File http-form-brute
Script types:
portrule
Categories:
intrusive, brute
Download: http://nmap.org/svn/scripts/http-form-brute.nse
User Summary
Performs brute force password auditing against http form-based authentication.
Script Arguments
http-form-brute.path
points to the path protected by authentication
http-form-brute.onfailure
(optional) sets the message to expect on unsuccessful authentication
http-form-brute.passvar
sets the http-variable name that holds the password used to authenticate. A simple autodetection of this variable is attempted.
http-form-brute.onsuccess
(optional) sets the message to expect on successful authentication
http-form-brute.uservar
(optional) sets the http-variable name that holds the username used to authenticate. A simple autodetection of this variable is attempted.
http-form-brute.hostname
sets the host header in case of virtual hosting
passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb
See the documentation for the unpwdb library.smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername
See the documentation for the smbauth library.http.max-cache-size, http.max-pipeline, http.pipeline, http.useragent
See the documentation for the http library.Example Usage
nmap --script http-form-brute -p 80 <host> This script uses the unpwdb and brute libraries to perform password guessing. Any successful guesses are stored in the nmap registry, under the nmap.registry.credentials.http key for other scripts to use. The script automatically attempts to discover the form field names to use in order to perform password guessing. If it fails doing so the form parameters can be supplied using the uservar and passvar arguments. After attempting to authenticate using a HTTP POST request the script analyzes the response and attempt to determine whether authentication was successful or not. The script analyzes this by checking the response using the following rules: 1. If the response was empty the authentication was successful 2. If the response contains the message passed in the onsuccess argument the authentication was successful 3. If no onsuccess argument was passed, and if the response does not contain the message passed in the onfailure argument the authentication was successful 4. If neither the onsuccess or onfailure argument was passed and the response does not contain a password form field authentication was successful 5. Authentication failed
Script Output
PORT STATE SERVICE REASON
80/tcp open http syn-ack
| http-brute:
| Accounts
| Patrik Karlsson:secret => Login correct
| Statistics
|_ Perfomed 60023 guesses in 467 seconds, average tps: 138
Summary
-------
x The Driver class contains the driver implementation used by the brute
library
Requires
Author: Patrik Karlsson
License: Same as Nmap--See http://nmap.org/book/man-legal.html