Script `nexpose-brute`

Script types: portrule
Categories: intrusive, brute
Download: https://svn.nmap.org/nmap/scripts/nexpose-brute.nse

Script Summary

Performs brute force password auditing against a Nexpose vulnerability scanner using the API 1.1.

As the Nexpose application enforces account lockout after 4 incorrect login attempts, the script performs only 3 guesses per default. This can be altered by supplying the brute.guesses argument a different value or 0 (zero) to guess the whole dictionary.

Script Arguments

creds.[service], creds.global: See the documentation for the creds library.
smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername: See the documentation for the smbauth library.
passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb: See the documentation for the unpwdb library.
brute.credfile, brute.delay, brute.emptypass, brute.firstonly, brute.guesses, brute.mode, brute.passonly, brute.retries, brute.start, brute.threads, brute.unique, brute.useraspass: See the documentation for the brute library.
slaxml.debug: See the documentation for the slaxml library.
http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent: See the documentation for the http library.

Example Usage

nmap --script nexpose-brute -p 3780 <ip>

Script Output

PORT     STATE SERVICE     REASON  VERSION
3780/tcp open  ssl/nexpose syn-ack NeXpose NSC 0.6.4
| nexpose-brute:
|   Accounts
|     nxadmin:nxadmin - Valid credentials
|   Statistics
|_    Performed 5 guesses in 1 seconds, average tps: 5

Requires

Author:

Vlatko Kosturjak