w*_\w*$ # Output shows worst-case complexity and example malicious input # Or scan installed Python modules: regexploit-python-env Requires Python 3.8 or later. NodeJS 12+ is required only if extracting regexes from JavaScript/TypeScript code. Verify before relying: - Whether the tool's ReDoS detection algorithm covers all known ReDoS patterns or has documented limitations. - Performance characteristics when analyzing very large regex collections or complex patterns. ## Package facts - License: not declared (permissive) - Python support: supports_current - Install friction: low - Maintenance: dormant - Downloads: 334.1K/month (top 15,000 on PyPI) - Known vulnerabilities: none known ## Tags regex denial of service detection, redos vulnerability scanner, regular expression backtracking analysis, find vulnerable regexes, regex security testing, catastrophic backtracking finder, pattern complexity analyzer, security-audit, regex-analysis, denial-of-service [View on SkillFed](https://skillfed.io/packages/regexploit) · [View on PyPI](https://pypi.org/project/regexploit/)