How does it find an exposed git repository?

The git_dir test requests known internal paths such as /.git/config and /.git/HEAD and checks that the response is a real repository rather than a generic 404 page. A reachable .git directory leaks source, history, and committed secrets.

How do I keep output on real security issues?

Leave --info and --noisy off. By default snallygaster reports genuine findings. Use --tests to narrow the run, for example git_dir,sql_dump,backupfiles.

Can I scope which tests run and where?

Yes. Set --path for a base directory, --tests for named tests, --nowww to skip the www variant, and --nohttp or --nohttps to limit protocol. Scoping keeps large-estate runs focused.

Where does snallygaster fit in a workflow?

After probing, against confirmed live hosts, so each one is checked for exposed files before deeper scanning and triage. Wire a probed host list into the node and route output into reporting.

Updated Jul 14, 2026

Misconfiguration

Find public files that should stay private

Find files on web servers that should not be public.

Catch exposed git repositories Find leaked backups and dumps Scope a targeted run

overview

What snallygaster does

snallygaster requests curated candidate paths against a host and inspects responses for files never meant to be public: exposed git/svn repos, backups, dumps, stray .env files, and leaked keys.

Default output stays on real security issues. Leave --info and --noisy off; use --tests to run a named subset, --path to scope a base directory, and --nohttp or --nohttps to pick a protocol.

Run it after probing across confirmed live hosts. For IIS short-name leakage use shortscan; for request smuggling use smuggler.

source github.com/hannob/snallygaster

use cases

Where snallygaster fits

Catch exposed git repositories

Scan a host list for publicly reachable .git and .svn directories that leak source code, history, and hardcoded secrets, a common and high-impact misconfiguration.

Find leaked backups and dumps

Look for backup files, database dumps, and stray .env files left in the web root that may contain credentials or sensitive data.

Scope a targeted run

Restrict to a base path, a named test set, and a single protocol so a scan across a large estate stays fast and focused on what matters.

Audit a probed surface

Run snallygaster after probing so each confirmed live host is checked for exposed files before scanning moves on.

reference

snallygaster inputs and flags

10 inputs

Name	Type	Flag	Description
hosts	STRING	·	Hostname to scan.
path	STRING	--path	Base path on the server (scans the root directory by default).
tests	STRING	--tests	Comma-separated list of tests to run.
info	BOOLEAN	--info	Enable all info tests (no bugs or security vulnerabilities).
nowww	BOOLEAN	--nowww	Skip scanning the www.[host] variant.
nohttp	BOOLEAN	--nohttp	Do not scan over HTTP.
nohttps	BOOLEAN	--nohttps	Do not scan over HTTPS.
useragent	STRING	--useragent	User agent to send in the request header.

Showing key inputs. snallygaster exposes 10 inputs in total.

Full flag reference (10 inputs)

Name	Type	Flag	Description
info	BOOLEAN	--info	Enable all info tests (no bugs or security vulnerabilities).
path	STRING	--path	Base path on the server (scans the root directory by default).
debug	BOOLEAN	--debug	Show detailed debugging info.
hosts	STRING	·	Hostname to scan (positional argument).
noisy	BOOLEAN	--noisy	Show noisy messages that indicate boring bugs, but no security issue.
nowww	BOOLEAN	--nowww	Skip scanning the www.[host] variant.
tests	STRING	--tests	Comma-separated list of tests to run.
nohttp	BOOLEAN	--nohttp	Do not scan over HTTP.
nohttps	BOOLEAN	--nohttps	Do not scan over HTTPS.
useragent	STRING	--useragent	User agent to send in the request header.

example

Run snallygaster

snallygaster · command

# scan two hosts over HTTPS only, focused on exposed repos and dumpssnallygaster --nohttp --tests git_dir,svn_dir,sql_dump,backupfiles example.com staging.example.com

sample output

[git_dir] http://example.com/.git/config[git_dir] http://example.com/.git/HEAD[dotenv] https://example.com/.env[sql_dump] https://example.com/backup/dump.sql[backupfiles] http://example.com/index.php.bak[ds_store] https://example.com/.DS_Store[apache_server_status] http://example.com/server-status[privatekey] https://example.com/server.key

guidance

Choosing snallygaster

Use snallygaster to find exposed files and server misconfigurations across an estate. For IIS-specific short-name leakage use shortscan; for request smuggling use smuggler. Run all three against a probed host list when relevant.

shortscan

IIS 8.3 short-name leakage specifically. snallygaster covers broader, server-agnostic file exposure.

smuggler

Tests for request smuggling rather than exposed files. A different misconfiguration class.

socialhunter

Finds hijackable broken social links by crawling. Another exposure check on the same surface.

faq

snallygaster questions

Files that should not be public and related misconfigurations: exposed git and svn repos, backup files, database dumps, stray .env and .DS_Store files, leaked private keys, and open Apache server-status pages. It confirms hits by inspecting the response body, not status codes alone.

Run snallygaster yourself

A host list feeds snallygaster, which probes each server for exposed files and writes the confirmed misconfigurations as a queryable output.

Run snallygaster in Trickest Browse the library

Facts on this page come from the live Trickest tool library.