mysql-empty-password NSE Script

Checks for MySQL servers with an empty password for root or anonymous. See also: mysql-brute.nse Example Usage nmap -sV --script=mysql-empty-password Script Output 3306/tcp open mysql | mysql-empty-password: | anonymous account has empty password | root account has empty password Requires mysql...

mysql-databases NSE Script

Attempts to list all databases on a MySQL server. Script Arguments mysqluser The username to use for authentication. If unset it attempts to use credentials found by mysql-brute or mysql-empty-password. mysqlpass The password to use for authentication. If unset it attempts to use credentials foun...

mysql-brute NSE Script

Performs password guessing against MySQL. See also: mysql-empty-password.nse Script Arguments mysql-brute.timeout socket timeout for connecting to MySQL default 5s passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library. creds.service,...

daap-get-library NSE Script

Retrieves a list of music from a DAAP server. The list includes artist names and album and song titles. Output will be capped to 100 items if not otherwise specified in the daapitemlimit script argument. A daapitemlimit below zero outputs the complete contents of the DAAP library. Based on...

dns-service-discovery NSE Script

Attempts to discover target hosts' services using the DNS Service Discovery protocol. The script first sends a query for services.dns-sd.udp.local to get a list of services. It then sends a followup query for each one to try to get more information. Script Arguments max-newtargets, newtargets See...

afp-showmount NSE Script

Shows AFP shares and ACLs. Script Arguments afp.password, afp.username See the documentation for the afp library. Example Usage nmap -sV --script=afp-showmount Script Output PORT STATE SERVICE 548/tcp open afp | afp-showmount: | Yoda's Public Folder | Owner: Search,Read,Write | Group: Search,Read...

oracle-sid-brute NSE Script

Guesses Oracle instance/SID names against the TNS-listener. If the oraclesids script argument is not used to specify an alternate file, the default oracle-sids file will be used. License to use the oracle-sids file was granted by its author, Alexander Kornbrust . Script Arguments oraclesids A fil...

citrix-enum-servers-xml NSE Script

Extracts the name of the server farm and member servers from Citrix XML service. Script Arguments slaxml.debug See the documentation for the slaxml library. http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent See the documentatio...

citrix-enum-apps NSE Script

Extracts a list of published applications from the ICA Browser service. Example Usage sudo ./nmap -sU --script=citrix-enum-apps -p 1604 Script Output PORT STATE SERVICE 1604/udp open unknown 1604/udp open unknown | citrix-enum-apps: | Notepad | iexplorer | registry editor Requires nmap shortport...

citrix-brute-xml NSE Script

Attempts to guess valid credentials for the Citrix PN Web Agent XML Service. The XML service authenticates against the local Windows server or the Active Directory. This script makes no attempt of preventing account lockout. If the password list contains more passwords than the lockout-threshold...

citrix-enum-servers NSE Script

Extracts a list of Citrix servers from the ICA Browser service. Example Usage sudo ./nmap -sU --script=citrix-enum-servers -p 1604 Script Output PORT STATE SERVICE 1604/udp open unknown | citrix-enum-servers: | CITRIXSRV01 | CITRIXSRV02 Requires nmap shortport stdnse string table local nmap =...

nfs-showmount NSE Script

Shows NFS exports, like the showmount -e command. Script Arguments mount.version, nfs.version, rpc.protocol See the documentation for the rpc library. Example Usage nmap -sV --script=nfs-showmount Script Output PORT STATE SERVICE 111/tcp open rpcbind | nfs-showmount: | /home/storage/backup...

Novell NetMail <= 3.52d NMAP STOR Buffer Overflow

require 'msf/core' class Metasploit3 'Novell NetMail %q This module exploits a stack overflow in Novell's Netmail 3.52 NMAP STOR verb. By sending an overly long string, an attacker can overwrite the buffer and control program execution. , 'Author' = 'MC' , 'License' = MSFLICENSE, 'Version' =...

smb-psexec NSE Script

Implements remote process execution similar to the Sysinternals' psexec tool, allowing a user to run a series of programs on a remote machine and read the output. This is great for gathering information about servers, running the same tool on a range of system, or even installing a backdoor on a...

smb-enum-groups NSE Script

Obtains a list of groups from the remote Windows system, as well as a list of the group's users. This works similarly to enum.exe with the /G switch. The following MSRPC functions in SAMR are used to find a list of groups and the RIDs of their users. Keep in mind that MSRPC refers to groups as...

Service Detection (unknown) with nmap

This plugin performs service detection. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later For those who wish to go digging, please note that...

smbv2-enabled NSE Script

Checks whether or not a server is running the SMBv2 protocol. Script Arguments randomseed, smbbasic, smbport, smbsign See the documentation for the smb library. smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername See the documentation for the smbauth library. Example Usage nmap...

SLES9: Security update for nmap

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: nmap nmap-gtk More details may also be found by searching for keyword 5012982 within the SuSE Enterprise Server 9 patch database linked in the references...

SLES9: Security update for nmap

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: nmap nmap-gtk More details may also be found by searching for keyword 5012982 within the SuSE Enterprise Server 9 patch database at...

http-malware-host NSE Script

Looks for signature of known server compromises. Currently, the only signature it looks for is the one discussed here: . This is done by requesting the page /ts/in.cgi?open2 and looking for an errant 302 it attempts to detect servers that always return 302. Thanks to Denis from the above link for...