Sulla — a tool for scanning SMB resources

Sulla is a CLI utility from Praetorian, built on top of the Go library Titus and designed for automated discovery of sensitive data stored on shared SMB resources.

What it looks for: 🔍 cloud provider credentials (AWS, GCP, Azure) 🔍 version control and CI/CD tokens (GitHub, GitLab, Jenkins) 🔍 database connection strings (PostgreSQL, MySQL, MongoDB) 🔍 SaaS API keys (Stripe, Twilio, SendGrid, Slack, Datadog) 🔍 cryptographic material (RSA/DSA/EC private keys and PGP private keys) 🔍 infrastructure secrets (SSH keys, SNMP community strings, WPA PSK values)

How it works: 1️⃣ detects domain controllers via DNS SRV queries 2️⃣ enumerates SMB shares on active machines 3️⃣ filters candidate files 4️⃣ scans files in memory against Titus detection rules

Alternatives: ⚔️Snaffler requires .NET ⚔️CrackMapExec / NetExec use less advanced secret‑search algorithms

🔗 Article: https://www.praetorian.com/blog/sharing-is-caring-smb-secret-scanning-with-sulla 📎 Tool: https://www.github.com/praetorian-inc/Sulla