Nmap NSE net: ms-sql-query

Runs a query against Microsoft SQL Server ms-sql. SYNTAX: mssql.timeout: How long to wait for SQL responses. This is a number followed by 'ms' for milliseconds, 's' for seconds, 'm' for minutes, or 'h' for hours. Default: '30s'. mssql-query.query: specifies the query to run against the server...

Nmap NSE net: snmp-win32-services

Attempts to enumerate Windows services through SNMP. SYNTAX: snmpcommunity: The community string to use. If not given, it is ''public'', or whatever is passed to 'buildPacket'. OpenVAS Vulnerability Test $Id: gbnmapsnmpwin32servicesnet.nasl 5499 2017-03-06 13:06:09Z teissa $ Autogenerated NSE...

Nmap NSE net: netbus-auth-bypass

Checks if a NetBus server is vulnerable to an authentication bypass vulnerability which allows ful access without knowing the password. For example a server running on TCP port 12345 on localhost with this vulnerability is accessible to anyone. An attacker could simply form a connection to the...

Nmap NSE net: http-malware-host

Looks for signature of known server compromises. Currently, the only signature it looks for is the one discussed here: http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-botnet-of-zombie-web-servers/. This is done by requesting the page '/ts/in.cgi?open2' and looking for an errant 302 it...

Nmap NSE net: modbus-discover

Enumerates SCADA Modbus slave ids sids and collects their device information. Modbus is one of the popular SCADA protocols. This script does Modbus device information disclosure. It tries to find legal sids slave ids of Modbus devices and to get additional information about the vendor and firmwar...

Nmap NSE net: couchdb-databases

Gets database tables from a CouchDB database. For more info about the CouchDB HTTP API, see http://wiki.apache.org/couchdb/HTTPdatabaseAPI. SYNTAX: http.pipeline: If set, it represents the number of HTTP requests that'll be pipelined ie, sent in a single request. This can be set low to make...

Nmap NSE net: ssh-hostkey

Shows SSH hostkeys. Shows the target SSH server's key fingerprint and with high enough verbosity level the public key itself. It records the discovered host keys in 'nmap.registry' for use by other scripts. Output can be controlled with the 'sshhostkey' script argument. SYNTAX: sshhostkey: Contro...

Nmap NSE net: ldap-rootdse

Retrieves the LDAP root DSA-specific Entry DSE OpenVAS Vulnerability Test $Id: gbnmapldaprootdsenet.nasl 5499 2017-03-06 13:06:09Z teissa $ Autogenerated NSE wrapper Authors: NSE-Script: Patrik Karlsson NASL-Wrapper: autogenerated Copyright: NSE-Script: The Nmap Security Scanner http://nmap.org...

Nmap NSE net: nfs-showmount

Shows NFS exports, like the 'showmount -e' command. SYNTAX: nfs.version: number If set overrides the detected version of nfs mount.version: number If set overrides the detected version of mountd rpc.protocol: table If set overrides the preferred order in which protocols are tested. ie. 'tcp', 'ud...

Nmap NSE net: domcon-cmd

Runs a console command on the Lotus Domino Console using the given authentication credentials see also: domcon-brute SYNTAX: domcon-cmd.pass: The password used to authenticate to the server domcon-cmd.cmd: The command to run on the remote server domcon-cmd.user: The user used to authenticate to t...

Nmap NSE net: http-domino-enum-passwords

Attempts to enumerate the hashed Domino Internet Passwords that are by default accessible by all authenticated users. This script can also download any Domino ID Files attached to the Person document. SYNTAX: domino-enum-passwords.idpath: the path where downloaded ID files should be saved If not...

Nmap NSE net: upnp-info

Attempts to extract system information from the UPnP service. SYNTAX: upnp-info.override: Controls whether we override the IP address information returned by the UPNP service for the location of the XML file that describes the device. Defaults to true for unicast hosts. OpenVAS Vulnerability Test...

Nmap NSE net: ldap-brute

Attempts to brute-force LDAP authentication. By default it uses the built-in username and password lists. In order to use your own lists use the 'userdb' and 'passdb' script arguments. This script does not make any attempt to prevent account lockout! If the number of passwords in the dictionary...

Nmap NSE net: citrix-enum-servers

Extracts a list of Citrix servers from the ICA Browser service. OpenVAS Vulnerability Test $Id: gbnmapcitrixenumserversnet.nasl 5505 2017-03-07 10:00:18Z teissa $ Autogenerated NSE wrapper Authors: NSE-Script: Patrik Karlsson NASL-Wrapper: autogenerated Copyright: NSE-Script: The Nmap Security...

Nmap NSE net: smb-enum-domains

Attempts to enumerate domains on a system, along with their policies. This generally requires credentials, except against Windows 2000. In addition to the actual domain, the 'Builtin' domain is generally displayed. Windows returns this in the list of domains, but its policies don't appear to be...

Nmap NSE net: vnc-info

Queries a VNC server for its protocol version and supported security types. OpenVAS Vulnerability Test $Id: gbnmapvncinfonet.nasl 5505 2017-03-07 10:00:18Z teissa $ Autogenerated NSE wrapper Authors: NSE-Script: Patrik Karlsson NASL-Wrapper: autogenerated Copyright: NSE-Script: The Nmap Security...

Nmap NSE net: sql-injection

Spiders an HTTP server looking for URLs containing queries vulnerable to an SQL injection attack. The script spiders an HTTP server looking for URLs containing queries. It then proceeds to combine crafted SQL commands with susceptible URLs in order to obtain errors. The errors are analysed to see...

Nmap NSE net: dns-service-discovery

Attempts to discover a hosts services using the DNS Service Discovery protocol. The script first sends a query for services.dns-sd.udp.local to get a list of services. It then sends a followup query for each one to try to get more information. SYNTAX: dnssd.services: string or table containing...

Nmap NSE net: snmp-brute

Attempts to find an SNMP community string by brute force guessing. SYNTAX: snmplist: The filename of a list of community strings to try. snmpcommunity: The community string to use. If not given, it is ''public'', or whatever is passed to 'buildPacket'. OpenVAS Vulnerability Test $Id:...

Nmap NSE net: http-favicon

Gets the favicon 'favorites icon' from a web page and matches it against a database of the icons of known web applications. If there is a match, the name of the application is printed; otherwise the MD5 hash of the icon data is printed. If the script argument 'favicon.uri' is given, that relative...