SnaffCon / Snaffler

a tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Case Sensitive Matching

cmprmsd opened this issue · comments

Hi! :)
I noticed during my tests, that the matching is always case insensitive as also described in your readme.

When we want to match certain words in regex rules e.g. PINs? it would also match many other words e.g.

  • mmcsnapins
  • igxpin.exe
  • colorschememapping.xml
  • SnapIn.dll
  • mdmpin.inf
  • mdmpin.PNF
  • EmpInv.xml

and many more. This could be ruled out (hoho) with case sensitive matching and drastically reduce false positives.

As I already identified several interesting files with PIN matching I would not want to drop the keyword as a whole.

I hope the detailed feedback and many issues are okay and Snaffler won't murder me. 🔪

The short answer here is that there is a definite trade-off in making it case-insensitive, but the benefits of maintaining case sensitivity are relatively minor, and the benefits of removing it are substantial.

I don't plan on bringing back case sensitivity, but if you want to make a fork that has it, all you'll need to do is search the code for "RegexOptions.IgnoreCase" and remove it.

Thanks for the hint! It's good to understand the background of your decision 😊
Is this a trade-off in crawl speed or the way you have to build the rules?