• Stars
    star
    974
  • Rank 47,011 (Top 1.0 %)
  • Language
    Python
  • License
    GNU General Publi...
  • Created over 4 years ago
  • Updated 4 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Spider entire networks for juicy files sitting on SMB shares. Search filenames or file content - regex supported!

MAN-SPIDER

Crawl SMB shares for juicy information. File content searching + regex is supported!

manspider

File types supported:

  • PDF
  • DOCX
  • XLSX
  • PPTX
  • any text-based format
  • and many more!!

MAN-SPIDER will crawl every share on every target system. If provided creds don't work, it will fall back to "guest", then to a null session.

manspider

Installation:

(Optional) Install these dependencies to add additional file parsing capability:

# for images (png, jpeg)
$ sudo apt install tesseract-ocr

# for legacy document support (.doc)
$ sudo apt install antiword

Install manspider (please be patient, this can take a while):

$ pip install pipx
$ pipx install git+https://github.com/blacklanternsecurity/MANSPIDER

Example #1: Search the network for filenames that may contain creds

NOTE: matching files are automatically downloaded into $HOME/.manspider/loot! (-n to disable)

$ manspider 192.168.0.0/24 -f passw user admin account network login logon cred -d evilcorp -u bob -p Passw0rd

Example #2: Search for XLSX files containing "password"

$ manspider share.evilcorp.local -c password -e xlsx -d evilcorp -u bob -p Passw0rd

Example #3: Search for interesting file extensions

$ manspider share.evilcorp.local -e bat com vbs ps1 psd1 psm1 pem key rsa pub reg txt cfg conf config -d evilcorp -u bob -p Passw0rd

Example #4: Search for finance-related files

This example searches financy-sounding directories for filenames containing 5 or more consecutive numbers (e.g. 000202006.EFT)

$ manspider share.evilcorp.local --dirnames bank financ payable payment reconcil remit voucher vendor eft swift -f '[0-9]{5,}' -d evilcorp -u bob -p Passw0rd

Example #5: Search for certificates

$ manspider share.evilcorp.local -e pfx p12 pkcs12 pem key crt cer csr jks keystore key keys der -d evilcorp -u bob -p Passw0rd

Usage Tip #1:

You can run multiple instances of manspider at one time. This is useful when one instance is already running, and you want to search what it's downloaded (similar to grep -R). To do this, specify the keyword loot as the target, which will search the downloaded files in $HOME/.manspider/loot.

Usage Tip #2:

Reasonable defaults help prevent unwanted scenarios like getting stuck on a single target. All of these can be overridden:

  • default spider depth: 10 (override with -m)
  • default max filesize: 10MB (override with -s)
  • default threads: 5 (override with -t)
  • shares excluded: C$, IPC$, ADMIN$, PRINT$ (override with --exclude-sharenames)

Usage Tip #3:

Manspider accepts any combination of the following as targets:

  • IPs
  • hostnames
  • subnets (CIDR format)
  • files containing any of the above
  • local folders containing files

For example, you could specify any or all of these:

  • 192.168.1.250
  • share.evilcorp.local
  • 192.168.1.0/24
  • smb_hosts.txt
  • loot (to search already-downloaded files)
  • /mnt/share (to recursively search a directory)
    • NOTE: when searching local files, you must specify a directory, not an individual file

Usage:

usage: manspider [-h] [-u USERNAME] [-p PASSWORD] [-d DOMAIN] [-m MAXDEPTH] [-H HASH] [-t THREADS] [-f REGEX [REGEX ...]] [-e EXT [EXT ...]] [--exclude-extensions EXT [EXT ...]]
                 [-c REGEX [REGEX ...]] [--sharenames SHARE [SHARE ...]] [--exclude-sharenames [SHARE ...]] [--dirnames DIR [DIR ...]] [--exclude-dirnames DIR [DIR ...]] [-q] [-n]
                 [-mfail INT] [-o] [-s SIZE] [-v]
                 targets [targets ...]

Scan for juicy data on SMB shares. Matching files and logs are stored in $HOME/.manspider. All filters are case-insensitive.

positional arguments:
  targets               IPs, Hostnames, CIDR ranges, or files containing targets to spider (NOTE: local searching also supported, specify directory name or keyword "loot" to search
                        downloaded files)

optional arguments:
  -h, --help            show this help message and exit
  -u USERNAME, --username USERNAME
                        username for authentication
  -p PASSWORD, --password PASSWORD
                        password for authentication
  -d DOMAIN, --domain DOMAIN
                        domain for authentication
  -m MAXDEPTH, --maxdepth MAXDEPTH
                        maximum depth to spider (default: 10)
  -H HASH, --hash HASH  NTLM hash for authentication
  -t THREADS, --threads THREADS
                        concurrent threads (default: 5)
  -f REGEX [REGEX ...], --filenames REGEX [REGEX ...]
                        filter filenames using regex (space-separated)
  -e EXT [EXT ...], --extensions EXT [EXT ...]
                        only show filenames with these extensions (space-separated, e.g. `docx xlsx` for only word & excel docs)
  --exclude-extensions EXT [EXT ...]
                        ignore files with these extensions
  -c REGEX [REGEX ...], --content REGEX [REGEX ...]
                        search for file content using regex (multiple supported)
  --sharenames SHARE [SHARE ...]
                        only search shares with these names (multiple supported)
  --exclude-sharenames [SHARE ...]
                        don't search shares with these names (multiple supported)
  --dirnames DIR [DIR ...]
                        only search directories containing these strings (multiple supported)
  --exclude-dirnames DIR [DIR ...]
                        don't search directories containing these strings (multiple supported)
  -q, --quiet           don't display matching file content
  -n, --no-download     don't download matching files
  -mfail INT, --max-failed-logons INT
                        limit failed logons
  -o, --or-logic        use OR logic instead of AND (files are downloaded if filename OR extension OR content match)
  -s SIZE, --max-filesize SIZE
                        don't retrieve files over this size, e.g. "500K" or ".5M" (default: 10M)
  -v, --verbose         show debugging messages

More Repositories

1

bbot

A recursive internet scanner for hackers.
Python
4,389
star
2

writehat

A pentest reporting tool written in Python. Free yourself from Microsoft Word.
Python
1,260
star
3

TREVORspray

TREVORspray is a modular password sprayer with threading, clever proxying, loot modules, and more!
Python
1,016
star
4

badsecrets

A library for detecting known secrets across many web frameworks
Python
471
star
5

TREVORproxy

A SOCKS proxy written in Python that randomizes your source IP address. Round-robin your evil packets through SSH tunnels or give them billions of unique source addresses!
Python
315
star
6

offensive-azure

Collection of offensive tools targeting Microsoft Azure
Python
164
star
7

kali-setup-script

Bash script which prepares Kali for a pentest by enabling session logging, installing tools, and making common configuration changes
Shell
136
star
8

baddns

Check subdomains for subdomain takeovers and other DNS tomfoolery
Python
94
star
9

spiderfoot-neo4j

Import, visualize, and analyze SpiderFoot scans in Neo4j, a graph database
Python
65
star
10

credshed

credshed - a scalable database for credential leaks. Written in Python, it can easily ingest poorly-formatted files or entire directories into a searchable database. MongoDB is used in the backend.
Python
53
star
11

cloudcheck

Check whether an IP address or hostname belongs to popular cloud providers
Python
45
star
12

dp_cryptomg

Another tool for exploiting CVE-2017-9248, a cryptographic weakness in Telerik UI for ASP.NET AJAX dialog handler.
Python
43
star
13

KCMTicketFormatter

Format SSSD Raw Kerberos Payloads into CCACHE files for use on Windows systems
Python
35
star
14

Convert-Invoke-Kerberoast

Converts the output from Invoke-Kerberoast into hashcat format.
Python
32
star
15

fulcrom

A web shell for pivoting and lateral movement
Python
32
star
16

evilginx-setup-script

A quick-and-easy bash script installing and launching EvilGinx2, a phishing reverse-proxy
Shell
24
star
17

bls-bible

BLS-Bible is a knowledge-base application that houses a collection of guides and write-ups that BLS uses for our various operations.
Python
24
star
18

zmap-asset-inventory

Python script which takes internal asset inventory at scale using zmap. Outputs to CSV.
Python
20
star
19

public-dns-servers

A CI/CD-verified list of the internet's known-good public DNS servers (from public-dns.info) Updated weekly!
Python
20
star
20

enter_the_matrix

ETM enables the creation of detailed attack graphs and figures while calculating the risk associated with your attack narratives. ETM was built keeping NIST recommendations on threat matrices in mind. Features an API to interact on your data to act as a living database of your executed threat models.
C#
20
star
21

bbot-vivagraphjs

Visualize BBOT scans in realtime with VivaGraphJS
HTML
19
star
22

webspray

Fuzz for hidden proxies, vhosts, and URLs
Python
16
star
23

sigma-rules

A collection of Sigma rules organized by MITRE ATT&CK technique
13
star
24

bbot-module-playground

A proving grounds for young and aspiring BBOT modules
Python
13
star
25

nmappalyzer

A lightweight Python 3 Nmap wrapper that doesn't try too hard. Gracefully handles any Nmap command, providing access to all output types (normal, greppable, xml), plus JSON!
Python
12
star
26

mklnk

Create a lnk shortcut file for Windows
Python
8
star
27

parse-crackmapexec

Generates statistics based on output from CrackMapExec. Ideal for enumeration of host-based controls.
Python
8
star
28

credshed-api

REST API for Credshed
Python
6
star
29

credshed-gui

Vue.js frontend for credshed
SCSS
6
star
30

Cisco-7937G-PoCs

Proofs of concept for three vulnerabilities affecting the Cisco 7937G Conference Station
Python
5
star
31

JSDiagrammer

Simple javascript library that will aid in creating simple diagrams with pictures for nodes and arrows for the edges connecting nodes.
JavaScript
5
star
32

blue-resources

A collection of helpful blue team resources
4
star
33

radixtarget

RadixTarget is a performant radix implementation designed for quick lookups of IP addresses/networks and DNS hostnames.
Python
4
star
34

filter-qualys-csv

Cut down on the size of Qualys' scan results by filtering based on severity, keywords, etc. Written in Python.
Python
3
star
35

BLSPyUtils

Repo for small functions used often in Python.
Python
3
star
36

ASM_BBOT_Training

HCL
2
star