Nmap NSE 6.01: rpcinfo

Connects to portmapper and fetches a list of all registered programs. It then prints out a table including for each program the RPC program number, supported version numbers, port number and protocol, and program name. SYNTAX: nfs.version: number If set overrides the detected version of nfs...

Nmap NSE 6.01: irc-info

Gathers information from an IRC server. It uses STATS, LUSERS, and other queries to obtain this information. OpenVAS Vulnerability Test $Id: gbnmap6ircinfo.nasl 7148 2017-09-15 13:01:14Z cfischer $ Autogenerated NSE wrapper Authors: NSE-Script: Doug Hoyte NASL-Wrapper: autogenerated Copyright:...

Nmap NSE 6.01: sshv1

Checks if an SSH server supports the obsolete and less secure SSH Protocol Version 1. OpenVAS Vulnerability Test $Id: gbnmap6sshv1.nasl 7148 2017-09-15 13:01:14Z cfischer $ Autogenerated NSE wrapper Authors: NSE-Script: Brandon Enright NASL-Wrapper: autogenerated Copyright: NSE-Script: The Nmap...

Nmap NSE 6.01: smb-enum-groups

Obtains a list of groups from the remote Windows system, as well as a list of the group's users. This works similarly to 'enum.exe' with the '/G' switch. The following MSRPC functions in SAMR are used to find a list of groups and the RIDs of their users. Keep in mind that MSRPC refers to groups a...

Nmap NSE 6.01: pop3-brute

Tries to log into a POP3 account by guessing usernames and passwords. SYNTAX: userdb: The filename of an alternate username database. pop3loginmethod: The login method to use: ''USER'' default, ''SASL-PLAIN'', ''SASL-LOGIN'', ''SASL-CRAM-MD5'', or ''APOP''. unpwdb.passlimit: The maximum number of...

Nmap NSE 6.01: smb-enum-domains

Attempts to enumerate domains on a system, along with their policies. This generally requires credentials, except against Windows 2000. In addition to the actual domain, the 'Builtin' domain is generally displayed. Windows returns this in the list of domains, but its policies don't appear to be...

Nmap NSE 6.01: asn-query

Maps IP addresses to autonomous system AS numbers. The script works by sending DNS TXT queries to a DNS server which in turn queries a third-party service provided by Team Cymru team-cymru.org using an in-addr.arpa style zone set up especially for use by Nmap. The responses to these queries conta...

Nmap NSE 6.01: smb-system-info

Pulls back information about the remote system from the registry. Getting all of the information requires an administrative account, although a user account will still get a lot of it. Guest probably won't get any, nor will anonymous. This goes for all operating systems, including Windows 2000...

Nmap NSE 6.01: snmp-brute

Attempts to find an SNMP community string by brute force guessing. This script opens a sending socket and a sniffing pcap socket in parallel threads. The sending socket sends the SNMP probes with the community strings, while the pcap socket sniffs the network for an answer to the probes. If valid...

Nmap NSE 6.01: smb-brute

Attempts to guess username/password combinations over SMB, storing discovered combinations for use in other scripts. Every attempt will be made to get a valid list of users and to verify each username before actually using them. When a username is discovered, besides being printed, it is also sav...

Nmap NSE 6.01: upnp-info

Attempts to extract system information from the UPnP service. SYNTAX: upnp-info.override: Controls whether we override the IP address information returned by the UPNP service for the location of the XML file that describes the device. Defaults to true for unicast hosts. OpenVAS Vulnerability Test...

Nmap NSE 6.01: nbstat

Attempts to retrieve the target's NetBIOS names and MAC address. By default, the script displays the name of the computer and the logged-in user; if the verbosity is turned up, it displays all names the system thinks it owns. OpenVAS Vulnerability Test $Id: gbnmap6nbstat.nasl 7148 2017-09-15...

Nmap NSE 6.01: smb-os-discovery

Attempts to determine the operating system, computer name, domain, workgroup, and current time over the SMB protocol ports 445 or 139. This is done by starting a session with the anonymous account or with a proper user account, if one is given; it likely doesn't make a difference; in response to ...

Nmap NSE 6.01: citrix-enum-apps

Extracts a list of published applications from the ICA Browser service. OpenVAS Vulnerability Test $Id: gbnmap6citrixenumapps.nasl 7148 2017-09-15 13:01:14Z cfischer $ Autogenerated NSE wrapper Authors: NSE-Script: Patrik Karlsson NASL-Wrapper: autogenerated Copyright: NSE-Script: The Nmap Securi...

Nmap NSE 6.01: p2p-conficker

Checks if a host is infected with Conficker.C or higher, based on Conficker's peer to peer communication. When Conficker.C or higher infects a system, it opens four ports: two TCP and two UDP. The ports are random, but are seeded with the current week and the IP of the infected host. By determini...

Nmap NSE 6.01: ms-sql-info

Attempts to determine configuration and version information for Microsoft SQL Server instances. SQL Server credentials required: No will not benefit from 'mssql.username' & 'mssql.password'. Run criteria: Host script: Will always run. Port script: N/A NOTE: Unlike previous versions, this script...

Nmap NSE 6.01: ftp-bounce

Checks to see if an FTP server allows port scanning using the FTP bounce method. SYNTAX: ftp-bounce.username: Username to log in with. Default ''anonymous''. ftp-bounce.password: Password to log in with. Default ''IEUser@''. OpenVAS Vulnerability Test $Id: gbnmap6ftpbounce.nasl 7006 2017-08-25...

Nmap NSE 6.01: realvnc-auth-bypass

Checks if a VNC server is vulnerable to the RealVNC authentication bypass CVE-2006-2369. OpenVAS Vulnerability Test $Id: gbnmap6realvncauthbypass.nasl 7148 2017-09-15 13:01:14Z cfischer $ Autogenerated NSE wrapper Authors: NSE-Script: Brandon Enright NASL-Wrapper: autogenerated Copyright:...

Nmap NSE 6.01: dns-random-txid

Checks a DNS server for the predictable-TXID DNS recursion vulnerability. Predictable TXID values can make a DNS server vulnerable to cache poisoning attacks see CVE-2008-1447. The script works by querying txidtest.dns-oarc.net see https://www.dns- oarc.net/oarc/services/txidtest. Be aware that a...

Nmap NSE 6.01: mysql-info

Connects to a MySQL server and prints information such as the protocol and version numbers, thread ID, status, capabilities, and the password salt. If service detection is performed and the server appears to be blocking our host or is blocked because of too many connections, then this script isn'...