use Text::Balanced qw(extract_bracketed); my $rex = qr/(?s):(\w+) (\(.*)/; my $href = {}; my $data = join '', ; extract($data, $href); print $href->{info}->{english}->{long_name}, "\n"; ########################################### sub extract { ########################################### my($input, $href) = @_; while($input =~ /$rex/) { my($tok, $str) = ($1, $2); my ($extr, $rest) = extract_bracketed($str, '()'); if($extr =~ /$rex/) { $href->{$tok} = {}; extract($extr, $href->{$tok}); } else { $extr =~ s/^\(|\)$//g; $href->{$tok} = $extr; } $input = $rest; }; return $href; } __DATA__ ("TELNET:OVERFLOW:OPTIONS-REPLY" :info ( :english ( :name ("TELNET:OVERFLOW:OPTIONS-REPLY") :long_name ("TELNET Options Overflow (Response)") :description ("This signature detects attempts to exploit a known vulnerability against the BSD-based TELNET daemon. The option processing function (telrcv) in the daemon produces responses with a fixed size buffer, but does not perform bounds checking. Attackers can send a combination of TELNET protocol options to the daemon to overflow the buffer and execute arbitrary commands.") ) ) :color (red) :severity (5) :category (TELNET) :keywords ("telnet dangerous command bin") )