Regular expressions and grep: first steps
You learn to search text for patterns from scratch and use character classes, repetition and anchors to find what you need in logs, lists and config files.
Level 101 · 15 lessons · 15 practice labs
Lessons
The idea of a pattern
- Why patterns: thousands of lines that fit one shape
- Searching for plain text with grep
- The dot, ^ and $: any character, line start, line end
- Short task: find only the lines that start with ERROR
Building blocks
- Character classes: [abc], [0-9] and [[:digit:]]
- Repetition: *, +, ? and {n,m}
- Groups and alternation: parentheses and the vertical bar
- Basic versus extended regex: grep and grep -E
- Escaping special characters
- Short task: pull the IPv4 addresses out of a log
Real jobs
- grep's useful flags: -o, -c, -w, -l
- Patterns for emails, dates and times
- Greedy matching and common mistakes
- Testing a pattern on a small sample
- Capstone: extract a table of users, IPs and times from a mixed log
Practice labs
- Find only the lines that start with ERROR: Use grep to find log records with ERROR at the start of the line and submit how many there are.
- Find requests ending in a given extension: Find access-log requests whose URL ends in .php, excluding those with a query string.
- Fix a pattern that over-matches an unescaped dot: Find the flaw in a pattern that also matches look-alike names and fix it to match only the exact domain.
- Show active settings without comments and blanks: Strip comment and blank lines from a config file and write only the active settings to a separate file.
- Get the right count with whole-word matching: Search for root without counting words like chroot using -w and -c and give counts per file.
- Scan for weak settings with one pattern file: Write a pattern file that catches five weak settings across twenty config files and produce a findings list with file name and line number.
- Pull the IPv4 addresses out of a log: Extract every IPv4 address in the log with grep -oE and submit the number of unique addresses.
- Catch several severity levels with one pattern: Catch WARN, ERROR and FATAL lines with a single extended pattern and give counts per level.
- Find why a pattern fails in plain grep: Convert a pattern that works with grep -E but not plain grep to basic regex syntax and show both give the same result.
- Find user names that break the naming rule: Use character classes to find user names in a list that break the lowercase, digit and hyphen rule.
- Pick out malformed MAC addresses: Validate the MAC addresses in an inventory list with a pattern, write the malformed lines to a separate file and submit their count.
- Extract a user, IP and time table from a mixed log: From a log with lines in different formats, extract user, IP and time of successful logins into a three-column table.
- Find records within an hour range: Use a timestamp pattern to find login records between midnight and six in the morning and submit the count.
- Collect email addresses from text: Extract email addresses from a support ticket file and list separately those outside the company domain.
- Fix a pattern that grabs too much: Fix a pattern that should take the first quoted value but grabs to the end of the line, using a negated class.
About this course
You learn to search text for patterns from scratch and use character classes, repetition and anchors to find what you need in logs, lists and config files.
What you will learn
- The idea of a pattern
- Building blocks
- Real jobs
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.