Script broadcast-upnp-info

Script types: prerule
Categories: broadcast, safe
Download: https://svn.nmap.org/nmap/scripts/broadcast-upnp-info.nse

Script Summary

Attempts to extract system information from the UPnP service by sending a multicast query, then collecting, parsing, and displaying all responses.

Script Arguments

slaxml.debug

See the documentation for the slaxml library.

http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent

See the documentation for the http library.

max-newtargets, newtargets

See the documentation for the target library.

smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername

See the documentation for the smbauth library.

Example Usage

nmap -sV --script=broadcast-upnp-info <target>

Script Output 

| broadcast-upnp-info:
|   1.2.3.50
|       Debian/4.0 DLNADOC/1.50 UPnP/1.0 MiniDLNA/1.0
|       Location:  http://1.2.3.50:8200/rootDesc.xml
|       Webserver:  Debian/4.0 DLNADOC/1.50 UPnP/1.0 MiniDLNA/1.0
|       Name: BUBBA|TWO DLNA Server
|       Manufacturer: Justin Maggard
|       Model Descr: MiniDLNA on Debian
|       Model Name: Windows Media Connect compatible (MiniDLNA)
|       Model Version: 1
|   1.2.3.114
|       Linux/2.6 UPnP/1.0 KDL-32EX701/1.7
|       Location:  http://1.2.3.114:52323/dmr.xml
|       Webserver:  Linux/2.6 UPnP/1.0 KDL-32EX701/1.7
|       Name: BRAVIA KDL-32EX701
|       Manufacturer: Sony Corporation
|_      Model Name: KDL-32EX701

Requires

Author:

  • Patrik Karlsson

License: Same as Nmap--See https://nmap.org/book/man-legal.html

action

action (host, port)

Sends UPnP discovery packet to host, and extracts service information from results

Parameters

host
 
port