hostmap-robtex NSE Script

Discovers hostnames that resolve to the target's IP address by querying the online Robtex service at . TEMPORARILY DISABLED due to changes in Robtex's API. See Script Arguments slaxml.debug See the documentation for the slaxml library. http.host, http.max-body-size, http.max-cache-size,...

dns-ip6-arpa-scan NSE Script

Performs a quick reverse DNS lookup of an IPv6 network using a technique which analyzes DNS server response codes to dramatically reduce the number of queries needed to enumerate large networks. The technique essentially works by adding an octet to a given IPv6 prefix and resolving it. If the add...

broadcast-ataoe-discover NSE Script

Discovers servers supporting the ATA over Ethernet protocol. ATA over Ethernet is an ethernet protocol developed by the Brantley Coile Company and allows for simple, high-performance access to SATA drives over Ethernet. Discovery is performed by sending a Query Config Request to the Ethernet...

stun-info NSE Script

Retrieves the external IP address of a NAT:ed host using the STUN protocol. Script Arguments stun.mode See the documentation for the stun library. Example Usage nmap -sV -PN -sU -p 3478 --script stun-info Script Output PORT STATE SERVICE 3478/udp open|filtered stun | stun-info: | External IP:...

rpcap-info NSE Script

Connects to the rpcap service provides remote sniffing capabilities through WinPcap and retrieves interface information. The service can either be setup to require authentication or not and also supports IP restrictions. See also: rpcap-brute.nse Script Arguments creds.rpcap username:password to...

mongodb-brute NSE Script

Performs brute force password auditing against the MongoDB database. Script Arguments mongodb-brute.db Database against which to check. Default: admin passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library. creds.service, creds.global See...

rsync-brute NSE Script

Performs brute force password auditing against the rsync remote file syncing protocol. Script Arguments rsync-brute.module - the module against which brute forcing should be performed passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library...

voldemort-info NSE Script

Retrieves cluster and store information from the Voldemort distributed key-value store using the Voldemort Native Protocol. Example Usage nmap -p 6666 --script voldemort-info Script Output PORT STATE SERVICE 6666/tcp open irc | voldemort-info: | Cluster | Name: mycluster | Id: 0 | Host: localhost...

url-snarf NSE Script

Sniffs an interface for HTTP traffic and dumps any URLs, and their originating IP address. Script output differs from other script as URLs are written to stdout directly. There is also an option to log the results to file. The script can be limited in time by using the timeout argument or run unt...

http-auth-finder NSE Script

Spiders a web site to find web pages requiring form-based or HTTP-based authentication. The results are returned in a table with each url and the detected method. See also: http-auth.nse http-brute.nse Script Arguments http-auth-finder.url the url to start spidering. This is a URL relative to the...

broadcast-ripng-discover NSE Script

Discovers hosts and routing information from devices running RIPng on the LAN by sending a broadcast RIPng Request command and collecting any responses. Script Arguments broadcast-ripng-discover.timeout sets the connection timeout default: 5s Example Usage nmap --script broadcast-ripng-discover...

redis-info NSE Script

Retrieves information such as version number and architecture from a Redis key-value store. Script Arguments creds.service, creds.global See the documentation for the creds library. Example Usage nmap -p 6379 --script redis-info Script Output PORT STATE SERVICE 6379/tcp open unknown | redis-info:...

vmauthd-brute NSE Script

Performs brute force password auditing against the VMWare Authentication Daemon vmware-authd. Script Arguments passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library. creds.service, creds.global See the documentation for the creds library...

ssh-hostkey NSE Script

Shows SSH hostkeys. Shows the target SSH server's key fingerprint and with high enough verbosity level the public key itself. It records the discovered host keys in nmap.registry for use by other scripts. Output can be controlled with the sshhostkey script argument. You may also compare the...

telnet-encryption NSE Script

Determines whether the encryption option is supported on a remote telnet server. Some systems including FreeBSD and the krb5 telnetd available in many Linux distributions implement this option incorrectly, leading to a remote root vulnerability. This script currently only tests whether encryption...

reverse-index NSE Script

Creates a reverse index at the end of scan output showing which hosts run a particular service. This is in addition to Nmap's normal output listing the services on each host. Script Arguments reverse-index.mode the output display mode, can be either horizontal or vertical default: horizontal...

rlogin-brute NSE Script

Performs brute force password auditing against the classic UNIX rlogin remote login service. This script must be run in privileged mode on UNIX because it must bind to a low source port number. Script Arguments rlogin-brute.timeout socket timeout for connecting to rlogin default 10s passdb,...

ms-sql-dump-hashes NSE Script

Dumps the password hashes from an MS-SQL server in a format suitable for cracking by tools such as John-the-ripper. In order to do so the user needs to have the appropriate DB privileges. Credentials passed as script arguments take precedence over credentials discovered by other scripts. Script...

http-wordpress-enum NSE Script

Enumerates themes and plugins of Wordpress installations. The script can also detect outdated plugins by comparing version numbers with information pulled from api.wordpress.org. The script works with two separate databases for themes wp-themes.lst and plugins wp-plugins.lst. The databases are...

http-vuln-cve2011-3192 NSE Script

Detects a denial of service vulnerability in the way the Apache web server handles requests for multiple overlapping/simple ranges of a page. References: See also: http-slowloris-check.nse http-slowloris.nse Script Arguments http-vuln-cve2011-3192.path Define the request path...