Nmap NSE net: ssl-enum-ciphers

This script repeatedly initiates SSL/TLS connections, each time trying a new cipher or compressor while recording whether a host accepts or rejects it. The end result is a list of all the ciphers and compressors that a server accepts. SSLv3/TLSv1 requires more effort to determine which ciphers an...

Nmap NSE net: vnc-brute

Performs brute force password auditing against VNC servers. SYNTAX: brute.firstonly: stop guessing after first password is found default: false brute.unique: make sure that each password is only guessed once default: true brute.retries: the number of times to retry if recoverable failures occurs...

Nmap NSE net: citrix-brute-xml

Attempts to guess valid credentials for the Citrix PN Web Agent XML Service. The XML service authenticates against the local Windows server or the Active Directory. This script makes no attempt of preventing account lockout. If the password list contains more passwords than the lockout-threshold...

Nmap NSE net: broadcast-upnp-info

Attempts to extract system information from the UPnP service by sending a multicast query, then collecting, parsing, and displaying all responses. OpenVAS Vulnerability Test $Id: gbnmapbroadcastupnpinfonet.nasl 5499 2017-03-06 13:06:09Z teissa $ Autogenerated NSE wrapper Authors: NSE-Script: Patr...

Nmap NSE net: couchdb-databases

Gets database tables from a CouchDB database. For more info about the CouchDB HTTP API, see http://wiki.apache.org/couchdb/HTTPdatabaseAPI. SYNTAX: http.pipeline: If set, it represents the number of HTTP requests that'll be pipelined ie, sent in a single request. This can be set low to make...

Nmap NSE net: sql-injection

Spiders an HTTP server looking for URLs containing queries vulnerable to an SQL injection attack. The script spiders an HTTP server looking for URLs containing queries. It then proceeds to combine crafted SQL commands with susceptible URLs in order to obtain errors. The errors are analysed to see...

Nmap NSE net: domcon-cmd

Runs a console command on the Lotus Domino Console using the given authentication credentials see also: domcon-brute SYNTAX: domcon-cmd.pass: The password used to authenticate to the server domcon-cmd.cmd: The command to run on the remote server domcon-cmd.user: The user used to authenticate to t...

Nmap NSE net: vnc-info

Queries a VNC server for its protocol version and supported security types. OpenVAS Vulnerability Test $Id: gbnmapvncinfonet.nasl 5505 2017-03-07 10:00:18Z teissa $ Autogenerated NSE wrapper Authors: NSE-Script: Patrik Karlsson NASL-Wrapper: autogenerated Copyright: NSE-Script: The Nmap Security...

Nmap NSE net: http-trace

Sends an HTTP TRACE request and shows header fields that were modified in the response. OpenVAS Vulnerability Test $Id: gbnmaphttptracenet.nasl 5499 2017-03-06 13:06:09Z teissa $ Autogenerated NSE wrapper Authors: NSE-Script: Kris Katterjohn NASL-Wrapper: autogenerated Copyright: NSE-Script: The...

Nmap NSE net: dns-cache-snoop

Performs DNS cache snooping against a DNS server. There are two modes of operation, controlled by the 'dns-cache-snoop.mode' script argument. In 'nonrecursive' mode the default, queries are sent to the server with the RD recursion desired flag set to 0. The server should respond positively to the...

Nmap NSE net: telnet-brute

Tries to get Telnet login credentials by guessing usernames and passwords. SYNTAX: userdb: The filename of an alternate username database. unpwdb.passlimit: The maximum number of passwords 'passwords' will return default unlimited. passdb: The filename of an alternate password database...

Nmap NSE net: ssh2-enum-algos

Reports the number of algorithms for encryption, compression, etc. that the target SSH2 server offers. If verbosity is set, the offered algorithms are each listed by type. If the 'client to server' and 'server to client' algorithm lists are identical order specifies preference then the list is...

Nmap NSE net: smb-enum-domains

Attempts to enumerate domains on a system, along with their policies. This generally requires credentials, except against Windows 2000. In addition to the actual domain, the 'Builtin' domain is generally displayed. Windows returns this in the list of domains, but its policies don't appear to be...

Nmap NSE net: ntp-info

Gets the time and configuration variables from an NTP server. We send two requests: a time request and a 'read variables' opcode 2 control message. Without verbosity, the script shows the time and the value of the 'version', 'processor', 'system', 'refid', and 'stratum' variables. With verbosity,...

Nmap NSE net: snmp-interfaces

Attempts to enumerate network interfaces through SNMP. This script can also be run during Nmap's pre-scanning phase and can attempt to add the SNMP server's interface addresses to the target list. The script argument 'snmp- interfaces.host' is required to know what host to probe. To specify a por...

Nmap NSE net: smb-server-stats

Attempts to grab the server's statistics over SMB and MSRPC, which uses TCP ports 445 or 139. An administrator account is required to pull these statistics on most versions of Windows, and Vista and above require UAC to be turned down. Some of the numbers returned here don't feel right to me, but...

Nmap NSE net: dns-recursion

Checks if a DNS server allows queries for third-party names. It is expected that recursion will be enabled on your own internal nameservers. OpenVAS Vulnerability Test $Id: gbnmapdnsrecursionnet.nasl 5505 2017-03-07 10:00:18Z teissa $ Autogenerated NSE wrapper Authors: NSE-Script: Felix Groebert...

Nmap NSE net: ftp-anon

Checks if an FTP server allows anonymous logins. If anonymous is allowed, gets a directory listing of the root directory and highlights writeable files. SYNTAX: ftp-anon.maxlist: The maximum number of files to return in the directory listing. By default it is 20, or unlimited if verbosity is...

Nmap NSE net: broadcast-dropbox-listener

Listens for the LAN sync information broadcasts that the Dropbox.com client broadcasts every 20 seconds, then prints all the discovered client IP addresses, port numbers, version numbers, display names, and more. If the 'newtargets' script argument is given, all discovered Dropbox clients will be...

Nmap NSE net: firewalk

Tries to discover firewall rules using an IP TTL expiration technique known as firewalking. The scan requires a firewall or 'gateway' and a metric or 'target'. For each filtered port on the target, send a probe with an IP TTL one greater than the number of hops to the gateway. The TTL can be give...