http-slowloris-check NSE Script

Tests a web server for vulnerability to the Slowloris DoS attack without actually launching a DoS attack. Slowloris was described at Defcon 17 by RSnake see . This script opens two connections to the server, each without the final CRLF. After 10 seconds, second connection sends additional header...

llmnr-resolve NSE Script

Resolves a hostname by using the LLMNR Link-Local Multicast Name Resolution protocol. The script works by sending a LLMNR Standard Query containing the hostname to the 5355 UDP port on the 224.0.0.252 multicast address. It listens for any LLMNR responses that are sent to the local machine with a...

broadcast-igmp-discovery NSE Script

Discovers targets that have IGMP Multicast memberships and grabs interesting information. The scripts works by sending IGMP Membership Query message to the 224.0.0.1 All Hosts multicast address and listening for IGMP Membership Report messages. The script then extracts all the interesting...

OS X Gather Keychain Enumeration

This module presents a way to quickly go through the current user's keychains and collect data such as email accounts, servers, and other services. Please note: when using the GETPASS and GETPASSAUTOACCEPT option, the user may see an authentication alert flash briefly on their screen that gets...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

These new kernel packages contain fixes for the following security issues : - a flaw in the handling of IPv6 type 0 routing headers that allowed remote users to cause a denial of service that led to a network amplification between two routers CVE-2007-2242, Important. - a flaw in the nfnetlinklog...

Veeam ONE Monitor performance data collection times out

Challenge You are facing the following configuration issue: Veeam ONE Monitor performance graphs show the No Data Available message. Cause VeeamDCS.log file contains the following errors: ​Collecting thread has failed to initialize The operation has timed out and will be stopped Collecting thread...

Scientific Linux Security Update : openldap on SL5.x i386/x86_64

A flaw was found in the way OpenLDAP's slapd daemon handled malformed objectClasses LDAP attributes. A local or remote attacker could create an LDAP request which could cause a denial of service by crashing slapd. CVE-2007-5707 In addition, the following feature was added : - OpenLDAP client tool...

sip-call-spoof NSE Script

Spoofs a call to a SIP phone and detects the action taken by the target busy, declined, hung up, etc. This works by sending a fake sip invite request to the target phone and checking the responses. A response with status code 180 means that the phone is ringing. The script waits for the next...

Unable to collect files information from datastore in a timely manner due to high vCenter server load

Challenge Veeam ONE Reporter collects data from datastores using the SearchDatastoreSubFoldersTask tasks, which are pre-defined by vSphere. During that process, if a datastore becomes unavailable or experiences performance issues, Veeam ONE Reporter may be unable to complete data collection tasks...

pcanywhere-brute NSE Script

Performs brute force password auditing against the pcAnywhere remote access protocol. Due to certain limitations of the protocol, bruteforcing is limited to single thread at a time. After a valid login pair is guessed the script waits some time until server becomes available again. Script Argumen...

Hyperlinks in SSRS-based reports do not work

Challenge Some hyperlinks in SSRS-based reports expire in 20 minutes version 6.0-10.0. NOTE: In Veeam ONE Reporter v11 the timeout is 12 hours. Cause The behavior is caused by Microsoft SSRS implementation specifics. Solution This behavior is by Microsoft SSRS design. More Information If you have...

CVE-2011-1927

The ipexpire function in net/ipv4/ipfragment.c in the Linux kernel before 2.6.39 does not properly construct ICMPTIMEEXCEEDED packets after a timeout, which allows remote attackers to cause a denial of service invalid pointer dereference via crafted fragmented packets...

gpsd-info NSE Script

Retrieves GPS time, coordinates and speed from the GPSD network daemon. Script Arguments gpsd-info.timeout timespec defining how long to wait for data default 10s Example Usage nmap -p 2947 --script gpsd-info Script Output PORT STATE SERVICE REASON 2947/tcp open gpsd-ng syn-ack | gpsd-info: | Tim...

KnFTPd 1.0.0 Denial Of Service

!/usr/bin/perl Advisory: KnFTPd 1.0.0 'FEAT' DoS PoC-Exploit Author: Stefan Schurtz Affected Software: Successfully tested on KnFTPd 1.0.0 Vendor URL: http://knftp.sourceforge.net/ Vendor Status: informed CVE-ID: - PoC-Version: 1.0 use strict; use Net::FTP; my $user = "system"; my $password =...

eap-info NSE Script

Enumerates the authentication methods offered by an EAP Extensible Authentication Protocol authenticator for a given identity or for the anonymous identity if no argument is passed. Script Arguments eap-info.identity Identity to use for the first step of the authentication methods if omitted...

nfs-utils security, bug fix, and enhancement update

1.0.9-60.0.1.el5 - Add support for resvport for unmonting orabug 13567018 1.0.9-60 - Updated idmapd.conf and idmapd.conf.man to reflect the static user name mapping 502707 - Fixed an umount regression introduced by bz 513094 bz 781931 1.0.9-59 - gss: turned of even more excessive syslogs bz 59309...

url-snarf NSE Script

Sniffs an interface for HTTP traffic and dumps any URLs, and their originating IP address. Script output differs from other script as URLs are written to stdout directly. There is also an option to log the results to file. The script can be limited in time by using the timeout argument or run unt...

Gitorious Remote Command Execution

Phenoelit Advisory Authors joernchen Phenoelit Group http://www.phenoelit.de Affected Products Gitorious 2.1.1 http://gitorious.org Vendor communication 2012-01-16 Asking vendor for PGP key 2012-01-17 Getting PGP key from vendor 2012-01-17 Sending vulnerability details to vendor 2012-01-19 Vendor...

Windows Manage Download and/or Execute

This module will download a file by importing urlmon via railgun. The user may also choose to execute the file with arguments via execstring. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

broadcast-ripng-discover NSE Script

Discovers hosts and routing information from devices running RIPng on the LAN by sending a broadcast RIPng Request command and collecting any responses. Script Arguments broadcast-ripng-discover.timeout sets the connection timeout default: 5s Example Usage nmap --script broadcast-ripng-discover...