Regex tester with match offsets and capture groups

Two uses in CTF: extracting flags from a large body of output, and understanding a filter you need to defeat. The second is the interesting one - a regex in a challenge’s source is a precise statement of what it will reject, and reading it carefully usually reveals what it forgot to.

Testing a pattern against inputs you control is how you turn a filter from an obstacle into a specification. Every regex says exactly what it rejects; the gap between what it rejects and what the downstream code is dangerous for is the whole vulnerability, and you find that gap by trying inputs rather than by staring at the pattern.

Reading a filter for gaps

• Missing anchors. A pattern without ^ and $ matches anywhere in the string, so prefixing or suffixing your payload passes.
• No multiline flag. $ matches at the end of the string, not at the end of a line - so a newline hides everything after it from an unanchored check.
• Character class gaps. [a-zA-Z0-9] excludes underscore, hyphen, and dot. Whether that matters depends entirely on the sink.
• Case sensitivity. A pattern without i blocks script and permits ScRiPt.