SnafflePy: When You Need Snaffler's Power But Don't Have a Windows Box

You're on an engagement, you've got valid credentials, and you know there are juicy files sitting on SMB shares across the domain. But there's a problem: Snaffler—that fantastic tool for hunting interesting files on Windows networks—only runs on Windows. And right now, you're on your Linux laptop. That's exactly the gap SnafflePy fills: it's a Python reimplementation of Snaffler that lets you hunt for interesting files over SMB from any machine.

What It Does

SnafflePy is a Python port of the original Snaffler tool. It works in two phases: first, it sends LDAP queries to Active Directory to automatically discover domain-joined machines. Then it attempts to authenticate to those machines over SMB—using either credentials you provide or unauthenticated sessions—and retrieves files that match its interest rules.

The tool is flexible about how you feed it targets. You can let it discover computers automatically via LDAP, or you can disable that and hand it a list of IPs, hostnames, or CIDR ranges directly. It supports both authenticated and unauthenticated enumeration, and it has a sensible fallback chain: if your provided credentials fail, it tries a Guest login, and if that fails, it tries a NULL session.

For identifying interesting files, SnafflePy uses the original TOML rule formats from Snaffler to spot interesting share names. It can currently identify common password files by extension and name, backup files by extension, and Social Security Numbers via regex in file content. The classifier system from Snaffler isn't fully ported yet, but the core file-hunting functionality is there.

Why It's Cool

The obvious win here is platform independence. You're no longer tied to having a domain-joined Windows machine to run a Snaffle-style hunt. That's genuinely useful for penetration testers and red teamers who live on Linux but need to poke at Windows environments.

Beyond that, a few design decisions stand out:

• Graceful auth fallback: The automatic fallback from provided credentials to Guest to NULL session means you don't have to manually test each auth method. It just tries them in order and uses whatever works.

• The --go-loud flag: Sometimes you don't want to be subtle. This flag skips the interesting-file filtering entirely and just enumerates every share and file it can access. The README warns "use at your own risk," which is the right energy for a tool like this.

• Manual target lists: The ability to pass CIDR ranges or a file containing targets means you're not dependent on LDAP discovery. If you already know what you're hunting, you can skip the discovery phase entirely.

• Practical output options: You can download files to a local remotefiles/ directory, or use --no-download to just print file names to stdout. The no-download mode has a limitation—it can only show the top level of files and can't recurse into subdirectories—but it's still handy for quick recon.

• Credential flexibility: You can authenticate with a password or an NT hash, which is convenient if you've already got hashes from another phase of your engagement.

How to Try It

Getting started is straightforward. Clone the repo, set up a virtual environment, and install the dependencies:

git clone https://github.com/asmtlab/snafflepy
cd snafflepy
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt

The basic usage pattern looks like this. To do a full, loud enumeration of everything:

python3 snaffler.py <IP> -u <username> -p <password> -d <domain> --go-loud

Or to let it auto-discover the domain and hunt for interesting shares and files:

python3 snaffler.py <IP> -u <username> -p <password> -v

There are several options worth knowing about. The -m flag lets you set a max file size to snaffle in bytes, which is useful for avoiding huge files that aren't worth pulling down. The -n flag disables computer discovery entirely—useful if you're providing your own target list. And --no-download prints found file names to stdout without pulling files, though as mentioned, it can't recurse into subdirectories.

One note on multiple targets: if you're providing more than one target, you need to use the -n flag. That's a quirk worth remembering so you don't get tripped up.

Final Thoughts

SnafflePy is a practical tool for a specific problem: you want Snaffler's file-hunting capability but you're not on Windows. It's not a complete port yet—the full classifier system from Snaffler is still on the roadmap, along with JSON output and performance improvements—but what's there is functional and useful today.

This is best for penetration testers, red teamers, and sysadmins who need to audit SMB shares from Linux or other non-Windows platforms. If you're already on a Windows domain-joined machine, you're probably better off with the original Snaffler. But if you're not, SnafflePy gives you a solid option that speaks the same language.

The project is actively evolving, and the roadmap items (faster execution, JSON output, the full classifier) suggest it's heading in a good direction. If you're doing SMB enumeration from a non-Windows box, this is worth adding to your toolkit.

Follow @githubprojects for more developer tools and open source projects.