Script http-brute

Script types: portrule
Categories: intrusive, brute
Download: https://svn.nmap.org/nmap/scripts/http-brute.nse

Script Summary

Performs brute force password auditing against http basic, digest and ntlm authentication.

This script uses the unpwdb and brute libraries to perform password guessing. Any successful guesses are stored in the nmap registry, using the creds library, for other scripts to use.

Script Arguments

http-brute.hostname

sets the host header in case of virtual hosting

http-brute.method

sets the HTTP method to use (default: GET)

http-brute.path

points to the path protected by authentication (default: /)

creds.[service], creds.global

See the documentation for the creds library.

smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername

See the documentation for the smbauth library.

passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb

See the documentation for the unpwdb library.

brute.credfile, brute.delay, brute.emptypass, brute.firstonly, brute.guesses, brute.mode, brute.passonly, brute.retries, brute.start, brute.threads, brute.unique, brute.useraspass

See the documentation for the brute library.

slaxml.debug

See the documentation for the slaxml library.

http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent

See the documentation for the http library.

Example Usage

nmap --script http-brute -p 80 <host>

Script Output

PORT     STATE SERVICE REASON
80/tcp   open  http    syn-ack
| http-brute:
|   Accounts:
|     user:user - Valid credentials
|_  Statistics: Performed 123 guesses in 1 seconds, average tps: 123

Requires


Authors:

  • Patrik Karlsson
  • Piotr Olma
  • Gyanendra Mishra

License: Same as Nmap--See https://nmap.org/book/man-legal.html