# Wildcard in URL finding base64

**URL:** <https://discuss.elastic.co/t/wildcard-in-url-finding-base64/79287>\
**Category:** Elasticsearch\
**Created:** [March 20, 2017, 4:11pm UTC](https://discuss.elastic.co/t/wildcard-in-url-finding-base64/79287 "2017-03-20T16:11:44Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![zokratez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zokratez/32/5974_2.png) [@zokratez](https://discuss.elastic.co/u/zokratez)\
**Post date:** [March 20, 2017, 4:11pm UTC](https://discuss.elastic.co/t/wildcard-in-url-finding-base64/79287/1 "2017-03-20T16:11:44Z")

</div>

I need to filter double equal in URL \ ***==** to detect base64 attacks.

I tried with the fields request\_page, request\_page.keyword and request\_page.raw and nothing hapens...

```
{
  "wildcard": {
    "request_page": "*==*"
  }
}

{
  "wildcard": {
    "request_page": "*=="
  }
}

```

or in kibana search.

request\_page: \*==  
request\_page: \*"=="  
request\_page: \*==

request\_page:.raw \*==  
request\_page.raw: \*"=="  
request\_page.raw: \*==

request\_page.keyword: \*==  
request\_page.keyword: \*"=="  
request\_page.keyword: \*==

All of these with raw and keyword too. Analyzed and not analized.

What's the correct way to apply wildcard?

Here is an example of the string:

> index.php/en/component/user/admin/Cms\_Wysiwyg/directive/?forwarded=true&isIframe=true&\_\_\_directive=e3tibG9jayB0eXBlPSJhZG1pbmh0bWwvcmVwb3J0X3NlYXJjaF9ncmlkIn19&filter=bnVtX3Jlc3VsdHNbZnJvbV09MCZudW1fcmVzdWx0c1tmaWVsZF9leHByXT0xPTIpO0RFTEVURSBGUk9NIGBhZG1pbl91c2VyYCBXSEVSRSB1c2VyX2lkID0gMzM7ICBERUxFVEUgRlJPTSBgYWRtaW5fcm9sZWAgV0hFUkUgdXNlcl9pZCA9IDMzOyAgSU5TRVJUIElOVE8gYGFkbWluX3VzZXJgIChgdXNlcl9pZGAsIGBmaXJzdG5hbWVgLCBgbGFzdG5hbWVgLCBgZW1haWxgLCBgdXNlcm5hbWVgLCBgcGFzc3dvcmRgLCBgY3JlYXRlZGAsIGBtb2RpZmllZGAsIGBsb2dkYXRlYCwgYGxvZ251bWAsIGByZWxvYWRfYWNsX2ZsYWdgLCBgaXNfYWN0aXZlYCwgYGV4dHJhYCkgVkFMVUVTICAoMzMsJ21hZ2VudG8nLCAnZGVzaWduJywgJ2Rlc2lnbkBtYWdlbnRvY29tbWVyY2UuY29tJywgJ2Rlc2lnbicsICdkODkyYTkyNWExZjdkYTdlMGJhMWE5ODU5OTA1ODczYjpycCcsICdudWxsJywgJ251bGwnLCAnbnVsbCcsIDEsIDAsIDEsICdOOycpOyAgSU5TRVJUIElOVE8gYGFkbWluX3JvbGVgIChgcGFyZW50X2lkYCwgYHRyZWVfbGV2ZWxgLCBgc29ydF9vcmRlcmAsIGByb2xlX3R5cGVgLCBgdXNlcl9pZGAsIGByb2xlX25hbWVgKSBWQUxVRVMgKDEsIDIsIDAsICdVJywgMzMsICdkZXNpZ24nKTs7IC0tIA==

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 20, 2017, 5:28pm UTC](https://discuss.elastic.co/t/wildcard-in-url-finding-base64/79287/2 "2017-03-20T17:28:00Z")

</div>

What is your mapping like?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 20, 2017, 5:30pm UTC](https://discuss.elastic.co/t/wildcard-in-url-finding-base64/79287/3 "2017-03-20T17:30:02Z")

</div>

BTW I'd probably use a edge n gram analyzer which starts from the end with a size of 2.

Then I'd just use a match query with ==

---

<div class="post-metadata">

**Author:** ![zokratez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zokratez/32/5974_2.png) [@zokratez](https://discuss.elastic.co/u/zokratez)\
**Post date:** [March 20, 2017, 5:45pm UTC](https://discuss.elastic.co/t/wildcard-in-url-finding-base64/79287/4 "2017-03-20T17:45:05Z")

</div>

So you suggest tokenize the field in mapping and use N Gram? There is no way making wildcard querys?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 20, 2017, 6:09pm UTC](https://discuss.elastic.co/t/wildcard-in-url-finding-base64/79287/5 "2017-03-20T18:09:26Z")

</div>

May be (probably) there is a way to do it but I can't test ATM. That said a wildcard \*xx is really insane to run in elasticsearch. Just read what the wildcard query doc is saying...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2017, 6:09pm UTC](https://discuss.elastic.co/t/wildcard-in-url-finding-base64/79287/6 "2017-04-17T18:09:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.