loading
Loading content
loading
Misconfiguration
Find files on web servers that should not be public.
overview
snallygaster requests curated candidate paths against a host and inspects responses for files never meant to be public: exposed git/svn repos, backups, dumps, stray .env files, and leaked keys.
Default output stays on real security issues. Leave --info and --noisy off; use --tests to run a named subset, --path to scope a base directory, and --nohttp or --nohttps to pick a protocol.
Run it after probing across confirmed live hosts. For IIS short-name leakage use shortscan; for request smuggling use smuggler.
use cases
Scan a host list for publicly reachable .git and .svn directories that leak source code, history, and hardcoded secrets, a common and high-impact misconfiguration.
Look for backup files, database dumps, and stray .env files left in the web root that may contain credentials or sensitive data.
Restrict to a base path, a named test set, and a single protocol so a scan across a large estate stays fast and focused on what matters.
Run snallygaster after probing so each confirmed live host is checked for exposed files before scanning moves on.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| hosts | STRING | · | Hostname to scan. |
| path | STRING | --path | Base path on the server (scans the root directory by default). |
| tests | STRING | --tests | Comma-separated list of tests to run. |
| info | BOOLEAN | --info | Enable all info tests (no bugs or security vulnerabilities). |
| nowww | BOOLEAN | --nowww | Skip scanning the www.[host] variant. |
| nohttp | BOOLEAN | --nohttp | Do not scan over HTTP. |
| nohttps | BOOLEAN | --nohttps | Do not scan over HTTPS. |
| useragent | STRING | --useragent | User agent to send in the request header. |
Showing key inputs. snallygaster exposes 10 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| info | BOOLEAN | --info | Enable all info tests (no bugs or security vulnerabilities). |
| path | STRING | --path | Base path on the server (scans the root directory by default). |
| debug | BOOLEAN | --debug | Show detailed debugging info. |
| hosts | STRING | · | Hostname to scan (positional argument). |
| noisy | BOOLEAN | --noisy | Show noisy messages that indicate boring bugs, but no security issue. |
| nowww | BOOLEAN | --nowww | Skip scanning the www.[host] variant. |
| tests | STRING | --tests | Comma-separated list of tests to run. |
| nohttp | BOOLEAN | --nohttp | Do not scan over HTTP. |
| nohttps | BOOLEAN | --nohttps | Do not scan over HTTPS. |
| useragent | STRING | --useragent | User agent to send in the request header. |
example
# scan two hosts over HTTPS only, focused on exposed repos and dumpssnallygaster --nohttp --tests git_dir,svn_dir,sql_dump,backupfiles example.com staging.example.com[git_dir] http://example.com/.git/config[git_dir] http://example.com/.git/HEAD[dotenv] https://example.com/.env[sql_dump] https://example.com/backup/dump.sql[backupfiles] http://example.com/index.php.bak[ds_store] https://example.com/.DS_Store[apache_server_status] http://example.com/server-status[privatekey] https://example.com/server.keyguidance
Use snallygaster to find exposed files and server misconfigurations across an estate. For IIS-specific short-name leakage use shortscan; for request smuggling use smuggler. Run all three against a probed host list when relevant.
IIS 8.3 short-name leakage specifically. snallygaster covers broader, server-agnostic file exposure.
Tests for request smuggling rather than exposed files. A different misconfiguration class.
Finds hijackable broken social links by crawling. Another exposure check on the same surface.
faq
A host list feeds snallygaster, which probes each server for exposed files and writes the confirmed misconfigurations as a queryable output.
Facts on this page come from the live Trickest tool library.