How to use Selectors - Regular Expressions (regex)

Starting in version 2.5.0 of Hunchly, we've introduced the ability to use regular expressions (regex) selectors. This gives you way more control over what Hunchly searches for in your history and as you capture pages, enhancing your ability to find the information you are looking for. This article will go over what regex is, and how to use this for selectors in Hunchly.

What are regular expressions?

Regular expressions or regex, is a syntax that allows you to match strings with specific patterns. This lets you build extremely advanced search patterns that can be used to search through your data, not just for exact matches, but for strings that match a defined pattern.

There are some variations of regex syntax that you need to be aware of, Hunchly supports golang regex.

A good introduction to regex can be found here and a great resource to test out regex can be found here.

We've found that LLMs are helpful for crafting regex, and have had success using a variety of models.

Using regex for selectors can help you find things such as variations on names, cryptocurrency addresses, phone numbers, API keys or passwords and usernames.

An example

Say you are looking for a particular name in your investigation, lets use John Smith. You can make a selector using John Smith, this will find all the matches for that specific string in any page you capture.

What if you are looking for someone with a middle name, but you don't know what that could be? Here is where regex comes in handy.

Here is an example of a regex selector that is designed to match any text matching John Smith with one or more middle names, or with middle initials, or middle initials followed by a period:

\bJohn\s((?:[A-Za-z]+\.?\s?)+)\sSmith\b

Explanation:

• \b asserts a word boundary to ensure the match starts at the beginning of a word.
• John\s matches "John" followed by a space.
• ((?:[A-Za-z]+\.?\s?)+) captures middle names or initials:
  • (?:...) is a non-capturing group to group parts of the pattern without capturing.
  • [A-Za-z]+ matches one or more letters.
  • \.? optionally matches a period.
  • \s? optionally matches a space.
  • + quantifier is applied to the non-capturing group to match one or more middle names/initials.
• Smith\b matches "Smith" followed by a word boundary.

Regex in Hunchly

Check out this video which discusses how to use regex selectors in Hunchly.

We will cover:

1. Traditional selectors vs regex selectors.
2. Set up a regex selector in the dashboard.
3. Identify when a selector has a match in the capture history and on a page.

As always, if you have suggestions or any additional questions about using regex selectors, please reach out to us at: support@hunch.ly.