MANSPIDER

MANSPIDER (Black Lantern Security) crawls readable SMB shares across one or many hosts and greps inside the files it finds, so it catches secrets buried in documents, spreadsheets and text files rather than just interesting filenames. -c/--content takes one or more regexes matched against extracted file contents (it can parse PDF, Office and other formats), while -f/--filenames and -e/--extensions narrow the crawl by name or type. It downloads matching files to the loot directory by default; add -n/--no-download for a quieter content-only sweep. Useful for wide domain-scale secret hunting once you hold any domain account. Command Reference: Target IP: 10.10.10.1 Domain: test.local Username: john Password: password123

# Search file CONTENT for 'password' across all readable shares on a host
manspider 10.10.10.1 -c password -u john -p password123 -d test.local

# Hunt spreadsheets/office docs mentioning credentials, content-only (no download)
manspider 10.10.10.1 -c passw creds -e xlsx docx csv -n -u john -p password123 -d test.local

Evidence

Upstream reference

Environment

Active Directory

Native

Collection, Credential Access, Discovery

Requires

Username, Password

Services

SMB

Refs

github.com/blacklanternsecurity/MANSPIDER

www.blacklanternsecurity.com/2020-11-04-MANSPIDER/