NAME

SYNOPSIS

DESCRIPTION

    name|type|offset|string

where string is the URL encoded form of the raw data.

Feeding the output of this utility to ftimes-dig2ctx(1) allows you to extract a variable amount of context surrounding each hit.

OPTIONS

-D

Dump the specified type information to stdout and exit. Currently, the following types are supported: DOMAIN|HOST, EIN|TIN, SSN|SOCIAL, and STATE.

-H

Print offsets in hex. If not set, offsets will be printed in decimal.

-h

Print a header line.

-q

Don't report errors (i.e., be quiet) while processing files.

-R

Dump domain regex information to stdout and exit.

-r

Operate on regular files only.

-s length

Specifies the save length. This is the maximum number of bytes to carry over from one search buffer to the next.

-T tag

Specifies a tag that is used to identify the dig string. Each internally defined search type has a default tag value. This option would typically be used to assign a tag to a CUSTOM search type.

Note: The default tag, if any, is trumped by this value.

-t {type|custom=regexp}

Specifies the type of search that is to be conducted. Currently, the following types are supported: CUSTOM, HOST, IP, PASS|PASSWORD, SSN|SOCIAL, T1|TRACK1, T1S|TRACK1-STRICT, T2|TRACK2, and T2S|TRACK2-STRICT. The default value is IP. The value for this option is not case sensitive.

If the specified type is CUSTOM, then it must be accompanied by a valid regular expression. The required format for this argument is:

    custom = <regexp>
    

Any whitespace surrounding these tokens is ignored, but whitespace within <regexp> is not. Proper quoting is essential when specifying custom expressions. When in doubt, use single quotes like so:

    'custom=(?i)abc123'
    

Custom expressions are automatically wrapped in a single set of capturing parentheses. Therefore, the value of $1 (i.e., the entire pattern) is copied directly to the output stream. You can control which subpattern constitutes $1 by enabling expert mode (see -x).

-x

Enable expert mode. When this mode is active, custom expressions are not automatically wrapped in a single set of capturing parentheses. However, since $1 is still required, you must specify at least one set of capturing parentheses in your expression. For example, the following expression allows you to match on the string '123' when it is prefixed by any form of 'abc' or 'def':

    'custom=(?i)(?:abc|def)(123)'
    

AUTHOR

SEE ALSO

LICENSE