SauronEye v0.0.8 releases: find specific files containing specific words
SauronEye is a search tool built to aid red teams in finding files containing specific keywords.
- Search multiple (network) drives
- Search contents of files
- Search contents of Microsoft Office files (.doc, .docx, .xls, .xlsx)
- Search multiple drives multi-threaded for increased performance
- Compatible with Cobalt Strike’s execute-assembly
It’s also quite fast, can do 50k files, totaling 1,3 TB on a network drive in under a minute (with realistic file filters). Searches a C:\ (on a cheap SATA SSD) in about 15 seconds.
- Fixes a bug where paths containing a sharename with a $-sign would not be searched.
- Reported by @stanhegt in #6
SauronEye.exe -Dirs C:\, \\SOMENETWORKDRIVE\C$ -FileTypes .txt,.bat,.docx, .conf -Contents -Keywords password,pass -SystemDirs
SauronEye does not search for %WINDIR% and %APPDATA%. Use the -SystemDirs flag to search the contents of Program Files*. SauronEye relies on multi-threading libraries only available from .NET 4.0, and so requires >= .NET 4.0 to run.
Copyright (C) 2019 vivami