SauronEye: a search tool to facilitate your hunger for credentials
- 1 minSauronEye is a search tool built to aid red teams in finding files containing specific keywords (i.e. files containing credentials, passwords and other secrets). It’s a .NET command-line tool that is small enough to be loaded as an inline assembly in most common C2 frameworks such as Cobalt Strike.
Features:
- Search multiple (network) drives
- Search contents of files
- Search contents of Microsoft Office files (
.doc,.docx,.xls,.xlsx) - Find VBA macros in old 2003
.xlsand.docfiles - Search multiple drives multi-threaded for increased performance
- Supports regular expressions in search keywords
- Compatible with Cobalt Strike’s execute-assembly
It’s also quite fast, can do 50k files, totalling 1,3 TB on a network drive in under a minute (with realistic file filters). Searches a C:\ (on a cheap SATA SSD) in about 15 seconds.
SauronEye is available for download on Github.