REcollapse Is A Helper Tool For Black-Box Regex Fuzzing To Bypass Validations And Discover Normalizations In Web Applications

REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications.

It can also be helpful to bypass WAFs and weak vulnerability mitigations. For more information, take a look at the REcollapse blog post.

The goal of this tool is to generate payloads for testing. Actual fuzzing shall be done with other tools like Burp (intruder), ffuf, or similar.


Requirements: Python 3

pip3 install --user --upgrade -r requirements.txt or ./install.sh


docker build -t recollapse . or docker pull 0xacb/recollapse


$ recollapse -husage: recollapse [-h] [-p POSITIONS] [-e {1,2,3}] [-r RANGE] [-s SIZE] [-f FILE]                  [-an] [-mn MAXNORM] [-nt]                  [input]REcollapse is a helper tool for black-box regex fuzzing to bypass validations anddiscover normalizations in web applicationspositional arguments:  input                 original inputoptions:  -h, --help            show this help message and exit  -p POSITIONS, --positions POSITIONS                        pivot position modes. Example: 1,2,3,4 (default). 1: starting,                        2: separator, 3: normalization, 4: termination  -e {1,2,3}, --encoding {1,2,3}                        1: URL-encoded format (default), 2: Unicode format, 3: Raw                        format  -r RANGE, --range RANGE                        range of bytes for fuzzing. Example: 0,0xff (default)  -s SIZE, --size SIZE  numb   er of fuzzing bytes (default: 1)  -f FILE, --file FILE  read input from file  -an, --alphanum       include alphanumeric bytes in fuzzing range  -mn MAXNORM, --maxnorm MAXNORM                        maximum number of normalizations (default: 3)  -nt, --normtable      print normalization table

Detailed options explanation

Let's consider this_is.an_example as the input.


  1. Fuzz the beginning of the input: $this_is.an_example
  2. Fuzz the before and after special characters: this$_$is$.$an$_$example
  3. Fuzz normalization positions: replace all possible bytes according to the normalization table
  4. Fuzz the end of the input: this_is.an_example$


  1. URL-encoded format to be used with application/x-www-form-urlencoded or query parameters: %22this_is.an_example
  2. Unicode format to be used with application/json: \u0022this_is.an_example
  3. Raw format to be used with multipart/form-data: "this_is.an_example


Specify a range of bytes for fuzzing: -r 1-127. This will exclude alphanumeric characters unless the -an option is provided.


Specify the size of fuzzing for positions 1, 2 and 4. The default approach is to fuzz all possible values for one byte. Increasing the size will consume more resources and generate many more inputs, but it can lead to finding new bypasses.


Input can be provided as a positional argument, stdin, or a file through the -f option.


By default, alphanumeric characters will be excluded from output generation, which is usually not interesting in terms of responses. You can allow this with the -an option.

Maximum number or normalizations

Not all normalization libraries have the same behavior. By default, three possibilities for normalizations are generated for each input index, which is usually enough. Use the -mn option to go further.

Normalization table

Use the -nt option to show the normalization table.


$ recollapse -e 1 -p 1,2,4 -r 10-11 https://legit.example.com%0ahttps://legit.example.com%0bhttps://legit.example.comhttps%0a://legit.example.comhttps%0b://legit.example.comhttps:%0a//legit.example.comhttps:%0b//legit.example.comhttps:/%0a/legit.example.comhttps:/%0b/legit.example.comhttps://%0alegit.example.comhttps://%0blegit.example.comhttps://legit%0a.example.comhttps://legit%0b.example.comhttps://legit.%0aexample.comhttps://legit.%0bexample.comhttps://legit.example%0a.comhttps://legit.example%0b.comhttps://legit.example.%0acomhttps://legit.example.%0bcomhttps://legit.example.com%0ahttps://legit.example.com%0b


This technique has been presented on BSidesLisbon 2022

Blog post: https://0xacb.com/2022/11/21/recollapse/



Normalization table: https://0xacb.com/normalization_table



Disqus Comments