ip-forwarding NSE Script

Detects whether the remote device has ip forwarding or "Internet connection sharing" enabled, by sending an ICMP echo request to a given target using the scanned host as default gateway. The given target can be a routed or a LAN host and needs to be able to respond to ICMP requests ping in order...

http-gitweb-projects-enum NSE Script

Retrieves a list of Git projects, owners and descriptions from a gitweb web interface to the Git revision control system. Script Arguments http-gitweb-projects-enum.path specifies the location of gitweb default: / slaxml.debug See the documentation for the slaxml library. http.host,...

traceroute-geolocation NSE Script

Lists the geographic locations of each hop in a traceroute and optionally saves the results to a KML file, plottable on Google earth and maps. Script Arguments traceroute-geolocation.kmlfile full path and name of file to write KML data to. The KML file can be used in Google earth or maps to plot...

cups-info NSE Script

Lists printers managed by the CUPS printing service. Script Arguments slaxml.debug See the documentation for the slaxml library. http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent See the documentation for the http library...

http-icloud-findmyiphone NSE Script

Retrieves the locations of all "Find my iPhone" enabled iOS devices by querying the MobileMe web service authentication required. Script Arguments http-icloud-findmyiphone.username the Apple Id username http-icloud-findmyiphone.password the Apple Id password slaxml.debug See the documentation for...

http-icloud-sendmsg NSE Script

Sends a message to a iOS device through the Apple MobileMe web service. The device has to be registered with an Apple ID using the Find My Iphone application. Script Arguments http-icloud-sendmsg.username the Apple ID username http-icloud-sendmsg.sound boolean specifying if a loud sound should be...

gpsd-info NSE Script

Retrieves GPS time, coordinates and speed from the GPSD network daemon. Script Arguments gpsd-info.timeout timespec defining how long to wait for data default 10s Example Usage nmap -p 2947 --script gpsd-info Script Output PORT STATE SERVICE REASON 2947/tcp open gpsd-ng syn-ack | gpsd-info: | Tim...

http-robtex-shared-ns NSE Script

Finds up to 100 domain names which use the same name server as the target by querying the Robtex service at . The target must be specified by DNS name, not IP address. TEMPORARILY DISABLED due to changes in Robtex's API. See Script Arguments slaxml.debug See the documentation for the slaxml...

NMAP Script to Check Presence of ms12-020 RDP vulnerability

NMAP Script to Check Presence of ms12-020 RDP vulnerability Yesterday Sam Bowne was working on a NMAP script, which will be able to Check Presence of ms12-020 RDP vulnerability on a machine via scan only. But unfortunately, it was less in success rate, Later @eafoundation joins Sam Bowne to devel...

rdp-vuln-ms12-020 NSE Script

Checks if a machine is vulnerable to MS12-020 RDP vulnerability. The Microsoft bulletin MS12-020 patches two vulnerabilities: CVE-2012-0152 which addresses a denial of service vulnerability inside Terminal Server, and CVE-2012-0002 which fixes a vulnerability in Remote Desktop Protocol. Both are...

Distributed nmap Framework: dnmap

dnmap is a framework to distribute nmap scans among several clients. It reads an already created file with nmap commands and send those commands to each client connected to it. The framework use a client/server architecture. The server knows what to do and the clients do it. All the logic and...

targets-asn NSE Script

Produces a list of IP prefixes for a given routing AS number ASN. This script uses a whois server database operated by the Shadowserver Foundation. We thank them for granting us permission to use this in Nmap. Output is in CIDR notation. Script Arguments targets-asn.whoisport The whois port to us...

FreePBX 2.10.0 / Elastic 2.2.0 Remote Code Execution

!/usr/bin/python Exploit Title: FreePBX / Elastix pre-authenticated remote code execution exploit Google Dork: oy vey Date: March 23rd, 2010 Author: muts Version: FreePBX 2.10.0/ 2.9.0, Elastix 2.2.0, possibly others. Tested on: multiple CVE : notyet Blog post :...

FreePBX 2.10.0 / Elastix 2.2.0 - Remote Code Execution

!/usr/bin/python Exploit Title: FreePBX / Elastix pre-authenticated remote code execution exploit Google Dork: oy vey Date: March 23rd, 2012 Author: muts, SSL update by Emporeo Version: FreePBX 2.10.0/ 2.9.0, Elastix 2.2.0, possibly others. Tested on: multiple CVE : notyet Blog post :...

FreePBX 2.10.0 Elastix 2.2.0 - Remote Code Execution

FreePBX 2.10.0 Elastix 2.2.0 - Remote Code Execution !/usr/bin/python Exploit Title: FreePBX / Elastix pre-authenticated remote code execution exploit Google Dork: oy vey Date: March 23rd, 2012 Author: muts Version: FreePBX 2.10.0/ 2.9.0, Elastix 2.2.0, possibly others. Tested on: multiple CVE :...

http-drupal-enum-users NSE Script

Enumerates Drupal users by exploiting an information disclosure vulnerability in Views, Drupal's most popular module. Requests to admin/views/ajax/autocomplete/user/STRING return all usernames that begin with STRING. The script works by iterating STRING over letters to extract all usernames. For...

broadcast-ataoe-discover NSE Script

Discovers servers supporting the ATA over Ethernet protocol. ATA over Ethernet is an ethernet protocol developed by the Brantley Coile Company and allows for simple, high-performance access to SATA drives over Ethernet. Discovery is performed by sending a Query Config Request to the Ethernet...

stun-version NSE Script

Sends a binding request to the server and attempts to extract version information from the response, if the server attribute is present. Script Arguments stun.mode See the documentation for the stun library. Example Usage nmap -sU -sV -p 3478 Script Output PORT STATE SERVICE VERSION 3478/udp open...

stun-info NSE Script

Retrieves the external IP address of a NAT:ed host using the STUN protocol. Script Arguments stun.mode See the documentation for the stun library. Example Usage nmap -sV -PN -sU -p 3478 --script stun-info Script Output PORT STATE SERVICE 3478/udp open|filtered stun | stun-info: | External IP:...

duplicates NSE Script

Attempts to discover multihomed systems by analysing and comparing information collected by other scripts. The information analyzed currently includes, SSL certificates, SSH host keys, MAC addresses, and Netbios server names. In order for the script to be able to analyze the data it has...