Scripts
| ajp-auth |
Retrieves the authentication scheme and realm of an AJP service (Apache JServ Protocol) that requires authentication. |
| creds-summary |
Lists all discovered credentials (e.g. from brute force and default password checking scripts) at end of scan. |
| domcon-cmd |
Runs a console command on the Lotus Domino Console using the given authentication credentials (see also: domcon-brute) |
| domino-enum-users |
Attempts to discover valid IBM Lotus Domino users and download their ID files by exploiting the CVE-2006-5835 vulnerability. |
| ftp-anon |
Checks if an FTP server allows anonymous logins. |
| http-auth |
Retrieves the authentication scheme and realm of a web service that requires authentication. |
| http-barracuda-dir-traversal |
Attempts to retrieve the configuration settings from a Barracuda Networks Spam & Virus Firewall device using the directory traversal vulnerability described at http://seclists.org/fulldisclosure/2010/Oct/119. |
| http-config-backup |
Checks for backups and swap files of common content management system and web server configuration files. |
| http-default-accounts |
Tests for access with default credentials used by a variety of web applications and devices. |
| http-domino-enum-passwords |
Attempts to enumerate the hashed Domino Internet Passwords that are (by default) accessible by all authenticated users. This script can also download any Domino ID Files attached to the Person document. |
| http-method-tamper |
Attempts to bypass password protected resources (HTTP 401 status) by performing HTTP verb tampering. If an array of paths to check is not set, it will crawl the web server and perform the check against any password protected resource that it finds. |
| http-userdir-enum |
Attempts to enumerate valid usernames on web servers running with the mod_userdir module or similar enabled. |
| http-vuln-cve2010-0738 |
Tests whether a JBoss target is vulnerable to jmx console authentication bypass (CVE-2010-0738). |
| http-wordpress-enum |
Enumerates usernames in Wordpress blog/CMS installations by exploiting an information disclosure vulnerability existing in versions 2.6, 3.1, 3.1.1, 3.1.3 and 3.2-beta2 and possibly others. |
| informix-query |
Runs a query against IBM Informix Dynamic Server using the given authentication credentials (see also: informix-brute). |
| informix-tables |
Retrieves a list of tables and column definitions for each database on an Informix server. |
| krb5-enum-users |
Discovers valid usernames by brute force querying likely usernames against a Kerberos service. When an invalid username is requested the server will responde using the Kerberos error code KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN, allowing us to determine that the user name was invalid. Valid user names will illicit either the TGT in a AS-REP response or the error KRB5KDC_ERR_PREAUTH_REQUIRED, signaling that the user is required to perform pre authentication. |
| ms-sql-dump-hashes |
Dumps the password hashes from an MS-SQL server in a format suitable for cracking by tools such as John-the-ripper. In order to do so the user needs to have the appropriate DB privileges. |
| ms-sql-empty-password |
Attempts to authenticate to Microsoft SQL Servers using an empty password for the sysadmin (sa) account. |
| ms-sql-hasdbaccess |
Queries Microsoft SQL Server (ms-sql) instances for a list of databases a user has access to. |
| mysql-dump-hashes |
Dumps the password hashes from an MySQL server in a format suitable for cracking by tools such as John the Ripper. Appropriate DB privileges (root) are required. |
| mysql-empty-password |
Checks for MySQL servers with an empty password for |
| mysql-query |
Runs a query against a MySQL database and returns the results as a table. |
| mysql-users |
Attempts to list all users on a MySQL server. |
| ncp-enum-users |
Retrieves a list of all eDirectory users from the Novell NetWare Core Protocol (NCP) service. |
| netbus-auth-bypass |
Checks if a NetBus server is vulnerable to an authentication bypass vulnerability which allows full access without knowing the password. |
| oracle-enum-users |
Attempts to enumerate valid Oracle user names against unpatched Oracle 11g servers (this bug was fixed in Oracle's October 2009 Critical Patch Update). |
| realvnc-auth-bypass |
Checks if a VNC server is vulnerable to the RealVNC authentication bypass (CVE-2006-2369). |
| sip-enum-users |
Enumerates a SIP server's valid extensions (users). |
| smb-enum-users |
Attempts to enumerate the users on a remote Windows system, with as much
information as possible, through two different techniques (both over MSRPC,
which uses port 445 or 139; see |
| smtp-enum-users |
Attempts to enumerate the users on a SMTP server by issuing the VRFY, EXPN or RCPT TO commands. The goal of this script is to discover all the user accounts in the remote system. |
| snmp-win32-users |
Attempts to enumerate Windows user accounts through SNMP |
| x11-access |
Checks if you're allowed to connect to the X server. |