On 02/12/2014 10:46 PM, John Hardin wrote:
On Wed, 12 Feb 2014, Axb wrote:
On 02/12/2014 10:06 PM, John Hardin wrote:
Perhaps something like this:
body __HEXHASHWORD /\b[0-9a-f]{30,}\s[a-z]{1,10}\b/
tflags __HEXHASHWORD multiple maxhits=5
meta HEXHASH_WORD __HEXHASHWORD > 4
describe HEXHASH_WORD Hexadecimal hash followed by a word
Added to my sandbox, just in case.
John,
Isn't {30,} (without a limit) dangerously expensive?
Potentially expensive; the character class and the fact that the
following atom is not in that class limits the risk - backtracking isn't
a possibility. However, point taken - recommend {30,64} instead.
imo, you don't even need to count that much - I'd stop at sweet 16,
anything above is pink noise and not waste time chasing spaces & co.
