Nmap NSE 6.01: smb-os-discovery

Attempts to determine the operating system, computer name, domain, workgroup, and current time over the SMB protocol ports 445 or 139. This is done by starting a session with the anonymous account or with a proper user account, if one is given; it likely doesn't make a difference; in response to ...

Nmap NSE 6.01: citrix-enum-apps

Extracts a list of published applications from the ICA Browser service. OpenVAS Vulnerability Test $Id: gbnmap6citrixenumapps.nasl 7148 2017-09-15 13:01:14Z cfischer $ Autogenerated NSE wrapper Authors: NSE-Script: Patrik Karlsson NASL-Wrapper: autogenerated Copyright: NSE-Script: The Nmap Securi...

Nmap NSE 6.01: p2p-conficker

Checks if a host is infected with Conficker.C or higher, based on Conficker's peer to peer communication. When Conficker.C or higher infects a system, it opens four ports: two TCP and two UDP. The ports are random, but are seeded with the current week and the IP of the infected host. By determini...

Nmap NSE 6.01: smb-enum-users

Attempts to enumerate the users on a remote Windows system, with as much information as possible, through two different techniques both over MSRPC, which uses port 445 or 139; see 'smb.lua'. The goal of this script is to discover all user accounts that exist on a remote system. This can be helpfu...

Nmap NSE 6.01: ms-sql-info

Attempts to determine configuration and version information for Microsoft SQL Server instances. SQL Server credentials required: No will not benefit from 'mssql.username' & 'mssql.password'. Run criteria: Host script: Will always run. Port script: N/A NOTE: Unlike previous versions, this script...

Nmap NSE 6.01: ftp-bounce

Checks to see if an FTP server allows port scanning using the FTP bounce method. SYNTAX: ftp-bounce.username: Username to log in with. Default ''anonymous''. ftp-bounce.password: Password to log in with. Default ''IEUser@''. OpenVAS Vulnerability Test $Id: gbnmap6ftpbounce.nasl 7006 2017-08-25...

Nmap NSE 6.01: realvnc-auth-bypass

Checks if a VNC server is vulnerable to the RealVNC authentication bypass CVE-2006-2369. OpenVAS Vulnerability Test $Id: gbnmap6realvncauthbypass.nasl 7148 2017-09-15 13:01:14Z cfischer $ Autogenerated NSE wrapper Authors: NSE-Script: Brandon Enright NASL-Wrapper: autogenerated Copyright:...

Nmap NSE 6.01: dns-random-txid

Checks a DNS server for the predictable-TXID DNS recursion vulnerability. Predictable TXID values can make a DNS server vulnerable to cache poisoning attacks see CVE-2008-1447. The script works by querying txidtest.dns-oarc.net see https://www.dns- oarc.net/oarc/services/txidtest. Be aware that a...

Nmap NSE 6.01: mysql-info

Connects to a MySQL server and prints information such as the protocol and version numbers, thread ID, status, capabilities, and the password salt. If service detection is performed and the server appears to be blocking our host or is blocked because of too many connections, then this script isn'...

Nmap NSE 6.01: snmp-sysdescr

Attempts to extract system information from an SNMP version 1 service. SYNTAX: snmpcommunity: The community string to use. If not given, it is ''public'', or whatever is passed to 'buildPacket'. OpenVAS Vulnerability Test $Id: gbnmap6snmpsysdescr.nasl 7000 2017-08-24 11:51:46Z teissa $...

Nmap NSE 6.01: finger

Attempts to retrieve a list of usernames using the finger service. OpenVAS Vulnerability Test $Id: gbnmap6finger.nasl 7148 2017-09-15 13:01:14Z cfischer $ Autogenerated NSE wrapper Authors: NSE-Script: Eddie Bell NASL-Wrapper: autogenerated Copyright: NSE-Script: The Nmap Security Scanner...

Nmap NSE 6.01: sniffer-detect

Checks if a target on a local Ethernet has its network card in promiscuous mode. The techniques used are described at http://www.securityfriday.com/promiscuousdetection01.pdf. OpenVAS Vulnerability Test $Id: gbnmap6snifferdetect.nasl 7148 2017-09-15 13:01:14Z cfischer $ Autogenerated NSE wrapper...

Nmap NSE 6.01: smb-server-stats

Attempts to grab the server's statistics over SMB and MSRPC, which uses TCP ports 445 or 139. An administrator account is required to pull these statistics on most versions of Windows, and Vista and above require UAC to be turned down. Some of the numbers returned here don't feel right to me, but...

Nmap NSE 6.01: irc-info

This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Nmap NSE 6.01: smb-check-vulns

Checks for vulnerabilities: MS08-067, a Windows RPC vulnerability Conficker, an infection by the Conficker worm Unnamed regsvc DoS, a denial-of-service vulnerability I accidentally found in Windows 2000 SMBv2 exploit CVE-2009-3103, Microsoft Security Advisory 975497 MS06-025, a Windows Ras RPC...

Nmap NSE 6.01: dns-random-srcport

Checks a DNS server for the predictable-port recursion vulnerability. Predictable source ports can make a DNS server vulnerable to cache poisoning attacks see CVE-2008-1447. The script works by querying porttest.dns-oarc.net see https://www.dns- oarc.net/oarc/services/porttest. Be aware that any...

Nmap NSE 6.01: smbv2-enabled

Checks whether or not a server is running the SMBv2 protocol. SYNTAX: smbbasic: Forces the authentication to use basic security, as opposed to 'extended security'. Against most modern systems, extended security should work, but there may be cases where you want to force basic. There's a chance th...

Nmap NSE 6.01: socks-open-proxy

Checks if an open socks proxy is running on the target. The script attempts to connect to a proxy server and send socks4 and socks5 payloads. It is considered an open proxy if the script receives a Request Granted response from the target port. The payloads try to open a connection to...

Nmap NSE 6.01: oracle-sid-brute

Guesses Oracle instance/SID names against the TNS-listener. If the 'oraclesids' script argument is not used to specify an alternate file, the default 'oracle-sids' file will be used. License to use the 'oracle-sids' file was granted by its author, Alexander Kornbrust...

Nmap NSE 6.01: ntp-info

Gets the time and configuration variables from an NTP server. We send two requests: a time request and a 'read variables' opcode 2 control message. Without verbosity, the script shows the time and the value of the 'version', 'processor', 'system', 'refid', and 'stratum' variables. With verbosity,...