Fix anonymous share enumeration + JSON Lines output (shares, files, content matches) + Py3.14 console fix

[ocervell]

Summary

A set of related fixes and features discovered while running manspider against a Samba host where smbclient -L //host -N listed shares fine but manspider returned nothing.

1. fix(smb): use anonymous null session before Guest for share enumeration

When no credentials are supplied, login() switched to the Guest account and only fell back to a true null session if Guest failed. On Samba with map to guest = Bad User, the Guest login succeeds, but the SRVSVC NetrShareEnumAll RPC (listShares) is denied with STATUS_ACCESS_DENIED — so share enumeration silently returned nothing even though smbclient -L -N works. Now a true anonymous null session is attempted first, matching smbclient -N.

Verified directly with impacket against the same host:

NULL session ("")  : OK   -> ['myshare', 'IPC$']
Guest ("Guest","") : FAIL -> STATUS_ACCESS_DENIED

2. fix(logging): force the fork multiprocessing start method

Python 3.14 changed the default start method on Linux to forkserver, which re-imports modules in the worker process and creates a new, unlistened log queue — so no console output appeared at all (only the file log). Forcing fork restores the shared queue between the parent's QueueListener and the worker's QueueHandler. Guarded with try/except so it's a no-op on older Pythons and degrades safely where fork is unavailable.

3. feat(cli): list shares when no filter is given

When none of --filenames/--content/--extensions/--exclude-extensions are specified, manspider now enumerates and prints the shares for each remote target (like smbclient -L) instead of erroring out.

4. feat: always report enumerated shares while spidering

Previously the share list was only shown in no-filter mode. The enumerated shares are now reported once per target at INFO level (and emitted to JSON) regardless of whether filters are active.

5. feat(output): --json [FILE] JSON Lines output

Adds machine-readable output. --json FILE appends JSON Lines to a file; --json with no argument writes JSONL to stdout and redirects human-readable logs to stderr (so stdout stays clean for piping).

Three record types, each carrying a consistent target + port:

{"type": "share", "target": "localhost", "port": 445, "share": "myshare"}
{"type": "file", "target": "localhost", "port": 445, "share": "myshare", "path": "sample.cfg", "size": 10, "downloaded": false}
{"type": "content_match", "target": "localhost", "port": 445, "share": "myshare", "path": "creds.cfg", "pattern": "password=\\S+", "count": 1, "matches": [{"match": "password=Sup3rS3cret!", "line": 2, "column": 1, "end_column": 22}]}

content_match records include a matches array with the actual matched substrings and where they were found — each entry is {"match": ..., "line": N, "column": N, "end_column": N} (1-based). Samples are deduped and capped at 20 distinct matches per pattern per file (each truncated to 256 chars). The substrings and locations are recovered from the regex span against the already-extracted text, so no extra scanning is performed.

Testing

All behaviours verified end-to-end against a local Samba container (myshare, anonymous read-write): null-session enumeration, console output on Python 3.14.4, no-filter share listing, share reporting while spidering, and --json in both stdout and file modes including captured match strings with line/column locations.

🤖 Generated with Claude Code

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[ocervell]

I have read the CLA Document and I hereby sign the CLA

[ocervell]

recheck

[ocervell]

Here is an example of the manspider output with --json flag (JSON lines output) after this PR:

manspider localhost --loot-dir . -v --json --extensions cfg --content password               
[+] MANSPIDER command executed: /home/jahmyst/.local/bin/manspider localhost --loot-dir . -v --json --extensions cfg --content password
[+] Skipping files larger than 10.00MB
[+] Using 5 threads
[+] Searching by file extension: ".cfg"
[+] Searching by file content: "password"
[+] Matching files will be downloaded to .
[*] localhost: Trying null session
[*] localhost (localhost): Authenticating as ""
[+] localhost: Successful login as ""
[*] localhost: Response length: 2
[*] localhost: Share 0: name='myshare', type=0, comment=''
[*] localhost: Share 1: name='IPC$', type=2147483651, comment='IPC Service (Samba Server Version 4.6.3)'
[+] localhost: 2 shares: myshare, IPC$
{"type": "share", "target": "localhost", "port": 445, "share": "myshare"}
{"type": "share", "target": "localhost", "port": 445, "share": "IPC$"}
[*] localhost: myshare: contains 3 items
[*] localhost: Skipping file mstest.txt, does not match extension filters
[*] localhost: Skipping myshare\mstest.txt: filename/extensions do not match
[*] localhost: sample.cfg matches extension filters
[*] localhost: Trying null session
[*] localhost (localhost): Authenticating as ""
[+] localhost: Successful login as ""
[*] localhost: Downloading myshare\sample.cfg
[*] localhost: creds.cfg matches extension filters
[*] localhost: Downloading myshare\creds.cfg
[*] Parsing file: localhost\myshare\sample.cfg
[*] Extracted text from localhost\myshare\sample.cfg using charset-normalizer
[*] localhost: Skipping blacklisted share: IPC$
[+] Finished spidering localhost
[*] Parsing file: localhost\myshare\creds.cfg
[*] Extracted text from localhost\myshare\creds.cfg using charset-normalizer
[+] localhost\myshare\creds.cfg: matched "password" 1 times
[+] password=Sup3rS3cret!
{"type": "content_match", "target": "localhost", "port": 445, "share": "myshare", "path": "creds.cfg", "pattern": "password", "count": 1, "matches": [{"match": "password", "line": 2, "column": 1, "end_column": 9}]}

JSON lines are emitted to stdout (so we can parse them with jq pipe them to other tools like notify) and the rest to sderr only when the --json flag is set.