Reading Time: 2 Minutes

SauronEye

SauronEye by Vivami is a powerful recon search tool designed for red teams. It allows users to search for specific keywords, such as passwords and secrets, across multiple network drives and within the contents of files, including Microsoft Office files (such as .doc, .docx, .xls, and .xlsx) and even VBA macros in old 2003 .xls and .doc files. The tool leverages multi-threading for improved performance, supports regular expressions in search keywords, and is compatible with Cobalt Strike’s execute-assembly.

With the capability to search over 50,000 files totaling 1.3 TB on a network drive in under a minute, and a local drive in just 15 seconds, SauronEye is both fast and effective in finding critical information.

Notes

SauronEye does not search %WINDIR% and %APPDATA%. Use the –systemdirs flag to search the contents of Program Files*. SauronEye relies on functionality only available from .NET 4.7.2, and so requires >= .NET 4.7.2 to run.

Clone the repo from here: