Keep certain blocks of text



  • So I’m doing a project for a firewall script I’m using and rather than pay Shodan a massive amount of money to obtain the data I figured I’d do it myself via Zenmap. Now I have blocks of results that have to be filtered. This is what I have:

    Nmap scan report for such*such.net (12.3.4)

    Host is up (0.14s latency).

    PORT STATE SERVICE

    53/tcp filtered cwmp

    Nmap scan report for such&such.com (4.3.2.1)

    Host is up (0.14s latency).

    PORT STATE SERVICE

    53/tcp open cwmp

    So what I need is the chunk of text that says that IP has an open port.
    I count 8 lines after the “Nmap scan report…” to the open port part of 53. Is there a plugin that can do this? If so, how would I do this?

    Thanks.



  • @737simpilot ,

    No plugin, specifically. But I think your goal can be met with the regular expression searching (regex) and bookmarking built into Notepad++.

    It’s hard to tell exactly how bad your text has been mangled by the forum (use the </> button when making your post to make sure the text is treated as plain text, rather than being in forum markdown), which might influence the exact makeup of the regex. But my first guess for a solution, assuming it’s always exactly 8 lines in the match, and that the port always has to say exacty 53/tcp open cwmp on the eighth line.

    • Search > Mark
    • FIND WHAT = ^Nmap scan report for(.*\R){7}^53/tcp open cwmp
      • start of line, the literal text Nmap scan report for, followed by 7 instances of anything up to the newline sequence, followed by exactly 53/tcp open cwmp
    • Search Mode = regular expression
    • enable ☑ Bookmark Line
    • click Clear all marks if you already have previous bookmarks that you want to get rid of
    • click Mark All

    What you do next depends on what you want to do with the matching data.

    • If you want all the matching data in the Windows clipboard to paste somewhere else, Copy Marked Text in the dialog, and paste it wherever you want
    • If you want to delete everything that’s not a matching section, then go to the Search menu, then the Bookmark > submenu, and Remove Unbookmarked Lines
    • That **Search > Bookmark > ** submenu has many other options for manipulating the bookmarked

    For more info on bookmarking, see https://npp-user-manual.org/docs/searching/#highlighting-and-bookmarking

    Example Data (using the formatting hint from above, also mentioned in the footnote at the bottom):

    Nmap scan report for such*such.net (12.3.4)
    Host is up (0.14s latency).
    PORT STATE SERVICE
    53/tcp filtered cwmp
    Nmap scan report for such&such.com (4.3.2.1)
    Host is up (0.14s latency).
    PORT STATE SERVICE
    53/tcp open cwmp
    Nmap scan report for such*such.net (12.3.4)
    Host is up (0.14s latency).
    PORT STATE SERVICE
    53/tcp filtered cwmp
    Nmap scan report for such&such.com (4.3.2.1)
    Host is up (0.14s latency).
    PORT STATE SERVICE
    53/tcp closed so don't match
    Nmap scan report for such*such.net (12.3.4)
    Host is up (0.14s latency).
    PORT STATE SERVICE
    53/tcp filtered cwmp
    Nmap scan report for such&such.com (4.3.2.1)
    Host is up (0.14s latency).
    PORT STATE SERVICE
    53/tcp open cwmp
    

    In this example, I believe you want the first 8 lines and the last 8 lines to match, but not the center 8 lines.
    For me, it does match:
    a660329c-6fae-4a36-aa2d-6bdceab16033-image.png

    If this isn’t sufficient for you, please follow the advice below and clarify.

    ----

    Do you want regex search/replace help? Then please be patient and polite, show some effort, and be willing to learn; answer questions and requests for clarification that are made of you. All example text should be marked as literal text using the </> toolbar button or manual Markdown syntax. To make regex in red (and so they keep their special characters like *), use backticks, like `^.*?blah.*?\z`. Screenshots can be pasted from the clipboard to your post using Ctrl+V to show graphical items, but any text should be included as literal text in your post so we can easily copy/paste your data. Show the data you have and the text you want to get from that data; include examples of things that should match and be transformed, and things that don’t match and should be left alone; show edge cases and make sure you examples are as varied as your real data. Show the regex you already tried, and why you thought it should work; tell us what’s wrong with what you do get. Read the official NPP Searching / Regex docs and the forum’s Regular Expression FAQ. If you follow these guidelines, you’re much more likely to get helpful replies that solve your problem in the shortest number of tries.


Log in to reply