Script `citrix-brute-xml`

Script types: portrule
Categories: intrusive, brute
Download: https://svn.nmap.org/nmap/scripts/citrix-brute-xml.nse

Script Summary

Attempts to guess valid credentials for the Citrix PN Web Agent XML Service. The XML service authenticates against the local Windows server or the Active Directory.

This script makes no attempt of preventing account lockout. If the password list contains more passwords than the lockout-threshold accounts will be locked.

Script Arguments

slaxml.debug: See the documentation for the slaxml library.
http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent: See the documentation for the http library.
passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb: See the documentation for the unpwdb library.
smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername: See the documentation for the smbauth library.

Example Usage

nmap --script=citrix-brute-xml --script-args=userdb=<userdb>,passdb=<passdb>,ntdomain=<domain> -p 80,443,8080 <host>

Script Output

PORT     STATE SERVICE    REASON
8080/tcp open  http-proxy syn-ack
| citrix-brute-xml:
|   Joe:password => Must change password at next logon
|   Luke:summer => Login was successful
|_  Jane:secret => Account is disabled

Requires

Author:

Patrik Karlsson