Snaffler Output File Parser for Faster Analysis

Snaffler can uncover a large number of potentially sensitive files across Windows networks, but reviewing its output manually becomes difficult in large environments. The Snaffler Output File Parser simplifies this process by converting Snaffler’s tab-separated values (TSV) output into readable reports, sortable HTML pages, and structured data files.

The PowerShell script helps penetration testers and security teams prioritize findings, review accessible network shares, and organize results for client reporting. It is particularly useful during authorized Active Directory assessments where file discovery produces a large volume of results.

Key Features of Snaffler Output File Parser

The parser offers several ways to organize and review Snaffler findings without manually processing a large text file.

• Multiple output formats: Export findings to TXT, CSV, HTML, or JSON for reporting and further analysis.
• Interactive HTML reports: Sort and filter results by severity or file extension, highlight matching keywords in file preview text, and use links to open a parent folder or download a listed file.
• Severity-based sorting: Prioritize findings in the order black, red, yellow, and green, then apply a selected sorting method.
• Severity-based splitting: Use the -split switch to separate generated reports by finding severity.
• PowerShell GridView: Display findings in an interactive grid for convenient examination.
• Share enumeration: Generate a list of shares Snaffler could access during its scan.
• Explorer++ bookmarks: Export discovered shares to Explorer++ configuration files for easier navigation.

Prerequisites and Snaffler TSV Output

The parser requires Snaffler output in TSV format. Run Snaffler with the -y switch to generate the required output file. For example, the following command saves results to snafflerout.txt:

.\Snaffler.exe -o snafflerout.txt -s -y

After the scan finishes, use the generated file as the parser’s input. Keep the original output available so you can verify findings and investigate results when necessary.

Parse Snaffler Output into Reports

Run the parser from PowerShell with the input file specified using -in:

.\snafflerparser.ps1 -in my_snaffler_output.txt

This basic command uses the default sorting order, based on severity and then file modification date. It also generates TXT, CSV, and HTML output by default.

Choose Output Formats and Split Reports

Use -outformat to select the formats you need. The all option generates all four supported report types:

.\snafflerparser.ps1 -in my_snaffler_output.txt -outformat all

To create a specific format, replace all with txt, csv, html, or json. For example, generate an interactive HTML report with:

.\snafflerparser.ps1 -in my_snaffler_output.txt -outformat html

To separate the generated reports by severity, add the -split switch. For interactive PowerShell results, add -gridview:

.\snafflerparser.ps1 -in my_snaffler_output.txt -split -gridview

HTML is useful for browsing findings, CSV works well for spreadsheets, JSON supports downstream processing, and TXT provides a straightforward text report. Choose formats according to your assessment and reporting workflow.

Sort Findings for Faster Investigation

The parser sorts findings by severity first. Use -sort to choose the secondary sorting field:

• -sort modified sorts by file modification date and is the default.
• -sort keyword sorts by the Snaffler finding keyword.
• -sort unc sorts by the file’s UNC path.
• -sort rule sorts by the Snaffler rule name.

For example, sort results by their UNC paths to group findings by network location:

.\snafflerparser.ps1 -in my_snaffler_output.txt -sort unc -outformat html

Explorer++ Integration and Share Review

Explorer++ is an alternative file manager for Windows. The parser can export discovered shares as Explorer++ bookmarks, making it easier to revisit locations during an authorized assessment. Explorer++ can also be launched in another user’s context with the /netonly switch, which can be useful in specific penetration-testing environments.

Review the generated share list to understand which network shares Snaffler could access. Access does not automatically mean that every file in a share is readable, so validate permissions and findings before documenting exposure.

For related approaches to finding exposed secrets in repositories and files, see our guides to Gitleaks and TruffleHog. These tools complement network file discovery by helping identify sensitive information in other contexts.

Project repository: Snaffler Output File Parser on GitHub. Check the repository for the latest script, supported options, and usage details.