ShareSift
An ML-augmented successor to Snaffler that ranks files on SMB shares by likelihood of containing credentials, using a LightGBM path classifier and an optional Qwen3 content classifier to confirm flagged files.
ShareSift is a two-stage machine-learning pipeline for hunting credentials and secrets on SMB shares during penetration tests, built as a successor to Snaffler. Stage one runs a LightGBM classifier over every file path, and an optional stage two runs a small fine-tuned Qwen3 1.7B LoRA content classifier on the flagged files to confirm them.
Snaffler's pattern-based rules catch obvious cases like id_rsa, NTDS.dit and .kdbx files but miss custom scripts, secrets in unusual filenames, and oddly named password directories. On a corpus of corporate-share content mixed with synthetic credential files, ShareSift's path classifier improves recall over Snaffler by 29.3 percentage points, and at its Red-tier operator triage policy it catches 3.4 times more credentials than Snaffler with a higher F1 score, at the cost of more false positives; a stricter Black-only setting raises precision for users who only want high-confidence findings.
Built with Python, LightGBM and a Qwen3-based transformer classifier. Apache-2.0 licensed.