CyberSoft CVDL

CVDL Tutorial

9. Digits

The \d+ operator matches one or more digits, and is named after the similar Perl operator.

This can be used, for example, to detect obfuscated URLs:

 "http://", \d+, "/"
matches URLs like http://3626287830/
"http://0", \d+, ".", "0", \d+, ".", "0", \d+, ".", "0", \d+, "/"

matches URLs like http://00000325.0000030.00000341.00000116/
can also be written using a macro:

$define zerod  "0", \d+
"http://", $zerod, ".", $zerod, ".", $zerod, ".", $zerod, "/"

CVDL macros will be discussed in more detail later in the tutorial.

Listen to the audio

Contents | Previous | Next