2.5 Length of Queries and Mixed Examples Continued - RX

Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or

Already have an account? Sign In »

Course
Time
1 hour 37 minutes
Difficulty
Beginner
CEU/CPE
2
Video Transcription
00:00
So welcome back, and we're gonna take off where we left off in the last lesson. This is still part of the land quarry lesson. It's just that we're gonna expand in this little concert over here.
00:11
And not only that, we're also gonna be at something that does not appear in the cheat. Cheat. Okay, So again, like in the previous example, we're gonna be using numbers
00:20
as it is easier to explain
00:23
these type of concepts asked, You are learning.
00:27
So here I am, actually expanding numbers off different lengths or sequences off numbers.
00:34
Right?
00:36
And here we have up to 12
00:40
up to 15
00:42
her 16 whatever.
00:45
All right?
00:46
And then we have up to 20.
00:49
Now,
00:51
again, we're gonna be using digits,
00:54
right? So slash D if you remember correctly from here
01:00
within the little breakfasting.
01:02
Now,
01:03
if you remember correctly for one to detect exactly three,
01:07
we just type three. And in Texas, you can see a block of three.
01:11
One block of three and an additional block of three. And nothing. Nothing. And then three blocks of three et cetera. Right? So what if you want to the tack At least three characters or sequence that has at least three characters. Right. You're more.
01:23
Then do you actually do
01:26
this?
01:26
And if you see correctly here,
01:29
C two or more in this example two or more so three or more and you see it targets 12312 before a Terrebonne, it does not target one, nor 12 or 12 if you want to put it that way.
01:42
So what does this tell me?
01:45
Basically, what it tells me is
01:48
I want to say specifically, search for parameters of a precise starting late.
01:56
Are you trying to follow now where this might be heading?
02:00
If not, I'm gonna give you a couple more examples right
02:06
now.
02:07
What happens if I put them by his versa will be detecting from
02:10
up to three characters.
02:13
Well,
02:14
if you're trying backwards, you know it's not that friendly. So you actually have to say for example, 123 So you can see again block of threes, right
02:23
between one and three.
02:24
Or you can say, for example, syrup did three and again you see a warning.
02:30
This Russian can return empty matches. So you gotta be careful.
02:34
It will be equivalent off when you do the little exclamation mark, which here or wonder. So in this case, at least two of the three you gotta be careful.
02:42
So again, there's the coven off that 123
02:46
segment, but again
02:47
different than the D three right where it didn't detect one or 12. In this case, it does Detective Curtis a minimum,
02:54
um,
02:55
bracket or sell off three characters. So to think about this, compare it to a let's, say, a roller coaster ride of coral culture. You match at least up to three people, right, so you can fit one person. Maybe
03:08
you could fit two people, or you can feed three people, right? And that's little roller Coster card, right? But more than that, then you have to have a second court right up to three people and then 1/3 card, etcetera, etcetera. It's a good way to think about a right little blocks of numbers.
03:23
Now,
03:23
if you see carefully here, we're now into a different concept. We have 12 or up to three,
03:30
and that's literally the last concert. When it comes to this, quantum fires fragments right. In this case, let's say you want to see if It has at least three characters and up to 10 characters. And you can see then that these ones are detected,
03:46
right? And if you play close attention different than when it was three comma, right?
03:53
You can see that this is divided just here after the 10 digits. Right? So if you do this,
03:59
it's one block.
04:00
If you did this,
04:00
it's two different blocks again. Think about the little roller coaster cards right
04:04
now. How can I use this?
04:06
You getting an idea yet or not? So let's say your information security analysts are a PSA sentiment, and you're in charge of blocking or protecting the environment for malicious evils. Right? And you start receiving an email
04:19
process invoice, right.
04:21
And then it has a couple of numbers. Right?
04:25
Let's call you that.
04:27
Here in this pound.
04:30
Zero
04:31
123456789 Right. Just to make sure you see how many dates are in this scenario, you know,
04:39
the first time you see the first email, you literally block it a such
04:44
but ask you moving forward, you start noticing that the last digits
04:47
start changing
04:49
and it becomes a sort of a sequins
04:53
on. Actually,
04:55
they start expanding,
04:57
and at the end of the day there's actually no formatting. It's just
05:01
character drink.
05:02
It's in this case is when you start doing the whole
05:08
projects that we discussed in the prior lesson, right?
05:11
I want to be exactly nine characters
05:14
or 10 characters.
05:15
All right
05:16
or eight characters doesn't really matter
05:19
now, as you can see, even though its less characters it was still detected.
05:25
Why is that? It's because, as mentioned earlier lessons,
05:29
they're missing a perimeter at the end, which you need to take into account.
05:32
So if you want to lock specific subjects such as invoice right
05:38
pound
05:41
right,
05:43
this and that has urgent
05:45
in the subject,
05:46
and all of them have the argent on it. You want to make sure
05:50
you include that urgent aspect into your rejects in order to capture. And, as you can tell now, none of them match. And that's because it's eight and not 10 again. This is all materials, just reviewing it really quick.
06:03
Now, if you do 8 to 10 you can see all of them are detected.
06:08
And if I, for example, again, let's just discuss
06:12
earlier part of lesson
06:14
weaken ranges and it's perfectly okay. Now let's see. Your company uses a very similar format for invoicing, Right pound.
06:20
It has a date
06:23
in this case, this one, right?
06:27
And then he uses one initial and it has, let's say the letters, right. One,
06:33
456789
06:36
So what happens Here?
06:40
It is the following
06:43
urgent.
06:45
You want to make sure Daddy, for example, the malicious person. It's using words in here as well.
06:54
I would say they have a I somewhere in here
06:58
or something to have a P
07:00
right?
07:00
Hey,
07:03
right. You want to make sure
07:06
that you're, uh,
07:09
format. It's not also block. So in this scenario, right,
07:15
if we block invoice space, pound
07:18
slash,
07:19
that's a w
07:21
plus Right? So just to make this easier
07:26
space urgent.
07:29
All right.
07:30
Urgent to space of dire. Sorry
07:33
that you can see that everything's detected. So how can you work with this? Well,
07:40
in this case, you can either work creating an exception for year format, or you can work to creating a specific block for this, right? So in this case, you know that your company has a specific length
07:54
and they always have the initial after these date range, right? So let's say we're gonna be working on the white listing, So instead of using the slash w right,
08:03
we're gonna be trying to detect these characters here. In this scenario, it's five right,
08:09
two for the month, one for a day into for the year. Now what happens if it's, um,
08:16
January 1
08:18
in the year? Then, in that case, you'll have four characters, right?
08:22
So four characters. And what happens if it's December 20th
08:26
2018? In that case, you'll have six characters, right?
08:30
So you going to slash six,
08:31
right?
08:33
Close it
08:33
now.
08:35
Something is that you have to have a letter right
08:37
now. In this scenario, if it's a small company you can actually use used to square bracket, and that's a put
08:43
being a cello, the sales person, right?
08:46
And then you can just do, uh,
08:50
let's say I want to tend to make it easier,
08:52
all right
08:54
in the space and the urgent. So in this case, actually has more than 10.
08:58
Let's say 15.
09:01
There you. So in this case, this works, but it's not efficient.
09:05
In a recent being, let's say you have self political Kevin than you have jae soon to have Brian. Do you have Theresa and you will he to have working on this often and whatever and employee leaves, You have to update it and tell her right
09:24
now you might be thinking, Well, that's easily solvable If I use W one. I mean,
09:30
it's one letter, so it should be taken care of, right?
09:33
No,
09:35
it's simple.
09:35
Doubly. It's alphanumeric. So what do we have to do to fix this?
09:50
And why do I put a to C eight to see twice again?
09:54
It's case sensitive, right?
09:58
And not only that, it also, uh
10:01
or remember 18 this year it's an order. It's a range from A to Z and minor and eight to seen upper caps. Right
10:09
now. Why is it still being detected Because of the data? Right Here you have 343 whatever. And here you have a lot more. So, for example, you actually then have to fix it.
10:18
Mission at length.
10:20
Well, for a range of characters.
10:22
And there you have. You built it. You're making sure you're not detecting all these characters like earlier because you were using any off on the merry character, and you're basically working through it. And this is when tools like this come very helpful. Thes tools help you start working and troubleshoot your
10:41
Rogic's while you're building them
10:43
live, and therefore minimize the amount of Amherst you might bring into your production or test environment.
10:50
And even though you still have to be cautious once you put them in your environment, do you at least have a general idea of one minor changes you might need to make, like simplicity?
11:01
So in summary on this model, we discussed the following parameters off the Reddick structure. How did use words
11:07
digits
11:09
while cards ranges
11:11
and the length of the queries helped to basically tell the rhetoric
11:16
how far or how short the Syntex gonna be right? The search parameters are going to be
11:24
We have a great day. I'll see you in the next lesson
Up Next