Command Palette
Search for a command to run...
Wildcard Search Guide
Master wildcard patterns for flexible and powerful search operations on LeakZero. Wildcard searching allows you to perform pattern matching that can match multiple variations of your search criteria, making your investigations more comprehensive and efficient.
What is Wildcard Search?
Wildcard search uses special characters as placeholders to represent one or more unknown characters in your search pattern. This technique originated from Unix command-line operations and has become a standard in data searching and pattern matching across various platforms.
On LeakZero, wildcard searches allow you to cast a wider net when investigating potential data breaches, enabling you to discover variations of email addresses, usernames, or other identifiers that might have been compromised across different breaches.
Core Wildcard Characters
Examples:
admin*Matches:
- admin
- administrator
- admin_user
- admin.backup.2023
Examples:
Advanced Wildcard Patterns
Complex Pattern Examples:
*admin*@*.company.comThis pattern finds all email addresses containing "admin" anywhere in the local part, from any subdomain of company.com.
user[0-9][0-9]?@test*.orgThis matches user accounts with 2-3 digit numbers from test-related domains.
backup*.??.2023@*This finds backup-related accounts from any 2023-related email across all domains.
Strategic Use Cases
When investigating potential executive compromises, wildcard patterns help uncover personal and professional account variations:
john.doe*@*ceo*@company.comj.doe*@*john*doe*@*Comprehensive departmental investigations benefit from systematic wildcard approaches:
hr*@company.com*hr*@company.comhuman*resources*@company.comWildcard patterns excel at discovering third-party relationship exposures:
*@vendor-name.**vendor*@*partner*@*company.comTime-based patterns help uncover legacy account compromises:
*backup*@**archive*@**old*@**legacy*@*Performance Optimization
Leading Character Specificity:
Always begin patterns with specific characters when possible:
admin*@company.com (efficient)*admin*@* (resource-intensive)Balanced Pattern Complexity:
Strike a balance between comprehensiveness and performance:
user[0-9]*@domain.com*[a-z]*[0-9]*@*.*.* (overly complex)Domain Anchoring:
Anchor searches to specific domains when investigating targeted breaches:
*@target-company.com*@* (overly broad)Common Patterns Library
firstname.lastname*@company.comf.lastname*@company.comfirstname*@company.comadmin*@*administrator*@*root*@*sysadmin*@*service*@*no-reply*@*noreply*@*support*@*username[0-9]*user[0-9][0-9]**[0-9]*admin*user*test*dev*prod*@*.target.com*@dev*.target.com*@staging*.target.com*@target**@*target**@target.*Integration with LeakZero Features
Subscribers with priority search capabilities experience:
- Faster wildcard pattern processing
- Higher result limits for complex patterns
- Reduced queue times during peak usage
Further Reading and Resources
- POSIX Pattern Matching: Official specification for wildcard behavior
- RFC 3977: Network News Transfer Protocol pattern matching standards
- IEEE 1003.2: Shell command language pattern matching specifications
- MITRE ATT&CK Framework: Reconnaissance and discovery techniques
- NIST Cybersecurity Framework: Asset identification and management
- OWASP Testing Guide: Security testing methodologies using pattern matching