Script citrix-brute-xml

Script types: portrule
Categories: intrusive, brute
Download: https://svn.nmap.org/nmap/scripts/citrix-brute-xml.nse

Script Summary

Attempts to guess valid credentials for the Citrix PN Web Agent XML Service. The XML service authenticates against the local Windows server or the Active Directory.

This script makes no attempt of preventing account lockout. If the password list contains more passwords than the lockout-threshold accounts will be locked.

Script Arguments

slaxml.debug

See the documentation for the slaxml library.

http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent

See the documentation for the http library.

passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb

See the documentation for the unpwdb library.

smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername

See the documentation for the smbauth library.

Example Usage

nmap --script=citrix-brute-xml --script-args=userdb=<userdb>,passdb=<passdb>,ntdomain=<domain> -p 80,443,8080 <host>

Script Output

PORT     STATE SERVICE    REASON
8080/tcp open  http-proxy syn-ack
| citrix-brute-xml:
|   Joe:password => Must change password at next logon
|   Luke:summer => Login was successful
|_  Jane:secret => Account is disabled

Requires


Author:

  • Patrik Karlsson

License: Same as Nmap--See https://nmap.org/book/man-legal.html