Performs password guessing against Apple Filing Protocol (AFP).

Performs brute force passwords auditing against the Apache JServ protocol. The Apache JServ Protocol is commonly used by web servers to communicate with back-end Java application server containers.

Performs brute force password auditing against the BackOrifice service. The backorifice-brute.ports script argument is mandatory (it specifies ports to run the script against).

Performs brute force password auditing against the Cassandra database.

Attempts to guess valid credentials for the Citrix PN Web Agent XML Service. The XML service authenticates against the local Windows server or the Active Directory.

Performs brute force password auditing against CVS pserver authentication.

Attempts to guess the name of the CVS repositories hosted on the remote server. With knowledge of the correct repository name, usernames and passwords can be guessed.

Performs brute force password auditing against the Lotus Domino Console.

Performs brute force password auditing against an iPhoto Library.

Performs password guessing against databases supporting the IBM DB2 protocol such as Informix, DB2 and Derby

Performs brute force password auditing against FTP servers.

Performs brute force password auditing against http basic authentication.

Performs brute force password auditing against http form-based authentication.

Performs brute force password auditing against Joomla web CMS installations.

Performs brute force password guessing against HTTP proxy servers.

performs brute force password auditing against Wordpress CMS/blog installations.

Performs brute force password auditing against the Asterisk IAX2 protocol. Guessing fails when a large number of attempts is made due to the maxcallnumber limit (default 2048). In case your getting "ERROR: Too many retries, aborted ..." after a while, this is most likely what's happening. In order to avoid this problem try: - reducing the size of your dictionary - use the brute delay option to introduce a delay between guesses - split the guessing up in chunks and wait for a while between them

Performs brute force password auditing against IMAP servers using either LOGIN, PLAIN, CRAM-MD5, DIGEST-MD5 or NTLM authentication.

Performs brute force password auditing against IBM Informix Dynamic Server.

Performs brute force password auditing against IRC (Internet Relay Chat) servers.

Performs brute force password auditing against IRC (Internet Relay Chat) servers supporting SASL authentication.

Performs brute force password auditing against iSCSI targets.

Attempts to brute-force LDAP authentication. By default it uses the built-in username and password lists. In order to use your own lists use the userdb and passdb script arguments.

Performs brute force password auditing against Couchbase Membase servers.

Performs brute force username and password auditing against Metasploit msgrpc interface.

Performs brute force password auditing against a Metasploit RPC server using the XMLRPC protocol.

Performs brute force password auditing against the RPA Tech Mobile Mouse servers.

Performs brute force password auditing against the MongoDB database.

Performs password guessing against Microsoft SQL Server (ms-sql). Works best in conjunction with the broadcast-ms-sql-discover script.

Performs password guessing against MySQL.

Performs valid user enumeration against MySQL server.

Performs brute force password auditing against a Nessus vulnerability scanning daemon using the NTP 1.2 protocol.

Performs brute force password auditing against a Nessus vulnerability scanning daemon using the XMLRPC protocol.

Performs brute force password auditing against the Netbus backdoor ("remote administration") service.

Performs brute force password auditing against a Nexpose vulnerability scanner using the API 1.1. By default it only tries three guesses per username to avoid target account lockout.

Performs brute force password auditing against an Nping Echo service.

Performs brute force password auditing against the OpenVAS manager using OMPv2.

Performs brute force password auditing against a OpenVAS vulnerability scanner daemon using the OTP 1.0 protocol.

Performs brute force password auditing against Oracle servers.

Exploits the CVE-2012-3137 vulnerability, a weakness in Oracle's O5LOGIN authentication scheme. The vulnerability exists in Oracle 11g R1/R2 and allows linking the session key to a password hash. When initiating an authentication attempt as a valid user the server will respond with a session key and salt. Once received the script will disconnect the connection thereby not recording the login attempt. The session key and salt can then be used to brute force the users password.

Guesses Oracle instance/SID names against the TNS-listener.

Performs brute force password auditing against the pcAnywhere remote access protocol.

Performs password guessing against PostgreSQL.

Tries to log into a POP3 account by guessing usernames and passwords.

Performs brute force passwords auditing against a Redis key-value store.

Performs brute force password auditing against the classic UNIX rexec (remote exec) service.

Performs brute force password auditing against the classic UNIX rlogin (remote login) service. This script must be run in privileged mode on UNIX because it must bind to a low source port number.

Performs brute force password auditing against the WinPcap Remote Capture Daemon (rpcap).

Performs brute force password auditing against the rsync remote file syncing protocol.

Attempts to enumerate RTSP media URLS by testing for common paths on devices such as surveillance IP cameras.

Performs brute force password auditing against Session Initiation Protocol (SIP - http://en.wikipedia.org/wiki/Session_Initiation_Protocol) accounts. This protocol is most commonly associated with VoIP sessions.

Attempts to guess username/password combinations over SMB, storing discovered combinations for use in other scripts. Every attempt will be made to get a valid list of users and to verify each username before actually using them. When a username is discovered, besides being printed, it is also saved in the Nmap registry so other Nmap scripts can use it. That means that if you're going to run smb-brute.nse, you should run other smb scripts you want. This checks passwords in a case-insensitive way, determining case after a password is found, for Windows versions before Vista.

Performs brute force password auditing against SMTP servers using either LOGIN, PLAIN, CRAM-MD5, DIGEST-MD5 or NTLM authentication.

Attempts to find an SNMP community string by brute force guessing.

Performs brute force password auditing against SOCKS 5 proxy servers.

Performs brute force password auditing against Subversion source code control servers.

Tries to get Telnet login credentials by guessing usernames and passwords.

Performs brute force password auditing against the VMWare Authentication Daemon (vmware-authd).

Performs brute force password auditing against VNC servers.

Performs brute force password auditing against XMPP (Jabber) instant messaging servers.