Nmap NSE net: ssh-hostkey

Shows SSH hostkeys. Shows the target SSH server's key fingerprint and with high enough verbosity level the public key itself. It records the discovered host keys in 'nmap.registry' for use by other scripts. Output can be controlled with the 'sshhostkey' script argument. SYNTAX: sshhostkey: Contro...

Nmap NSE net: banner

A simple banner grabber which connects to an open TCP port and prints out anything sent by the listening service within five seconds. The banner will be truncated to fit into a single line, but an extra line may be printed for every increase in the level of verbosity requested on the command line...

Nmap NSE net: jdwp-version

Detects the Java Debug Wire Protocol. This protocol is used by Java programs to be debugged via the network. It should not be open to the public Internet, as it does not provide any security against malicious attackers who can inject their own bytecode into the debugged process. Documentation for...

Nmap NSE net: wsdd-discover

Retrieves and displays information from devices supporting the Web Services Dynamic Discovery WS- Discovery protocol. It also attempts to locate any published Windows Communication Framework WCF web services .NET 4.0 or later. OpenVAS Vulnerability Test $Id: gbnmapwsdddiscovernet.nasl 5499...

Nmap NSE net: afp-path-vuln

Detects the Mac OS X AFP directory traversal vulnerability, CVE-2010-0533. This script attempts to iterate over all AFP shares on the remote host. For each share it attempts to access the parent directory by exploiting the directory traversal vulnerability as described in CVE-2010-0533. The scrip...

Nmap NSE net: imap-capabilities

Retrieves IMAP email server capabilities. IMAP4rev1 capabilities are defined in RFC 3501. The CAPABILITY command allows a client to ask a server what commands it supports and possibly any site-specific policy. OpenVAS Vulnerability Test $Id: gbnmapimapcapabilitiesnet.nasl 5505 2017-03-07 10:00:18...

Nmap NSE net: x11-access

Checks if you're allowed to connect to the X server. If the X server is listening on TCP port 6000+n where n is the display number, it is possible to check if you're able to get connected to the remote display by sending a X11 initial connection request. In reply, the success byte 0x00 or 0x01 wi...

Nmap NSE net: citrix-enum-apps-xml

Extracts a list of applications, ACLs, and settings from the Citrix XML service. The script returns more output with higher verbosity. OpenVAS Vulnerability Test $Id: gbnmapcitrixenumappsxmlnet.nasl 5505 2017-03-07 10:00:18Z teissa $ Autogenerated NSE wrapper Authors: NSE-Script: Patrik Karlsson...

Nmap NSE net: sniffer-detect

Checks if a target on a local Ethernet has its network card in promiscuous mode. The techniques used are described at http://www.securityfriday.com/promiscuousdetection01.pdf. OpenVAS Vulnerability Test $Id: gbnmapsnifferdetectnet.nasl 5499 2017-03-06 13:06:09Z teissa $ Autogenerated NSE wrapper...

Nmap NSE net: dns-zone-transfer

Requests a zone transfer AXFR from a DNS server. The script sends an AXFR query to a DNS server. The domain to query is determined by examining the name given on the command line, the DNS server's hostname, or it can be specified with the dns-zone-transfer.domain' script argument. If the query is...

Nmap NSE net: smb-enum-processes

Pulls a list of processes from the remote server over SMB. This will determine all running processes, their process IDs, and their parent processes. It is done by querying the remote registry service, which is disabled by default on Vista; on all other Windows versions, it requires Administrator...

Nmap NSE net: http-title

Shows the title of the default page of a web server. The script will follow no more than one HTTP redirect, and only if the redirection leads to the same host. The script may send a DNS query to determine whether the host the redirect leads to has the same IP address as the original target. SYNTA...

Nmap NSE net: nat-pmp-info

Queries a NAT-PMP service for its external address. OpenVAS Vulnerability Test $Id: gbnmapnatpmpinfonet.nasl 5499 2017-03-06 13:06:09Z teissa $ Autogenerated NSE wrapper Authors: NSE-Script: Patrik Karlsson NASL-Wrapper: autogenerated Copyright: NSE-Script: The Nmap Security Scanner http://nmap.o...

Nmap NSE net: whois

Queries the WHOIS services of Regional Internet Registries RIR and attempts to retrieve information about the IP Address Assignment which contains the Target IP Address. In using this script your IP address will be sent to iana.org. Additionally your address and the address of the target of the...

Nmap NSE net: smb-enum-sessions

Enumerates the users logged into a system either locally or through an SMB share. The local users can be logged on either physically on the machine, or through a terminal services session. Connections to a SMB share are, for example, people connected to fileshares or making RPC calls. Nmap's...

Nmap NSE net: socks-open-proxy

Checks if an open socks proxy is running on the target. The script attempts to connect to a proxy server and send socks4 and socks5 payloads. It is considered an open proxy if the script receives a Request Granted response from the target port. The payloads try to open a connection to...

Nmap NSE net: ldap-rootdse

Retrieves the LDAP root DSA-specific Entry DSE OpenVAS Vulnerability Test $Id: gbnmapldaprootdsenet.nasl 5499 2017-03-06 13:06:09Z teissa $ Autogenerated NSE wrapper Authors: NSE-Script: Patrik Karlsson NASL-Wrapper: autogenerated Copyright: NSE-Script: The Nmap Security Scanner http://nmap.org...

Nmap NSE net: finger

Attempts to retrieve a list of usernames using the finger service. OpenVAS Vulnerability Test $Id: gbnmapfingernet.nasl 5499 2017-03-06 13:06:09Z teissa $ Autogenerated NSE wrapper Authors: NSE-Script: Eddie Bell NASL-Wrapper: autogenerated Copyright: NSE-Script: The Nmap Security Scanner...

Nmap NSE net: netbus-brute

Performs brute force password auditing against the Netbus backdoor 'remote administration' service. SYNTAX: userdb: The filename of an alternate username database. unpwdb.passlimit: The maximum number of passwords 'passwords' will return default unlimited. passdb: The filename of an alternate...

Nmap NSE net: ldap-brute

Attempts to brute-force LDAP authentication. By default it uses the built-in username and password lists. In order to use your own lists use the 'userdb' and 'passdb' script arguments. This script does not make any attempt to prevent account lockout! If the number of passwords in the dictionary...