http-frontpage-login NSE Script

Checks whether target machines are vulnerable to anonymous Frontpage login. Older, default configurations of Frontpage extensions allow remote user to login anonymously which may lead to server compromise. Script Arguments http-frontpage-login.path Path prefix to Frontpage directories. Defaults t...

ftp-libopie NSE Script

Checks if an FTPd is prone to CVE-2010-1938 OPIE off-by-one stack overflow, a vulnerability discovered by Maksymilian Arciemowicz and Adam "pi3" Zabrocki. See the advisory at . Be advised that, if launched against a vulnerable host, this script will crash the FTPd. Script Arguments vulns.short,...

http-wordpress-enum NSE Script

Enumerates themes and plugins of Wordpress installations. The script can also detect outdated plugins by comparing version numbers with information pulled from api.wordpress.org. The script works with two separate databases for themes wp-themes.lst and plugins wp-plugins.lst. The databases are...

http-webdav-scan NSE Script

A script to detect WebDAV installations. Uses the OPTIONS and PROPFIND methods. The script sends an OPTIONS request which lists the dav type, server type, date and allowed methods. It then sends a PROPFIND request and tries to fetch exposed directories and internal ip addresses by doing pattern...

dns-brute NSE Script

Attempts to enumerate DNS hostnames by brute force guessing of common subdomains. With the dns-brute.srv argument, dns-brute will also try to enumerate common DNS SRV records. Wildcard records are listed as "A" and "AAAA" for IPv4 and IPv6 respectively. See also: dns-nsec3-enum.nse...

smb-enum-users NSE Script

Attempts to enumerate the users on a remote Windows system, with as much information as possible, through two different techniques both over MSRPC, which uses port 445 or 139; see smb.lua. The goal of this script is to discover all user accounts that exist on a remote system. This can be helpful...

http-wordpress-users NSE Script

Enumerates usernames in Wordpress blog/CMS installations by exploiting an information disclosure vulnerability existing in versions 2.6, 3.1, 3.1.1, 3.1.3 and 3.2-beta2 and possibly others. Original advisory: Script Arguments http-wordpress-users.out If set it saves the username list in this file...

http-slowloris NSE Script

Tests a web server for vulnerability to the Slowloris DoS attack by launching a Slowloris attack. Slowloris was described at Defcon 17 by RSnake see . This script opens and maintains numerous 'half-HTTP' connections until the server runs out of resources, leading to a denial of service. When a...

ssl-cert NSE Script

Retrieves a server's SSL certificate. The amount of information printed about the certificate depends on the verbosity level. With no extra verbosity, the script prints the validity period and the commonName, organizationName, stateOrProvinceName, and countryName of the subject. 443/tcp open http...

http-hp-ilo-info NSE Script

Attempts to extract information from HP iLO boards including versions and addresses. HP iLO boards have an unauthenticated info disclosure at ip/xmldata?item=all. It lists board informations such as server model, firmware version, MAC addresses, IP addresses, etc. This script uses the slaxml...

mysql-vuln-cve2012-2122 NSE Script

Attempts to bypass authentication in MySQL and MariaDB servers by exploiting CVE2012-2122. If its vulnerable, it will also attempt to dump the MySQL usernames and password hashes. All MariaDB and MySQL versions up to 5.1.61, 5.2.11, 5.3.5, 5.5.22 are vulnerable but exploitation depends on whether...

rsync-brute NSE Script

Performs brute force password auditing against the rsync remote file syncing protocol. Script Arguments rsync-brute.module - the module against which brute forcing should be performed passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library...

http-vuln-cve2017-1001000 NSE Script

Attempts to detect a privilege escalation vulnerability in Wordpress 4.7.0 and 4.7.1 that allows unauthenticated users to inject content in posts. The script connects to the Wordpress REST API to obtain the list of published posts and grabs the user id and date from there. Then it attempts to...

llmnr-resolve NSE Script

Resolves a hostname by using the LLMNR Link-Local Multicast Name Resolution protocol. The script works by sending a LLMNR Standard Query containing the hostname to the 5355 UDP port on the 224.0.0.252 multicast address. It listens for any LLMNR responses that are sent to the local machine with a...

http-method-tamper NSE Script

Attempts to bypass password protected resources HTTP 401 status by performing HTTP verb tampering. If an array of paths to check is not set, it will crawl the web server and perform the check against any password protected resource that it finds. The script determines if the protected URI is...

dicom-brute NSE Script

Attempts to brute force the Application Entity Title of a DICOM server DICOM Service Provider. Application Entity Titles AET are used to restrict responses only to clients knowing the title. Hence, the called AET is used as a form of password. Script Arguments brute.credfile, brute.delay,...

http-form-brute NSE Script

Performs brute force password auditing against http form-based authentication. This script uses the unpwdb and brute libraries to perform password guessing. Any successful guesses are stored in the nmap registry, using the creds library, for other scripts to use. The script automatically attempts...

http-bigip-cookie NSE Script

Decodes any unencrypted F5 BIG-IP cookies in the HTTP response. BIG-IP cookies contain information on backend systems such as internal IP addresses and port numbers. See here for more info: Script Arguments http-bigip-cookie.path The URL path to request. The default path is "/". slaxml.debug See...

clamav-exec NSE Script

Exploits ClamAV servers vulnerable to unauthenticated clamav comand execution. ClamAV server 0.99.2, and possibly other previous versions, allow the execution of dangerous service commands without authentication. Specifically, the command 'SCAN' may be used to list system files and the command...

ubiquiti-discovery NSE Script

Extracts information from Ubiquiti networking devices. This script leverages Ubiquiti's Discovery Service which is enabled by default on many products. It will attempt to leverage version 1 of the protocol first and, if that fails, attempt version 2. Example Usage nmap -sU -p 10001 --script...

smtp-brute NSE Script

Performs brute force password auditing against SMTP servers using either LOGIN, PLAIN, CRAM-MD5, DIGEST-MD5 or NTLM authentication. Script Arguments smtp-brute.auth authentication mechanism to use LOGIN, PLAIN, CRAM-MD5, DIGEST-MD5 or NTLM creds.service, creds.global See the documentation for the...

rtsp-methods NSE Script

Determines which methods are supported by the RTSP real time streaming protocol server. Script Arguments rtsp-methods.path the path to query, defaults to "" which queries the server itself, rather than a specific url. Example Usage nmap -p 554 --script rtsp-methods Script Output PORT STATE SERVIC...

http-open-redirect NSE Script

Spiders a website and attempts to identify open redirects. Open redirects are handlers which commonly take a URL as a parameter and responds with a HTTP redirect 3XX to the target. Risks of open redirects are described at . Only open redirects that are directly linked on the target website can be...

krb5-enum-users NSE Script

Discovers valid usernames by brute force querying likely usernames against a Kerberos service. When an invalid username is requested the server will respond using the Kerberos error code KRB5KDCERRCPRINCIPALUNKNOWN, allowing us to determine that the user name was invalid. Valid user names will...

mysql-info NSE Script

Connects to a MySQL server and prints information such as the protocol and version numbers, thread ID, status, capabilities, and the password salt. If service detection is performed and the server appears to be blocking our host or is blocked because of too many connections, then this script isn'...

ftp-syst NSE Script

Sends FTP SYST and STAT commands and returns the result. The canonical SYST response of "UNIX Type: L8" is stripped or ignored, since it is meaningless. Typical FTP response codes 215 for SYST and 211 for STAT are also hidden. References: Example Usage nmap -sV -sC Script Output | ftp-syst: | SYS...

tls-alpn NSE Script

Enumerates a TLS server's supported application-layer protocols using the ALPN protocol. Repeated queries are sent to determine which of the registered protocols are supported. For more information, see: Script Arguments mssql.domain, mssql.instance-all, mssql.instance-name, mssql.instance-port,...

http-joomla-brute NSE Script

Performs brute force password auditing against Joomla web CMS installations. This script initially reads the session cookie and parses the security token to perfom the brute force password auditing. It uses the unpwdb and brute libraries to perform password guessing. Any successful guesses are...

http-sap-netweaver-leak NSE Script

Detects SAP Netweaver Portal instances that allow anonymous access to the KM unit navigation page. This page leaks file names, ldap users, etc. SAP Netweaver Portal with the Knowledge Management Unit enable allows unauthenticated users to list file system directories through the URL...

clock-skew NSE Script

Analyzes the clock skew between the scanner and various services that report timestamps. At the end of the scan, it will show groups of systems that have similar median clock skew among their services. This can be used to identify targets with similar configurations, such as those that share a...

http-vuln-cve2011-3368 NSE Script

Tests for the CVE-2011-3368 Reverse Proxy Bypass vulnerability in Apache HTTP server's reverse proxy mode. The script will run 3 tests: the loopback test, with 3 payloads to handle different rewrite rules the internal hosts test. According to Contextis, we expect a delay before a server error. Th...

pptp-version NSE Script

Attempts to extract system information from the point-to-point tunneling protocol PPTP service. Example Usage nmap -sV Script Output PORT STATE SERVICE VERSION 1723/tcp open pptp YAMAHA Corporation Firmware: 32838 Service Info: Host: RT57i Requires comm nmap shortport string local comm = require...

http-default-accounts NSE Script

Tests for access with default credentials used by a variety of web applications and devices. It works similar to http-enum, we detect applications by matching known paths and launching a login routine using default credentials when found. This script depends on a fingerprint file containing the...

http-fileupload-exploiter NSE Script

Exploits insecure file upload forms in web applications using various techniques like changing the Content-type header or creating valid image files containing the payload in the comment. Script Arguments http-fileupload-exploiter.fieldvalues The script will try to fill every field found in the...

ssl-heartbleed NSE Script

Detects whether a server is vulnerable to the OpenSSL Heartbleed bug CVE-2014-0160. The code is based on the Python script ssltest.py authored by Katie Stafford [email protected] Script Arguments ssl-heartbleed.protocols default tries all TLS 1.0, TLS 1.1, or TLS 1.2 tls.servername See the...

http-vuln-cve2015-1427 NSE Script

This script attempts to detect a vulnerability, CVE-2015-1427, which allows attackers to leverage features of this API to gain unauthenticated remote code execution RCE. Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have a vulnerability in the Groovy scripting engine. The vulnerability allow...

tftp-enum NSE Script

Enumerates TFTP trivial file transfer protocol filenames by testing for a list of common ones. TFTP doesn't provide directory listings. This script tries to retrieve filenames from a list. The list is composed of static names from the file tftplist.txt, plus configuration filenames for Cisco...

modbus-discover NSE Script

Enumerates SCADA Modbus slave ids sids and collects their device information. Modbus is one of the popular SCADA protocols. This script does Modbus device information disclosure. It tries to find legal sids slave ids of Modbus devices and to get additional information about the vendor and firmwar...

ftp-bounce NSE Script

Checks to see if an FTP server allows port scanning using the FTP bounce method. Script Arguments ftp-bounce.password Password to log in with. Default IEUser@. ftp-bounce.username Username to log in with. Default anonymous. ftp-bounce.checkhost Host to try connecting to with the PORT command...

http-tplink-dir-traversal NSE Script

Exploits a directory traversal vulnerability existing in several TP-Link wireless routers. Attackers may exploit this vulnerability to read any of the configuration and password files remotely and without authentication. This vulnerability was confirmed in models WR740N, WR740ND and WR2543ND but...

http-put NSE Script

Uploads a local file to a remote web server using the HTTP PUT method. You must specify the filename and URL path with NSE arguments. Script Arguments http-put.file - The full path to the local file that should be uploaded to the server http-put.url - The remote directory and filename to store...

http-jsonp-detection NSE Script

Attempts to discover JSONP endpoints in web servers. JSONP endpoints can be used to bypass Same-origin Policy restrictions in web browsers. The script searches for callback functions in the response to detect JSONP endpoints. It also tries to determine callback function through URLcallback functi...

pop3-capabilities NSE Script

Retrieves POP3 email server capabilities. POP3 capabilities are defined in RFC 2449. The CAPA command allows a client to ask a server what commands it supports and possibly any site-specific policy. Besides the list of supported commands, the IMPLEMENTATION string giving the server version may be...

http-vuln-cve2017-5689 NSE Script

Detects if a system with Intel Active Management Technology is vulnerable to the INTEL-SA-00075 privilege escalation vulnerability CVE2017-5689. This script determines if a target is vulnerable by attempting to perform digest authentication with a blank response parameter. If the authentication...

vnc-info NSE Script

Queries a VNC server for its protocol version and supported security types. Example Usage nmap -sV -sC Script Output PORT STATE SERVICE 5900/tcp open vnc | vnc-info: | Protocol version: 3.889 | Security types: | Mac OS X security type 30 | Mac OS X security type 35 Requires shortport stdnse strin...

cccam-version NSE Script

Detects the CCcam service software for sharing subscription TV among multiple receivers. The service normally runs on port 12000. It distinguishes itself by printing 16 random-looking bytes upon receiving a connection. Because the script attempts to detect "random-looking" bytes, it has a small...

pgsql-brute NSE Script

Performs password guessing against PostgreSQL. Script Arguments pgsql.version Force protocol version 2 or 3. pgsql.nossl If set to 1 or true, disables SSL. passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library. Example Usage nmap -p 5432...

http-vuln-cve2012-1823 NSE Script

Detects PHP-CGI installations that are vulnerable to CVE-2012-1823, This critical vulnerability allows attackers to retrieve source code and execute code remotely. The script works by appending "?-s" to the uri to make vulnerable php-cgi handlers return colour syntax highlighted source. We use th...

dicom-ping NSE Script

Attempts to discover DICOM servers DICOM Service Provider through a partial C-ECHO request. It also detects if the server allows any called Application Entity Title or not. The script responds with the message "Called AET check enabled" when the association request is rejected due configuration...

broadcast-jenkins-discover NSE Script

Discovers Jenkins servers on a LAN by sending a discovery broadcast probe. For more information about Jenkins auto discovery, see: Script Arguments broadcast-jenkins.address address to which the probe packet is sent. default: 255.255.255.255 broadcast-jenkins.timeout socket timeout default: 5s...