broadcast-pim-discovery NSE Script

Discovers routers that are running PIM Protocol Independent Multicast. This works by sending a PIM Hello message to the PIM multicast address 224.0.0.13 and listening for Hello messages from other routers. Script Arguments broadcast-pim-discovery.timeout Time to wait for responses in seconds...

broadcast-bjnp-discover NSE Script

Attempts to discover Canon devices Printers/Scanners supporting the BJNP protocol by sending BJNP Discover requests to the network broadcast address for both ports associated with the protocol. The script then attempts to retrieve the model, version and some additional information for all...

http-traceroute NSE Script

Exploits the Max-Forwards HTTP header to detect the presence of reverse proxies. The script works by sending HTTP requests with values of the Max-Forwards HTTP header varying from 0 to 2 and checking for any anomalies in certain response values such as the status code, Server, Content-Type and...

mmouse-exec NSE Script

Connects to an RPA Tech Mobile Mouse server, starts an application and sends a sequence of keys to it. Any application that the user has access to can be started and the key sequence is sent to the application after it has been started. The Mobile Mouse server runs on OS X, Windows and Linux and...

gpsd-info NSE Script

Retrieves GPS time, coordinates and speed from the GPSD network daemon. Script Arguments gpsd-info.timeout timespec defining how long to wait for data default 10s Example Usage nmap -p 2947 --script gpsd-info Script Output PORT STATE SERVICE REASON 2947/tcp open gpsd-ng syn-ack | gpsd-info: | Tim...

rdp-vuln-ms12-020 NSE Script

Checks if a machine is vulnerable to MS12-020 RDP vulnerability. The Microsoft bulletin MS12-020 patches two vulnerabilities: CVE-2012-0152 which addresses a denial of service vulnerability inside Terminal Server, and CVE-2012-0002 which fixes a vulnerability in Remote Desktop Protocol. Both are...

stun-version NSE Script

Sends a binding request to the server and attempts to extract version information from the response, if the server attribute is present. Script Arguments stun.mode See the documentation for the stun library. Example Usage nmap -sU -sV -p 3478 Script Output PORT STATE SERVICE VERSION 3478/udp open...

versant-info NSE Script

Extracts information, including file paths, version and database names from a Versant object database. Example Usage nmap -p 5019 --script versant-info Script Output PORT STATE SERVICE REASON 5019/tcp open versant syn-ack | versant-info: | Hostname: WIN-S6HA7RJFAAR | Root path: C:\Versant\8 |...

cccam-version NSE Script

Detects the CCcam service software for sharing subscription TV among multiple receivers. The service normally runs on port 12000. It distinguishes itself by printing 16 random-looking bytes upon receiving a connection. Because the script attempts to detect "random-looking" bytes, it has a small...

maxdb-info NSE Script

Retrieves version and database information from a SAP Max DB database. Example Usage nmap -p 7210 --script maxdb-info Script Output PORT STATE SERVICE REASON 7210/tcp open maxdb syn-ack | maxdb-info: | Version: 7.8.02 | Build: DBMServer 7.8.02 Build 021-121-242-175 | OS: UNIX | Instroot:...

hadoop-namenode-info NSE Script

Retrieves information from an Apache Hadoop NameNode HTTP status page. Information gathered: Date/time the service was started Hadoop version Hadoop compile date Upgrades status Filesystem directory relative to Log directory relative to Associated DataNodes. Script Arguments slaxml.debug See the...

hbase-master-info NSE Script

Retrieves information from an Apache HBase Hadoop database master HTTP status page. Information gathered: Hbase version Hbase compile date Hbase root directory Hadoop version Hadoop compile date Average load Zookeeper quorum server Associated region servers Script Arguments slaxml.debug See the...

hadoop-datanode-info NSE Script

Discovers information such as log directories from an Apache Hadoop DataNode HTTP status page. Information gathered: Log directory relative to Script Arguments slaxml.debug See the documentation for the slaxml library. http.host, http.max-body-size, http.max-cache-size, http.max-pipeline,...

ipv6-node-info NSE Script

Obtains hostnames, IPv4 and IPv6 addresses through IPv6 Node Information Queries. IPv6 Node Information Queries are defined in RFC 4620. There are three useful types of queries: qtype=2: Node Name qtype=3: Node Addresses qtype=4: IPv4 Addresses Some operating systems Mac OS X and OpenBSD return...

rtsp-url-brute NSE Script

Attempts to enumerate RTSP media URLS by testing for common paths on devices such as surveillance IP cameras. The script attempts to discover valid RTSP URLs by sending a DESCRIBE request for each URL in the dictionary. It then parses the response, based on which it determines whether the URL is...

lltd-discovery NSE Script

Uses the Microsoft LLTD protocol to discover hosts on a local network. For more information on the LLTD protocol please refer to Script Arguments lltd-discovery.interface string specifying which interface to do lltd discovery on. If not specified, all ethernet interfaces are tried...

ssl-google-cert-catalog NSE Script

Queries Google's Certificate Catalog for the SSL certificates retrieved from target hosts. The Certificate Catalog provides information about how recently and for how long Google has seen the given certificate. If a certificate doesn't appear in the database, despite being correctly signed by a...

quake3-info NSE Script

Extracts information from a Quake3 game server and other games which use the same protocol. Example Usage nmap -sU -sV -Pn --script quake3-info.nse -p Script Output PORT STATE SERVICE VERSION 27960/udp open quake3 Quake 3 dedicated server | quake3-info: | PLAYERS: | 1. cyberix frags: 0/20, ping: ...

broadcast-dhcp-discover NSE Script

Sends a DHCP request to the broadcast address 255.255.255.255 and reports the results. By default, the script uses a static MAC address DE:AD:CO:DE:CA:FE in order to prevent IP pool exhaustion. The script reads the response using pcap by opening a listening pcap socket on all available ethernet...

cvs-brute-repository NSE Script

Attempts to guess the name of the CVS repositories hosted on the remote server. With knowledge of the correct repository name, usernames and passwords can be guessed. Script Arguments cvs-brute-repository.repofile a file containing a list of repositories to guess cvs-brute-repository.nodefault wh...