S3cur3Th1sSh1t / SnafflePy

# Snaffler (Python)
A feature-for-feature Python port of SnaffCon/Snaffler,
using **impacket** for SMB share enumeration, file access and authentication, and
**ldap3/impacket LDAP** for Active Directory discovery.
It ships the **same 88 default rules with byte-identical regexes**, produces the
**same log line format**, and adds a filterable HTML report.
Unlike the original it does not need to run on a domain-joined Windows box — you
give it credentials and it runs from Linux/macOS.
 [code] 
## Why
The original Snaffler is a superb tool, but it's a Windows .NET binary that
expects to run as a domain user on a domain-joined host. This port lets you run
the exact same rules and get the exact same findings **from Linux/macOS with
explicit credentials** — over impacket, the way you'd run `secretsdump` or
`smbclient.py` — and adds a self-contained HTML report for triage and hand-off.
## Features
- **Identical findings.** The 88 default rules and all 385 regexes are the
 upstream `.toml` files, unmodified; output is [byte-for-byte identical
 to the original (verified against a compiled C# oracle).
- **impacket everything.** SMB share enumeration (srvsvc `NetrShareEnum`), file
 reads, and LDAP AD discovery all go through impacket.
- **Auth: password, pass-the-hash, Kerberos, null session.**
- **Flexible targeting.** AD auto-discovery, or a single host, a CIDR range, a
 comma-list, or a file of IPs/hostnames/CIDRs.
- **Filterable HTML report** — offline, single file, triage tiles, share/host/
 rule/ext filters, search, sortable/expandable rows, CSV/JSON export.
- **`snaffleplus` extended rules** (opt-in) for GPP cpassword, modern cloud/CI
 tokens, GCP/Azure keys, terraform state, kubeconfig and more.
- Same TSV / JSON / plain log formats and console colours as upstream.
> [!IMPORTANT]
> For **authorized security testing only** — pentests, red-team engagements with
> a signed statement of work, CTFs, and lab/research use. Scanning file shares
> you have no permission to touch is likely illegal. You are responsible for
> staying in scope.
## Install
 [code] 
Python 3.11+ (uses `tomllib`).
### uv
uv installs the tool into an isolated environment,
pulls in `impacket` and `cryptography`, and puts a `snaffler` executable on your
`PATH`:
 [code] 
From a checkout, install the local project instead:
 [code] 
`uvx` runs it once without installing anything:
 [code] 
Upgrade with `uv tool upgrade pysnaffler`, remove with
`uv tool uninstall pysnaffler`.
## Usage
The flags are the originals. Credentials are the only addition, because the C#
version borrows the caller's Windows token and we have no token to borrow.
 [code] 
**You need `-s` (stdout) or `-o` (outfile) or both**, otherwise the tool refuses
to run — same as upstream.
### Original flags
| Flag | Meaning |
|---|---|
| `-s, --stdout` | print results to the console as they're found |
| `-o, --outfile` | write the log to a file |
| `-v, --verbosity` | `trace` \| `debug` \| `info` (default) \| `data` (results onl