mtrace NSE Script

Queries for the multicast path from a source to a destination host. This works by sending an IGMP Traceroute Query and listening for IGMP Traceroute responses. The Traceroute Query is sent to the first hop and contains information about source, destination and multicast group addresses. First hop...

jdwp-info NSE Script

Attempts to exploit java's remote debugging port. When remote debugging port is left open, it is possible to inject java bytecode and achieve remote code execution. This script injects and execute a Java class file that returns remote system information. Example Usage nmap -sT -p...

broadcast-bjnp-discover NSE Script

Attempts to discover Canon devices Printers/Scanners supporting the BJNP protocol by sending BJNP Discover requests to the network broadcast address for both ports associated with the protocol. The script then attempts to retrieve the model, version and some additional information for all...

bjnp-discover NSE Script

Retrieves printer or scanner information from a remote device supporting the BJNP protocol. The protocol is known to be supported by network based Canon devices. Example Usage sudo nmap -sU -p 8611,8612 --script bjnp-discover Script Output PORT STATE SERVICE 8611/udp open canon-bjnp1 |...

ssl-date NSE Script

Retrieves a target host's time and date from its TLS ServerHello response. In many TLS implementations, the first four bytes of server randomness are a Unix timestamp. The script will test whether this is indeed true and report the time only if it passes this test. Original idea by Jacob Appelbau...

smb-vuln-ms10-061 NSE Script

Tests whether target machines are vulnerable to ms10-061 Printer Spooler impersonation vulnerability. This vulnerability was used in Stuxnet worm. The script checks for the vuln in a safe way without a possibility of crashing the remote system as this is not a memory corruption vulnerability. In...

http-exif-spider NSE Script

Spiders a site's images looking for interesting exif data embedded in .jpg files. Displays the make and model of the camera, the date the photo was taken, and the embedded geotag information. Script Arguments http-exif-spider.url the url to start spidering. This is a URL relative to the scanned...

smb-vuln-ms10-054 NSE Script

Tests whether target machines are vulnerable to the ms10-054 SMB remote memory corruption vulnerability. The vulnerable machine will crash with BSOD. The script requires at least READ access right to a share on a remote machine. Either with guest credentials or with specified username/password...

flume-master-info NSE Script

Retrieves information from Flume master HTTP pages. Information gathered: Flume version Flume server id Zookeeper/Hbase master servers present in configured flows Java information OS information various other local configurations. If this script is run wth -v, it will output lots more info. Use t...

http-git NSE Script

Checks for a Git repository found in a website's document root /.git/something and retrieves as much repo information as possible, including language/framework, remotes, last commit message, and repository description. Script Arguments http-git.root URL path to search for a .git directory. Defaul...

Setuid Nmap Exploit

Nmap's man page mentions that "Nmap should never be installed with special privileges e.g. suid root for security reasons.." and specifically avoids making any of its binaries setuid during installation. Nevertheless, administrators sometimes feel the need to do insecure things. This module abuse...

Setuid Nmap Exploit

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/post/common' require...

ms-sql-dac NSE Script

Queries the Microsoft SQL Browser service for the DAC Dedicated Admin Connection port of a given or all SQL Server instance. The DAC port is used to connect to the database instance when normal connection attempts fail, for example, when server is hanging, out of memory or in other bad states. In...

sip-methods NSE Script

Enumerates a SIP Server's allowed methods INVITE, OPTIONS, SUBSCRIBE, etc. The script works by sending an OPTION request to the server and checking for the value of the Allow header in the response. Script Arguments sip.timeout See the documentation for the sip library. Example Usage nmap...

Python Untrusted Search Path/Code Execution Vulnerability

Exploit for linux platform in category local exploits Exploit Title: Python untrusted search path/code execution vulnerability Date: 7.6.12 Exploit Author: rogueclown Vendor Homepage: http://www.python.org Software Link: http://www.python.org/getit/releases/ Version: python 2.7.2 and python 3.2.1...

Python - Untrusted Search Path/Code Execution

Exploit Title: Python untrusted search path/code execution vulnerability Date: 7.6.12 Exploit Author: rogueclown Vendor Homepage: http://www.python.org Software Link: http://www.python.org/getit/releases/ Version: python 2.7.2 and python 3.2.1 Tested on: linux my test machine was OpenSUSE 12.1 Th...

metasploit-info NSE Script

Gathers info from the Metasploit rpc service. It requires a valid login pair. After authentication it tries to determine Metasploit version and deduce the OS type. Then it creates a new console and executes few commands to get additional info. References: Metasploit RPC API Guide See also:...

tls-nextprotoneg NSE Script

Enumerates a TLS server's supported protocols by using the next protocol negotiation extension. This works by adding the next protocol negotiation extension in the client hello packet and parsing the returned server hello's NPN extension data. For more information, see: Script Arguments...

Python-wrapper Untrusted Search Path / Code Execution

python-wrapper untrusted search path/code execution vulnerability Python-wrapper executes any test.py script within the current working directory, when supplied with help'modules'. A non-priviledged user may gain code execution by tricking root to help'modules' or help and then modules from withi...

python-wrapper - Untrusted Search Path/Code Execution

python-wrapper untrusted search path/code execution vulnerability Python-wrapper executes any test.py script within the current working directory, when supplied with help'modules'. A non-priviledged user may gain code execution by tricking root to help'modules' or help and then modules from withi...