rdp-vuln-ms12-020 NSE Script

Checks if a machine is vulnerable to MS12-020 RDP vulnerability. The Microsoft bulletin MS12-020 patches two vulnerabilities: CVE-2012-0152 which addresses a denial of service vulnerability inside Terminal Server, and CVE-2012-0002 which fixes a vulnerability in Remote Desktop Protocol. Both are...

Distributed nmap Framework: dnmap

dnmap is a framework to distribute nmap scans among several clients. It reads an already created file with nmap commands and send those commands to each client connected to it. The framework use a client/server architecture. The server knows what to do and the clients do it. All the logic and...

targets-asn NSE Script

Produces a list of IP prefixes for a given routing AS number ASN. This script uses a whois server database operated by the Shadowserver Foundation. We thank them for granting us permission to use this in Nmap. Output is in CIDR notation. Script Arguments targets-asn.whoisport The whois port to us...

FreePBX 2.10.0 / Elastic 2.2.0 Remote Code Execution

!/usr/bin/python Exploit Title: FreePBX / Elastix pre-authenticated remote code execution exploit Google Dork: oy vey Date: March 23rd, 2010 Author: muts Version: FreePBX 2.10.0/ 2.9.0, Elastix 2.2.0, possibly others. Tested on: multiple CVE : notyet Blog post :...

FreePBX 2.10.0 / Elastix 2.2.0 - Remote Code Execution

!/usr/bin/python Exploit Title: FreePBX / Elastix pre-authenticated remote code execution exploit Google Dork: oy vey Date: March 23rd, 2012 Author: muts, SSL update by Emporeo Version: FreePBX 2.10.0/ 2.9.0, Elastix 2.2.0, possibly others. Tested on: multiple CVE : notyet Blog post :...

FreePBX 2.10.0 Elastix 2.2.0 - Remote Code Execution

FreePBX 2.10.0 Elastix 2.2.0 - Remote Code Execution !/usr/bin/python Exploit Title: FreePBX / Elastix pre-authenticated remote code execution exploit Google Dork: oy vey Date: March 23rd, 2012 Author: muts Version: FreePBX 2.10.0/ 2.9.0, Elastix 2.2.0, possibly others. Tested on: multiple CVE :...

http-drupal-enum-users NSE Script

Enumerates Drupal users by exploiting an information disclosure vulnerability in Views, Drupal's most popular module. Requests to admin/views/ajax/autocomplete/user/STRING return all usernames that begin with STRING. The script works by iterating STRING over letters to extract all usernames. For...

broadcast-ataoe-discover NSE Script

Discovers servers supporting the ATA over Ethernet protocol. ATA over Ethernet is an ethernet protocol developed by the Brantley Coile Company and allows for simple, high-performance access to SATA drives over Ethernet. Discovery is performed by sending a Query Config Request to the Ethernet...

stun-version NSE Script

Sends a binding request to the server and attempts to extract version information from the response, if the server attribute is present. Script Arguments stun.mode See the documentation for the stun library. Example Usage nmap -sU -sV -p 3478 Script Output PORT STATE SERVICE VERSION 3478/udp open...

stun-info NSE Script

Retrieves the external IP address of a NAT:ed host using the STUN protocol. Script Arguments stun.mode See the documentation for the stun library. Example Usage nmap -sV -PN -sU -p 3478 --script stun-info Script Output PORT STATE SERVICE 3478/udp open|filtered stun | stun-info: | External IP:...

duplicates NSE Script

Attempts to discover multihomed systems by analysing and comparing information collected by other scripts. The information analyzed currently includes, SSL certificates, SSH host keys, MAC addresses, and Netbios server names. In order for the script to be able to analyze the data it has...

eap-info NSE Script

Enumerates the authentication methods offered by an EAP Extensible Authentication Protocol authenticator for a given identity or for the anonymous identity if no argument is passed. Script Arguments eap-info.identity Identity to use for the first step of the authentication methods if omitted...

broadcast-versant-locate NSE Script

Discovers Versant object databases using the broadcast srvloc protocol. Example Usage nmap --script broadcast-versant-locate Script Output Pre-scan script results: | broadcast-versant-locate: | vod://192.168.200.222:5019 Requires srvloc table local srvloc = require "srvloc" local table = require...

versant-info NSE Script

Extracts information, including file paths, version and database names from a Versant object database. Example Usage nmap -p 5019 --script versant-info Script Output PORT STATE SERVICE REASON 5019/tcp open versant syn-ack | versant-info: | Hostname: WIN-S6HA7RJFAAR | Root path: C:\Versant\8 |...

rpcap-brute NSE Script

Performs brute force password auditing against the WinPcap Remote Capture Daemon rpcap. Script Arguments passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library. creds.service, creds.global See the documentation for the creds library...

rpcap-info NSE Script

Connects to the rpcap service provides remote sniffing capabilities through WinPcap and retrieves interface information. The service can either be setup to require authentication or not and also supports IP restrictions. See also: rpcap-brute.nse Script Arguments creds.rpcap username:password to...

mongodb-brute NSE Script

Performs brute force password auditing against the MongoDB database. Script Arguments mongodb-brute.db Database against which to check. Default: admin passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library. creds.service, creds.global See...

broadcast-networker-discover NSE Script

Discovers EMC Networker backup software servers on a LAN by sending a network broadcast query. Script Arguments mount.version, nfs.version, rpc.protocol See the documentation for the rpc library. Example Usage nmap --script broadcast-networker-discover Script Output Pre-scan script results: |...

ndmp-fs-info NSE Script

Lists remote file systems by querying the remote device using the Network Data Management Protocol ndmp. NDMP is a protocol intended to transport data between a NAS device and the backup device, removing the need for the data to pass through the backup server. The following products are known to...

dns-client-subnet-scan NSE Script

Performs a domain lookup using the edns-client-subnet option which allows clients to specify the subnet that queries supposedly originate from. The script uses this option to supply a number of geographically distributed locations in an attempt to enumerate as many different address records as...