Regex-Game - HTB Cyber Apocalypse 2025 Writeup

Write a single regular expression under 40 characters that matches valid mathematical equations but rejects maliciously injection vectors.

🚩 Challenge Overview

  • Platform/Event: HTB Cyber Apocalypse 2025
  • Difficulty: Medium
  • Points: 230
  • Solves: 290
  • Category: Misc
  • Tags: Regular Expressions, Input Validation, Constraints Bypass

📝 Description

Write a single regular expression under 40 characters that matches valid mathematical equations but rejects maliciously injection vectors.

💡 Solution / Approach

  1. The validation script uses PHP’s preg_match with a strict length count.

  2. The allowed characters are limited to numbers, arithmetic signs, and parentheses: ^[0-9+\-*\/()]+$.

  3. To bypass the length check while preventing command injection via backticks or function calls, we use recursive subpatterns to match matching nesting parentheses: ^([0-9+\-*\/]|(\((?1)*\)))+$.