从 Python 中的 json 中提取值

Question

I am extracting the value input from string using python.

{"eventid":"cowrie.command.input","input":"cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KUHJY","message":"CMD: cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KUHJY","sensor":"cowrieHoneypot2","timestamp":"2021-05-06T00:20:09.535217Z","src_ip":"76.250.199.133","session":"e3e61e8606ed"}
{"eventid":"cowrie.command.input","input":"tftp; wget; /bin/busybox KUHJY","message":"CMD: tftp; wget; /bin/busybox KUHJY","sensor":"cowrieHoneypot2","timestamp":"2021-05-06T00:20:09.729719Z","src_ip":"76.250.199.133","session":"e3e61e8606ed"}

Now, what regex should I use as in one string the value of the input is:

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KUHJY

Whereas, the value of the input in the next string is:

tftp; wget; /bin/busybox KUHJY

So, how can I simply extract the value of Input? Some sample strings are given in this file . Thanks in advance.

Answer 1

This really seems like more of a problem of parsing your JSON content than using regex:

import json

text = '{"eventid":"cowrie.command.input","input":"cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KUHJY","message":"CMD: cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KUHJY","sensor":"cowrieHoneypot2","timestamp":"2021-05-06T00:20:09.535217Z","src_ip":"76.250.199.133","session":"e3e61e8606ed"}'
json = json.loads(text)
inp = json["input"]
print(inp)

This prints:

cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox KUHJY