citrix-brute-xml NSE Script

Attempts to guess valid credentials for the Citrix PN Web Agent XML Service. The XML service authenticates against the local Windows server or the Active Directory. This script makes no attempt of preventing account lockout. If the password list contains more passwords than the lockout-threshold...

citrix-enum-servers NSE Script

Extracts a list of Citrix servers from the ICA Browser service. Example Usage sudo ./nmap -sU --script=citrix-enum-servers -p 1604 Script Output PORT STATE SERVICE 1604/udp open unknown | citrix-enum-servers: | CITRIXSRV01 | CITRIXSRV02 Requires nmap shortport stdnse string table local nmap =...

nfs-showmount NSE Script

Shows NFS exports, like the showmount -e command. Script Arguments mount.version, nfs.version, rpc.protocol See the documentation for the rpc library. Example Usage nmap -sV --script=nfs-showmount Script Output PORT STATE SERVICE 111/tcp open rpcbind | nfs-showmount: | /home/storage/backup...

Novell NetMail <= 3.52d NMAP STOR Buffer Overflow

require 'msf/core' class Metasploit3 'Novell NetMail %q This module exploits a stack overflow in Novell's Netmail 3.52 NMAP STOR verb. By sending an overly long string, an attacker can overwrite the buffer and control program execution. , 'Author' = 'MC' , 'License' = MSFLICENSE, 'Version' =...

smb-psexec NSE Script

Implements remote process execution similar to the Sysinternals' psexec tool, allowing a user to run a series of programs on a remote machine and read the output. This is great for gathering information about servers, running the same tool on a range of system, or even installing a backdoor on a...

smb-enum-groups NSE Script

Obtains a list of groups from the remote Windows system, as well as a list of the group's users. This works similarly to enum.exe with the /G switch. The following MSRPC functions in SAMR are used to find a list of groups and the RIDs of their users. Keep in mind that MSRPC refers to groups as...

Service Detection (unknown) with nmap

This plugin performs service detection. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later For those who wish to go digging, please note that...

smbv2-enabled NSE Script

Checks whether or not a server is running the SMBv2 protocol. Script Arguments randomseed, smbbasic, smbport, smbsign See the documentation for the smb library. smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername See the documentation for the smbauth library. Example Usage nmap...

SLES9: Security update for nmap

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: nmap nmap-gtk More details may also be found by searching for keyword 5012982 within the SuSE Enterprise Server 9 patch database linked in the references...

SLES9: Security update for nmap

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: nmap nmap-gtk More details may also be found by searching for keyword 5012982 within the SuSE Enterprise Server 9 patch database at...

http-malware-host NSE Script

Looks for signature of known server compromises. Currently, the only signature it looks for is the one discussed here: . This is done by requesting the page /ts/in.cgi?open2 and looking for an errant 302 it attempts to detect servers that always return 302. Thanks to Denis from the above link for...

CVE-2008-7201

Lantronix MSS485-T allows remote attackers to cause a denial of service unstable performance and service loss via certain vulnerability scans, as demonstrated using 1 Nessus and 2 nmap...

Design/Logic Flaw

Lantronix MSS485-T allows remote attackers to cause a denial of service unstable performance and service loss via certain vulnerability scans, as demonstrated using 1 Nessus and 2 nmap...

CVE-2008-7201

Lantronix MSS485-T allows remote attackers to cause a denial of service unstable performance and service loss via certain vulnerability scans, as demonstrated using 1 Nessus and 2 nmap...

http-favicon NSE Script

Gets the favicon "favorites icon" from a web page and matches it against a database of the icons of known web applications. If there is a match, the name of the application is printed; otherwise the MD5 hash of the icon data is printed. If the script argument favicon.uri is given, that relative U...

http-userdir-enum NSE Script

Attempts to enumerate valid usernames on web servers running with the moduserdir module or similar enabled. The Apache moduserdir module allows user-specific directories to be accessed using the syntax. This script makes http requests in order to discover valid user-specific directories and infer...

x11-access NSE Script

Checks if you're allowed to connect to the X server. If the X server is listening on TCP port 6000+n where n is the display number, it is possible to check if you're able to get connected to the remote display by sending a X11 initial connection request. In reply, the success byte 0x00 or 0x01 wi...

pjl-ready-message NSE Script

Retrieves or sets the ready message on printers that support the Printer Job Language. This includes most PostScript printers that listen on port 9100. Without an argument, displays the current ready message. With the pjlreadymessage script argument, displays the old ready message and changes it...

http-date NSE Script

Gets the date from HTTP-like services. Also prints how much the date differs from local time. Local time is the time the HTTP request was sent, so the difference includes at least the duration of one RTT. Script Arguments slaxml.debug See the documentation for the slaxml library. http.host,...

telnet-brute NSE Script

Performs brute-force password auditing against telnet servers. Script Arguments telnet-brute.autosize Whether to automatically reduce the thread count based on the behavior of the target default: "true" telnet-brute.timeout Connection time-out timespec default: "5s" passdb, unpwdb.passlimit,...