How to Extract CTF Flags with Regex

Start with the flag format you actually know

If the event uses flag{...}, escape the literal braces and constrain the contents. A practical JavaScript pattern is:

/flag\{[^}\r\n]{1,200}\}/gi

flag\{ matches the literal prefix and opening brace. The negated class accepts characters other than a closing brace or line break. The length bound prevents an accidental match from consuming an entire file. The final escaped brace closes the flag.

Avoid the greedy wildcard trap

The pattern /flag\{.*\}/ is tempting, but .* is greedy. Given two flags on one line, it can match from the first opening brace through the final closing brace. A lazy wildcard, .*?, is better but still crosses characters you may not intend. A bounded negated class communicates the expected structure more clearly.

Pattern	Behavior	Risk
`flag\{.*\}`	Greedy wildcard	May join multiple flags
`flag\{.*?\}`	Lazy wildcard	May cross unexpected content
`flag\{[^}\r\n]{1,200}\}`	Bounded content	Requires an explicit format assumption

Test against noisy CTF output

[debug] token=none
candidate FLAG{first_match}
ignored flag{second_match}
broken flag{never_closed
done

With the g and i flags, the bounded pattern returns two matches and rejects the unterminated candidate. Remove i when the event's prefix is case-sensitive. Remove g only when you intentionally need the first match.

Understand the two layers of escaping

In a regex literal, write /flag\{...\}/. In a JavaScript string passed to new RegExp(), each backslash must itself be escaped: "flag\\{...\\}". Confusing these layers is one of the most common reasons a correct-looking pattern fails.

Regex should locate candidates, not prove correctness

A match satisfies your pattern. It does not prove that the flag belongs to the current challenge or that its contents are valid. Preserve nearby context before submitting it.

Keep patterns predictable

Nested ambiguous quantifiers can take excessive time on adversarial input. Prefer bounded repetitions and specific character classes when processing large or untrusted text. Hexforge limits displayed matches, but the browser still has to evaluate the pattern you provide.

How this guide was verified

The recommended pattern was tested in the Hexforge regex tool against two valid flags, an unclosed flag, a 201-character candidate, mixed case, and two flags on a single line. Expected matches and their starting indexes were recorded before the article was published.

A repeatable extraction workflow

Write down the known prefix and delimiters.
Escape literal punctuation.
Constrain the inner character set and maximum length.
Test valid, invalid, adjacent, and multiline examples.
Inspect context around every match.
Save the final pattern with the challenge notes.