Script `http-brute`

Script types: portrule
Categories: intrusive, brute
Download: https://svn.nmap.org/nmap/scripts/http-brute.nse

Script Summary

Performs brute force password auditing against http basic, digest and ntlm authentication.

This script uses the unpwdb and brute libraries to perform password guessing. Any successful guesses are stored in the nmap registry, using the creds library, for other scripts to use.

Script Arguments

http-brute.hostname: sets the host header in case of virtual hosting
http-brute.method: sets the HTTP method to use (default: GET)
http-brute.path: points to the path protected by authentication (default: /)
creds.[service], creds.global: See the documentation for the creds library.
smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername: See the documentation for the smbauth library.
passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb: See the documentation for the unpwdb library.
brute.credfile, brute.delay, brute.emptypass, brute.firstonly, brute.guesses, brute.mode, brute.passonly, brute.retries, brute.start, brute.threads, brute.unique, brute.useraspass: See the documentation for the brute library.
slaxml.debug: See the documentation for the slaxml library.
http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent: See the documentation for the http library.

Example Usage

nmap --script http-brute -p 80 <host>

Script Output

PORT     STATE SERVICE REASON
80/tcp   open  http    syn-ack
| http-brute:
|   Accounts:
|     user:user - Valid credentials
|_  Statistics: Performed 123 guesses in 1 seconds, average tps: 123

Requires

Authors:

Patrik Karlsson
Piotr Olma
Gyanendra Mishra