Nmap NSE net: wdb-version

Detects vulnerabilities and gathers information such as version numbers and hardware support from VxWorks Wind DeBug agents. Wind DeBug is a SunRPC-type service that is enabled by default on many devices that use the popular VxWorks real-time embedded operating system. H.D. Moore of Metasploit ha...

Nmap NSE net: http-vmware-path-vuln

Checks for a path-traversal vulnerability in VMWare ESX, ESXi, and Server CVE-2009-3733. The vulnerability was originally released by Justin Morehouse and Tony Flick, who presented at Shmoocon 2010 http://fyrmassociates.com/tools.html. SYNTAX: http.pipeline: If set, it represents the number of HT...

Nmap NSE net: ftp-brute

Tries to get FTP login credentials by guessing usernames and passwords. This uses the standard unpwdb username/password list. However, in tests FTP servers are significantly slower than other servers when responding, so the number of usernames/passwords can be artificially limited using script...

Nmap NSE net: dns-fuzz

This script launches a DNS fuzzing attack against any DNS server. The script induces errors into randomly generated but valid DNS packets. The packet template that we use includes one uncompressed and one compressed name. Use the 'dns-fuzz.timelimit' argument to control how long the fuzzing lasts...

Nmap NSE net: http-iis-webdav-vuln

Checks for a vulnerability in IIS 5.1/6.0 that allows arbitrary users to access secured WebDAV folders by searching for a password-protected folder and attempting to access it. This vulnerability was patched in Microsoft Security Bulletin MS09-020, http://nmap.org/r/ms09-020. A list of well known...

Nmap NSE net: http-form-brute

Performs brute force password auditing against http form-based authentication. SYNTAX: brute.unique: make sure that each password is only guessed once default: true http-form-brute.hostname: sets the host header in case of virtual hosting brute.retries: the number of times to retry if recoverable...

Nmap NSE net: drda-info

Attempts to extract information from database servers supporting the DRDA protocol. The script sends a DRDA EXCSAT exchange server attributes command packet and parses the response. OpenVAS Vulnerability Test $Id: gbnmapdrdainfonet.nasl 5505 2017-03-07 10:00:18Z teissa $ Autogenerated NSE wrapper...

Nmap NSE net: ssl-cert

Retrieves a server's SSL certificate. The amount of information printed about the certificate depends on the verbosity level. With no extra verbosity, the script prints the validity period and the commonName, organizationName, stateOrProvinceName, and countryName of the subject. '443/tcp open htt...

Nmap NSE net: dns-recursion

Checks if a DNS server allows queries for third-party names. It is expected that recursion will be enabled on your own internal nameservers. OpenVAS Vulnerability Test $Id: gbnmapdnsrecursionnet.nasl 5505 2017-03-07 10:00:18Z teissa $ Autogenerated NSE wrapper Authors: NSE-Script: Felix Groebert...

Nmap NSE net: dns-random-srcport

Checks a DNS server for the predictable-port recursion vulnerability. Predictable source ports can make a DNS server vulnerable to cache poisoning attacks see CVE-2008-1447. The script works by querying porttest.dns-oarc.net see https://www.dns- oarc.net/oarc/services/porttest. Be aware that any...

Nmap NSE net: sslv2

Determines whether the server supports obsolete and less secure SSLv2, and discovers which ciphers it supports. OpenVAS Vulnerability Test $Id: gbnmapsslv2net.nasl 5499 2017-03-06 13:06:09Z teissa $ Autogenerated NSE wrapper Authors: NSE-Script: Matthew Boyle NASL-Wrapper: autogenerated Copyright...

Nmap NSE net: netbus-info

Opens a connection to a NetBus server and extracts information about the host and the NetBus service itself. The extracted host information includes a list of running applications, and the hosts sound volume settings. The extracted service information includes it's access control list acl, server...

Nmap NSE net: informix-query

Runs a query against IBM Informix Dynamic Server using the given authentication credentials see also: informix-brute. SYNTAX: informix.instance: specifies the Informix instance to connect to informix-query.database: The name of the database to connect to default: sysmaster informix-query.username...

Nmap NSE net: hostmap

Tries to find hostnames that resolve to the target's IP address by querying the online database at http://www.bfk.de/bfkdnslogger.html. The script is in the 'external' category because it sends target IPs to a third party in order to query their database. SYNTAX: hostmap.prefix: If set, saves the...

Nmap NSE net: dns-cache-snoop

Performs DNS cache snooping against a DNS server. There are two modes of operation, controlled by the 'dns-cache-snoop.mode' script argument. In 'nonrecursive' mode the default, queries are sent to the server with the RD recursion desired flag set to 0. The server should respond positively to the...

Nmap NSE net: smb-enum-users

Attempts to enumerate the users on a remote Windows system, with as much information as possible, through two different techniques both over MSRPC, which uses port 445 or 139; see 'smb.lua'. The goal of this script is to discover all user accounts that exist on a remote system. This can be helpfu...

Nmap NSE net: snmp-interfaces

Attempts to enumerate network interfaces through SNMP. This script can also be run during Nmap's pre-scanning phase and can attempt to add the SNMP server's interface addresses to the target list. The script argument 'snmp- interfaces.host' is required to know what host to probe. To specify a por...

Nmap NSE net: pjl-ready-message

Retrieves or sets the ready message on printers that support the Printer Job Language. This includes most PostScript printers that listen on port 9100. Without an argument, displays the current ready message. With the 'pjlreadymessage' script argument, displays the old ready message and changes i...

Nmap NSE net: nfs-ls

Attempts to get useful information about files from NFS exports. The output is intended to resemble the output of 'ls'. The script starts by enumerating and mounting the remote NFS exports. After that it performs an NFS GETATTR procedure call for each mounted point in order to get its ACLs. For...

Nmap NSE net: http-vhosts

Searches for web virtual hostnames by making a large number of HEAD requests against http servers using common hostnames. Each HEAD request provides a different 'Host' header. The hostnames come from a built-in default list. Shows the names that return a document. Also shows the location of...