Sniff the SMB partage to get sensitive information

[19]

Absolutely, here's the tutorial in English, no emojis:

---

What is Snaffler?Snaffler is an open-source tool designed for internal penetration testing or red teaming in Windows environments.
Its main purpose is to scan SMB shares across a network and identify potentially sensitive files—things like configuration files, scripts, database exports, and especially files containing credentials.
In short, it helps you automatically find interesting or sensitive files on accessible file shares in a Windows domain.

---

What is Snaffler used for?Snaffler helps identify files that might contain:

• Plaintext passwords (
  Code:

  passwords.txt
  ,
  
  Code:

  .env
  ,
  
  Code:

  .xml
  , etc.)
  
• API keys or secrets
  
• PowerShell scripts or batch files
  
• Database exports
  
• Configuration files containing internal info
  

The goal is to automate the process of hunting for loot during internal assessments.

---

How to Use Snaffler – Step-by-Step Guide1. Download Snaffler
You can clone the repository from GitHub:

 

Code:

git clone https://github.com/reddrabit1337/Snaffler.git

Or download a precompiled release here:
https://github.com/reddrabit1337/Snaffler
If you're using the source code, you'll need to compile it with Visual Studio.

---

2. Run SnafflerOnce you have the binary, run it from a command prompt or PowerShell on a machine connected to the domain:

 

Code:

Snaffler.exe -v

This will show you all the available options.
A basic scan looks like this:

 

Code:

Snaffler.exe -d yourdomain.local

Or scan a specific subnet:

 

Code:

Snaffler.exe 192.168.1.0/24

---

3. Useful OptionsOptionDescription

Code:

-d

Target domain name

Code:

-f

Use a filters file (define what to include/exclude)

Code:

-o

Output file for results

Code:

-c

Output in JSON format

Code:

-q

Quiet mode (less verbose)

Code:

--shares

Only list network shares without scanning filesExample with filters and output file:

 

Code:

Snaffler.exe -d YOURDOMAIN.LOCAL -f filters\default.filters -o results.json -c

---

Best Practices

• Run Snaffler after privilege escalation to get access to more shares.
  
• Use it in combination with tools like BloodHound or SharpHound for deeper analysis.
  
• Filter or parse the JSON output for quick triage.
  

•