Regular Expressions Quick Reference
====================================

BASIC PATTERNS
  .                 Any character (except newline)
  \d                Digit [0-9]
  \D                Non-digit
  \w                Word character [a-zA-Z0-9_]
  \W                Non-word character
  \s                Whitespace
  \S                Non-whitespace
  \b                Word boundary

ANCHORS
  ^                 Start of string/line
  $                 End of string/line
  \A                Start of string only
  \Z                End of string only

QUANTIFIERS
  *                 0 or more
  +                 1 or more
  ?                 0 or 1
  {n}               Exactly n
  {n,}              n or more
  {n,m}             Between n and m
  *?  +?  ??        Non-greedy versions

CHARACTER CLASSES
  [abc]             a, b, or c
  [a-z]             Lowercase letters
  [A-Z]             Uppercase letters
  [0-9]             Digits
  [^abc]            NOT a, b, or c
  [a-zA-Z0-9]      Alphanumeric

GROUPS & REFERENCES
  (pattern)         Capture group
  (?:pattern)       Non-capture group
  (?P<name>pat)     Named group (Python)
  \1                Back-reference to group 1
  (?=pattern)       Lookahead
  (?!pattern)       Negative lookahead
  (?<=pattern)      Lookbehind
  (?<!pattern)      Negative lookbehind

ALTERNATION
  a|b               a or b
  (cat|dog)         cat or dog

COMMON CTF PATTERNS
  # Flag format
  icoa\{[^}]+\}

  # IP address
  \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}

  # Hex string
  [0-9a-fA-F]+

  # Base64
  [A-Za-z0-9+/]+=*

  # Email
  [\w.+-]+@[\w-]+\.[\w.]+

  # URL
  https?://[^\s]+

GREP EXAMPLES
  grep -E "icoa\{.*\}" file       Find flags
  grep -oP "\d+\.\d+\.\d+\.\d+" f   Extract IPs
  grep -rn "password" .           Search recursively
