A Python tool that scans HTTP servers for publicly accessible secret files and security vulnerabilities like git repos and backup files.
snallygaster is a Python-based security tool that scans HTTP servers for publicly accessible files that shouldn't be public and could pose security risks. It helps identify file leaks such as git repositories, backup files containing passwords, database dumps, and other sensitive data that attackers could exploit. The tool provides security professionals with a way to audit web servers for common configuration mistakes that lead to data exposure.
Security professionals, penetration testers, system administrators, and developers responsible for maintaining web server security who need to identify file leakage vulnerabilities.
Developers choose snallygaster for its focused approach to detecting real-world file leakage problems, comprehensive test coverage for various security issues, and simplicity as a standalone Python tool that's easy to deploy and run without complex infrastructure.
Tool to scan for secret files on HTTP servers
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Specializes in finding publicly accessible sensitive files like git repositories, backup files, and database dumps, with a detailed test suite documented in TESTS.md.
Runs as a standalone Python 3 script requiring only urllib3, lxml, and dnspython, making it easy to deploy without complex setups.
Includes a well-documented TESTS.md file with links to further information about identified security issues, aiding in understanding and remediation.
Available via pip and packaged for several Linux distributions like Gentoo and openSUSE, simplifying installation across different environments.
Primarily focuses on file leakage with only a few additional security checks, making it insufficient for full-spectrum vulnerability assessments compared to broader scanners.
Lacks built-in reporting, visualization, or GUI features, requiring manual interpretation of raw terminal output which can be time-consuming.
Requires Python 3 and specific libraries, which may pose setup challenges in environments without Python or where dependencies conflict.