skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

testing-for-regex-dos-redos

Tests web applications for ReDoS vulnerabilities using doubling latency tests and blind regex injection.

954|172|Updated Mar 13, 2026
Search Tags:#owasp#web-security#RegEx#denial-of-service#penetration-testing#timing-attack#reDoS
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill testing-for-regex-dos-redos
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: testing-for-regex-dos-redos
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/web-application-security/testing-for-regex-dos-redos
Command: npx skills add https://github.com/xalgord/xalgorix --skill testing-for-regex-dos-redos

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires regexploit, requests.

What problem does it solve?

Regular Expression Denial of Service (ReDoS) flaws hide in backtracking regex engines and only appear when input length grows, so single-payload tests miss them. This Skill provides a systematic methodology to detect, confirm, and exploit ReDoS and blind regex injection during authorized web application assessments.

Core Features & Use Cases

  • Doubling Latency Test: Send inputs of length 2^k and detect super-linear response-time growth that confirms catastrophic backtracking.
  • Vulnerable Pattern Detection: Use regexploit and known evil-regex shapes like (a+)+ and ([a-zA-Z]+)* to identify exploitable validators.
  • Blind Regex Injection: Exfiltrate server-side secrets char-by-char using latency oracles when the attacker controls the pattern.
  • Use Case: During an authorized pentest, you find a signup endpoint validating email with a nested-quantifier regex; you run the doubling test, observe response time jump from 8 ms to 9.4 s, and document a High-severity ReDoS finding with timing evidence.

Quick Start

Test the email validation endpoint at the target URL for ReDoS by running a doubling latency test with payloads of growing length ending in an exclamation mark.

Frequently Asked Questions about testing-for-regex-dos-redos

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a web application for ReDoS vulnerabilities?▼

Run a doubling test: send inputs of length 2^k (k = 8..15) with a long run of an ambiguous character plus a failing tail character, then plot response latency. Exponential or steep polynomial growth confirms ReDoS; linear growth indicates the pattern is safe.

What tools detect vulnerable regular expressions automatically?▼

regexploit from Doyensec scans Python and JavaScript codebases, detects vulnerable patterns, and auto-generates evil inputs. Alternatives include the devina.io redos-checker web tool, redos-detector CLI, and vuln-regex-detector for end-to-end pipelines.

Which regex engines are vulnerable to catastrophic backtracking?▼

PCRE, Java java.util.regex, Python re, and JavaScript RegExp are backtracking engines vulnerable to ReDoS. RE2, RE2J, RE2JS, and Rust regex are linear-time engines that avoid backtracking and are ReDoS-resilient by construction.

Why does my ReDoS test show no latency increase?▼

A single payload length often misses ReDoS because catastrophic backtracking only appears as input grows. Test doubling lengths, repeat measurements 3-5 times to rule out jitter, and check whether the target uses a linear-time engine like RE2.

What is blind regex injection and how does it leak secrets?▼

Blind regex injection occurs when an attacker controls the pattern matched against a server-side secret. A pattern like ^(?=guess)((.*)*)*salt$ freezes the page only when the guess matches, creating a latency oracle that leaks the secret character by character.

Related Skills

Explore More Software Engineering Skills→
securityfortechsecurityfortech
6

web-fingerprinting

Identify web server type, frameworks, and versions via banner and header analysis.

Official
Intermediate
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
MartinNevlahaMartinNevlaha
1

security-review

Audit codebases for OWASP Top 10 vulnerabilities and hardcoded secrets.

Community
Intermediate
betaTridentbetaTrident

benchmark

Compare current web performance metrics against stored JSON baselines.

Community
Advanced