ssl-heartbleed NSE Script

Detects whether a server is vulnerable to the OpenSSL Heartbleed bug CVE-2014-0160. The code is based on the Python script ssltest.py authored by Katie Stafford [email protected] Script Arguments ssl-heartbleed.protocols default tries all TLS 1.0, TLS 1.1, or TLS 1.2 tls.servername See the...

D-Link Releases Router Firmware Updates for backdoor vulnerability

In October, A Security researcher 'Craig Heffner' discovered a backdoor vulnerability CVE-2013-6027 with certain D-Link routers that allow cyber criminals to alter a router setting without a username or password. Last week, D-Link has released new version of Firmware for various vulnerable router...

Tenda W309R Router 5.07.46 - Configuration Disclosure

Exploit for hardware platform in category web applications --------------------------------------------------- Exploit Title: Tenda W309R Configuration Enumeration without Authentication Author: SANTHO Vendor Homepage: http://www.tenda.cn Product link:...

http-referer-checker NSE Script

Informs about cross-domain include of scripts. Websites that include external javascript scripts are delegating part of their security to third-party entities. Script Arguments slaxml.debug See the documentation for the slaxml library. httpspider.doscraping, httpspider.maxdepth,...

http-coldfusion-subzero NSE Script

Attempts to retrieve version, absolute path of administration panel and the file 'password.properties' from vulnerable installations of ColdFusion 9 and 10. This was based on the exploit 'ColdSub-Zero.pyFusion v2'. See also: http-adobe-coldfusion-apsa1301.nse http-vuln-cve2009-3960.nse...

http-vuln-cve2013-0156 NSE Script

Detects Ruby on Rails servers vulnerable to object injection, remote command executions and denial of service attacks. CVE-2013-0156 All Ruby on Rails versions before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 are vulnerable. This script sends 3 harmless YAML payloa...

murmur-version NSE Script

Detects the Murmur service server for the Mumble voice communication client versions 1.2.X. The Murmur server listens on a TCP control and a UDP voice port with the same port number. This script activates on both a TCP and UDP port version scan. In both cases probe data is sent only to the UDP po...

rpc-grind NSE Script

Fingerprints the target RPC port to extract the target service, RPC number and version. The script works by sending RPC Null call requests with a random high version unsupported number to the target service with iterated over RPC program numbers from the nmap-rpc file and check for replies from t...

smb-vuln-ms10-054 NSE Script

Tests whether target machines are vulnerable to the ms10-054 SMB remote memory corruption vulnerability. The vulnerable machine will crash with BSOD. The script requires at least READ access right to a share on a remote machine. Either with guest credentials or with specified username/password...

flume-master-info NSE Script

Retrieves information from Flume master HTTP pages. Information gathered: Flume version Flume server id Zookeeper/Hbase master servers present in configured flows Java information OS information various other local configurations. If this script is run wth -v, it will output lots more info. Use t...

http-icloud-findmyiphone NSE Script

Retrieves the locations of all "Find my iPhone" enabled iOS devices by querying the MobileMe web service authentication required. Script Arguments http-icloud-findmyiphone.username the Apple Id username http-icloud-findmyiphone.password the Apple Id password slaxml.debug See the documentation for...

http-icloud-sendmsg NSE Script

Sends a message to a iOS device through the Apple MobileMe web service. The device has to be registered with an Apple ID using the Find My Iphone application. Script Arguments http-icloud-sendmsg.username the Apple ID username http-icloud-sendmsg.sound boolean specifying if a loud sound should be...

NMAP Script to Check Presence of ms12-020 RDP vulnerability

NMAP Script to Check Presence of ms12-020 RDP vulnerability Yesterday Sam Bowne was working on a NMAP script, which will be able to Check Presence of ms12-020 RDP vulnerability on a machine via scan only. But unfortunately, it was less in success rate, Later @eafoundation joins Sam Bowne to devel...

targets-asn NSE Script

Produces a list of IP prefixes for a given routing AS number ASN. This script uses a whois server database operated by the Shadowserver Foundation. We thank them for granting us permission to use this in Nmap. Output is in CIDR notation. Script Arguments targets-asn.whoisport The whois port to us...

broadcast-versant-locate NSE Script

Discovers Versant object databases using the broadcast srvloc protocol. Example Usage nmap --script broadcast-versant-locate Script Output Pre-scan script results: | broadcast-versant-locate: | vod://192.168.200.222:5019 Requires srvloc table local srvloc = require "srvloc" local table = require...

rpcap-brute NSE Script

Performs brute force password auditing against the WinPcap Remote Capture Daemon rpcap. Script Arguments passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library. creds.service, creds.global See the documentation for the creds library...

socks-auth-info NSE Script

Determines the supported authentication mechanisms of a remote SOCKS proxy server. Starting with SOCKS version 5 socks servers may support authentication. The script checks for the following authentication types: 0 - No authentication 1 - GSSAPI 2 - Username and password Example Usage nmap -p 108...

socks-brute NSE Script

Performs brute force password auditing against SOCKS 5 proxy servers. Script Arguments passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library. creds.service, creds.global See the documentation for the creds library. brute.credfile,...

broadcast-pc-anywhere NSE Script

Sends a special broadcast probe to discover PC-Anywhere hosts running on a LAN. Script Arguments broadcast-pc-anywhere.timeout specifies the amount of seconds to sniff the network interface. default varies according to timing. -T3 = 5s Example Usage nmap --script broadcast-pc-anywhere Script Outp...

http-unsafe-output-escaping NSE Script

Spiders a website and attempts to identify output escaping problems where content is reflected back to the user. This script locates all parameters, ?x=foo&y=bar and checks if the values are reflected on the page. If they are indeed reflected, the script will try to insert ghzhzx"zxc'xcv and chec...