# hannob/snallygaster

Tool to scan for secret files on HTTP servers

Repository: https://github.com/hannob/snallygaster
Canonical: https://ross.abutalabs.com/products/snallygaster
Language: Python
License: 0BSD
License Family: permissive
Topics: security, websecurity
Last push: 2026-02-04T11:26:43+00:00

## Health v2 (maintenance only)
Score: 54/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 65, release rhythm 15, longevity 100
- inputs: {"age_days": 3067, "days_push": 210, "days_rel": 359, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2110, forks 231 (observed 2026-08-28T04:06:14.192754+00:00)

## What it is
Snallygaster is a Python command-line scanner that probes HTTP servers for files that should not be publicly accessible, such as exposed git repositories, backup files, and database dumps. It bundles a set of checks for common web server misconfigurations and related security vulnerabilities.

## Use cases
- find exposed .git directories on my web server
- scan a website for leaked backup files containing passwords
- check if database dumps are publicly downloadable on my server
- audit a web server for misconfigured sensitive files
- detect file leaks on HTTP servers before deployment
- test my site for publicly accessible secret files

## When to choose
- you want a lightweight, dependency-minimal Python script to find exposed files on a web server
- you need a quick black-box check for common web misconfigurations like open git repos or leftover backups
- you prefer a single-purpose scanner over a full vulnerability suite
- you want a tool packaged in major Linux/BSD distributions and PyPI

## When to avoid
- you need a comprehensive web vulnerability scanner with crawling, fuzzing, or exploit modules
- you require authenticated scanning or deep application-layer testing
- you want continuous monitoring or CI integration rather than on-demand scans
- you need scanning of non-HTTP services or protocols

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, http-client, cli
- domain: security, web-development, penetration-testing, developer-tools
- platform: python, cli, cross-platform
- tags: file-leak-detection, web-server-audit, secret-file-scanner, misconfiguration-scanner, http-security-scanner, linux

## Member repositories
- hannob/snallygaster (main) score 54

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:14.192754+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:53:45.139240+00:00, confidence not recorded.
  - readme: https://github.com/hannob/snallygaster (fetched 2026-08-28T04:06:14.192754+00:00, sha 19967911d363)
  - registry_pypi: https://pypi.org/pypi/snallygaster/json (fetched 2026-08-29T10:33:50.026531+00:00, sha b04ca4bb182f)
- Data as of 2026-08-30T08:39:29.467469+00:00.