Script pop3-ntlm-info

Script types: portrule
Categories: default, discovery, safe

Script Summary

This script enumerates information from remote POP3 services with NTLM authentication enabled.

Sending a POP3 NTLM authentication request with null credentials will cause the remote service to respond with a NTLMSSP message disclosing information to include NetBIOS, DNS, and OS build version.

Script Arguments

smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername

See the documentation for the smbauth library.

Example Usage

nmap -p 110,995 --script pop3-ntlm-info <target>

Script Output

110/tcp   open     pop3
| pop3-ntlm-info:
|   Target_Name: ACTIVEPOP3
|   NetBIOS_Domain_Name: ACTIVEPOP3
|   NetBIOS_Computer_Name: POP3-TEST2
|   DNS_Domain_Name:
|   DNS_Computer_Name:
|   DNS_Tree_Name:
|_  Product_Version: 6.1.7601



  • Justin Cacak

License: Same as Nmap--See