Skip to content

nmap scripts

lethanhtung01011980 edited this page Oct 26, 2019 · 5 revisions

ls -1 /usr/share/nmap/scripts

  1. acarsd-info.nse
  2. address-info.nse
  3. afp-brute.nse
  4. afp-ls.nse
  5. afp-path-vuln.nse
  6. afp-serverinfo.nse
  7. afp-showmount.nse
  8. ajp-auth.nse
  9. ajp-brute.nse
  10. ajp-headers.nse
  11. ajp-methods.nse
  12. ajp-request.nse
  13. allseeingeye-info.nse
  14. amqp-info.nse
  15. asn-query.nse
  16. auth-owners.nse
  17. auth-spoof.nse
  18. backorifice-brute.nse
  19. backorifice-info.nse
  20. bacnet-info.nse
  21. banner.nse
  22. bitcoin-getaddr.nse
  23. bitcoin-info.nse
  24. bitcoinrpc-info.nse
  25. bittorrent-discovery.nse
  26. bjnp-discover.nse
  27. broadcast-ataoe-discover.nse
  28. broadcast-avahi-dos.nse
  29. broadcast-bjnp-discover.nse
  30. broadcast-db2-discover.nse
  31. broadcast-dhcp6-discover.nse
  32. broadcast-dhcp-discover.nse
  33. broadcast-dns-service-discovery.nse
  34. broadcast-dropbox-listener.nse
  35. broadcast-eigrp-discovery.nse
  36. broadcast-igmp-discovery.nse
  37. broadcast-listener.nse
  38. broadcast-ms-sql-discover.nse
  39. broadcast-netbios-master-browser.nse
  40. broadcast-networker-discover.nse
  41. broadcast-novell-locate.nse
  42. broadcast-ospf2-discover.nse
  43. broadcast-pc-anywhere.nse
  44. broadcast-pc-duo.nse
  45. broadcast-pim-discovery.nse
  46. broadcast-ping.nse
  47. broadcast-pppoe-discover.nse
  48. broadcast-rip-discover.nse
  49. broadcast-ripng-discover.nse
  50. broadcast-sonicwall-discover.nse
  51. broadcast-sybase-asa-discover.nse
  52. broadcast-tellstick-discover.nse
  53. broadcast-upnp-info.nse
  54. broadcast-versant-locate.nse
  55. broadcast-wake-on-lan.nse
  56. broadcast-wpad-discover.nse
  57. broadcast-wsdd-discover.nse
  58. broadcast-xdmcp-discover.nse
  59. cassandra-brute.nse
  60. cassandra-info.nse
  61. cccam-version.nse
  62. cics-enum.nse
  63. cics-info.nse
  64. cics-user-brute.nse
  65. cics-user-enum.nse
  66. citrix-brute-xml.nse
  67. citrix-enum-apps.nse
  68. citrix-enum-apps-xml.nse
  69. citrix-enum-servers.nse
  70. citrix-enum-servers-xml.nse
  71. clamav-exec.nse
  72. clock-skew.nse
  73. coap-resources.nse
  74. couchdb-databases.nse
  75. couchdb-stats.nse
  76. creds-summary.nse
  77. cups-info.nse
  78. cups-queue-info.nse
  79. cvs-brute.nse
  80. cvs-brute-repository.nse
  81. daap-get-library.nse
  82. daytime.nse
  83. db2-das-info.nse
  84. deluge-rpc-brute.nse
  85. dhcp-discover.nse
  86. dict-info.nse
  87. distcc-cve2004-2687.nse
  88. dns-blacklist.nse
  89. dns-brute.nse
  90. dns-cache-snoop.nse
  91. dns-check-zone.nse
  92. dns-client-subnet-scan.nse
  93. dns-fuzz.nse
  94. dns-ip6-arpa-scan.nse
  95. dns-nsec3-enum.nse
  96. dns-nsec-enum.nse
  97. dns-nsid.nse
  98. dns-random-srcport.nse
  99. dns-random-txid.nse
  100. dns-recursion.nse
  101. dns-service-discovery.nse
  102. dns-srv-enum.nse
  103. dns-update.nse
  104. dns-zeustracker.nse
  105. dns-zone-transfer.nse
  106. docker-version.nse
  107. domcon-brute.nse
  108. domcon-cmd.nse
  109. domino-enum-users.nse
  110. dpap-brute.nse
  111. drda-brute.nse
  112. drda-info.nse
  113. duplicates.nse
  114. eap-info.nse
  115. enip-info.nse
  116. epmd-info.nse
  117. eppc-enum-processes.nse
  118. fcrdns.nse
  119. finger.nse
  120. fingerprint-strings.nse
  121. firewalk.nse
  122. firewall-bypass.nse
  123. flume-master-info.nse
  124. fox-info.nse
  125. freelancer-info.nse
  126. ftp-anon.nse
  127. ftp-bounce.nse
  128. ftp-brute.nse
  129. ftp-libopie.nse
  130. ftp-proftpd-backdoor.nse
  131. ftp-syst.nse
  132. ftp-vsftpd-backdoor.nse
  133. ftp-vuln-cve2010-4221.nse
  134. ganglia-info.nse
  135. giop-info.nse
  136. gkrellm-info.nse
  137. gopher-ls.nse
  138. gpsd-info.nse
  139. hadoop-datanode-info.nse
  140. hadoop-jobtracker-info.nse
  141. hadoop-namenode-info.nse
  142. hadoop-secondary-namenode-info.nse
  143. hadoop-tasktracker-info.nse
  144. hbase-master-info.nse
  145. hbase-region-info.nse
  146. hddtemp-info.nse
  147. hnap-info.nse
  148. hostmap-bfk.nse
  149. hostmap-crtsh.nse
  150. hostmap-ip2hosts.nse
  151. hostmap-robtex.nse
  152. http-adobe-coldfusion-apsa1301.nse
  153. http-affiliate-id.nse
  154. http-apache-negotiation.nse
  155. http-apache-server-status.nse
  156. http-aspnet-debug.nse
  157. http-auth-finder.nse
  158. http-auth.nse
  159. http-avaya-ipoffice-users.nse
  160. http-awstatstotals-exec.nse
  161. http-axis2-dir-traversal.nse
  162. http-backup-finder.nse
  163. http-barracuda-dir-traversal.nse
  164. http-bigip-cookie.nse
  165. http-brute.nse
  166. http-cakephp-version.nse
  167. http-chrono.nse
  168. http-cisco-anyconnect.nse
  169. http-coldfusion-subzero.nse
  170. http-comments-displayer.nse
  171. http-config-backup.nse
  172. http-cookie-flags.nse
  173. http-cors.nse
  174. http-cross-domain-policy.nse
  175. http-csrf.nse
  176. http-date.nse
  177. http-default-accounts.nse
  178. http-devframework.nse
  179. http-dlink-backdoor.nse
  180. http-dombased-xss.nse
  181. http-domino-enum-passwords.nse
  182. http-drupal-enum.nse
  183. http-drupal-enum-users.nse
  184. http-enum.nse
  185. http-errors.nse
  186. http-exif-spider.nse
  187. http-favicon.nse
  188. http-feed.nse
  189. http-fetch.nse
  190. http-fileupload-exploiter.nse
  191. http-form-brute.nse
  192. http-form-fuzzer.nse
  193. http-frontpage-login.nse
  194. http-generator.nse
  195. http-git.nse
  196. http-gitweb-projects-enum.nse
  197. http-google-malware.nse
  198. http-grep.nse
  199. http-headers.nse
  200. http-huawei-hg5xx-vuln.nse
  201. http-icloud-findmyiphone.nse
  202. http-icloud-sendmsg.nse
  203. http-iis-short-name-brute.nse
  204. http-iis-webdav-vuln.nse
  205. http-internal-ip-disclosure.nse
  206. http-joomla-brute.nse
  207. http-jsonp-detection.nse
  208. http-litespeed-sourcecode-download.nse
  209. http-ls.nse
  210. http-majordomo2-dir-traversal.nse
  211. http-malware-host.nse
  212. http-mcmp.nse
  213. http-methods.nse
  214. http-method-tamper.nse
  215. http-mobileversion-checker.nse
  216. http-ntlm-info.nse
  217. http-open-proxy.nse
  218. http-open-redirect.nse
  219. http-passwd.nse
  220. http-phpmyadmin-dir-traversal.nse
  221. http-phpself-xss.nse
  222. http-php-version.nse
  223. http-proxy-brute.nse
  224. http-put.nse
  225. http-qnap-nas-info.nse
  226. http-referer-checker.nse
  227. http-rfi-spider.nse
  228. http-robots.txt.nse
  229. http-robtex-reverse-ip.nse
  230. http-robtex-shared-ns.nse
  231. http-security-headers.nse
  232. http-server-header.nse
  233. http-shellshock.nse
  234. http-sitemap-generator.nse
  235. http-slowloris-check.nse
  236. http-slowloris.nse
  237. http-sql-injection.nse
  238. http-stored-xss.nse
  239. http-svn-enum.nse
  240. http-svn-info.nse
  241. http-title.nse
  242. http-tplink-dir-traversal.nse
  243. http-trace.nse
  244. http-traceroute.nse
  245. http-trane-info.nse
  246. http-unsafe-output-escaping.nse
  247. http-useragent-tester.nse
  248. http-userdir-enum.nse
  249. http-vhosts.nse
  250. http-virustotal.nse
  251. http-vlcstreamer-ls.nse
  252. http-vmware-path-vuln.nse
  253. http-vuln-cve2006-3392.nse
  254. http-vuln-cve2009-3960.nse
  255. http-vuln-cve2010-0738.nse
  256. http-vuln-cve2010-2861.nse
  257. http-vuln-cve2011-3192.nse
  258. http-vuln-cve2011-3368.nse
  259. http-vuln-cve2012-1823.nse
  260. http-vuln-cve2013-0156.nse
  261. http-vuln-cve2013-6786.nse
  262. http-vuln-cve2013-7091.nse
  263. http-vuln-cve2014-2126.nse
  264. http-vuln-cve2014-2127.nse
  265. http-vuln-cve2014-2128.nse
  266. http-vuln-cve2014-2129.nse
  267. http-vuln-cve2014-3704.nse
  268. http-vuln-cve2014-8877.nse
  269. http-vuln-cve2015-1427.nse
  270. http-vuln-cve2015-1635.nse
  271. http-vuln-cve2017-1001000.nse
  272. http-vuln-cve2017-5638.nse
  273. http-vuln-cve2017-5689.nse
  274. http-vuln-cve2017-8917.nse
  275. http-vuln-misfortune-cookie.nse
  276. http-vuln-wnr1000-creds.nse
  277. http-waf-detect.nse
  278. http-waf-fingerprint.nse
  279. http-webdav-scan.nse
  280. http-wordpress-brute.nse
  281. http-wordpress-enum.nse
  282. http-wordpress-users.nse
  283. http-xssed.nse
  284. iax2-brute.nse
  285. iax2-version.nse
  286. icap-info.nse
  287. iec-identify.nse
  288. ike-version.nse
  289. imap-brute.nse
  290. imap-capabilities.nse
  291. imap-ntlm-info.nse
  292. impress-remote-discover.nse
  293. informix-brute.nse
  294. informix-query.nse
  295. informix-tables.nse
  296. ip-forwarding.nse
  297. ip-geolocation-geoplugin.nse
  298. ip-geolocation-ipinfodb.nse
  299. ip-geolocation-map-bing.nse
  300. ip-geolocation-map-google.nse
  301. ip-geolocation-map-kml.nse
  302. ip-geolocation-maxmind.nse
  303. ip-https-discover.nse
  304. ipidseq.nse
  305. ipmi-brute.nse
  306. ipmi-cipher-zero.nse
  307. ipmi-version.nse
  308. ipv6-multicast-mld-list.nse
  309. ipv6-node-info.nse
  310. ipv6-ra-flood.nse
  311. irc-botnet-channels.nse
  312. irc-brute.nse
  313. irc-info.nse
  314. irc-sasl-brute.nse
  315. irc-unrealircd-backdoor.nse
  316. iscsi-brute.nse
  317. iscsi-info.nse
  318. isns-info.nse
  319. jdwp-exec.nse
  320. jdwp-info.nse
  321. jdwp-inject.nse
  322. jdwp-version.nse
  323. knx-gateway-discover.nse
  324. knx-gateway-info.nse
  325. krb5-enum-users.nse
  326. ldap-brute.nse
  327. ldap-novell-getpass.nse
  328. ldap-rootdse.nse
  329. ldap-search.nse
  330. lexmark-config.nse
  331. llmnr-resolve.nse
  332. lltd-discovery.nse
  333. maxdb-info.nse
  334. mcafee-epo-agent.nse
  335. membase-brute.nse
  336. membase-http-info.nse
  337. memcached-info.nse
  338. metasploit-info.nse
  339. metasploit-msgrpc-brute.nse
  340. metasploit-xmlrpc-brute.nse
  341. mikrotik-routeros-brute.nse
  342. mmouse-brute.nse
  343. mmouse-exec.nse
  344. modbus-discover.nse
  345. mongodb-brute.nse
  346. mongodb-databases.nse
  347. mongodb-info.nse
  348. mqtt-subscribe.nse
  349. mrinfo.nse
  350. msrpc-enum.nse
  351. ms-sql-brute.nse
  352. ms-sql-config.nse
  353. ms-sql-dac.nse
  354. ms-sql-dump-hashes.nse
  355. ms-sql-empty-password.nse
  356. ms-sql-hasdbaccess.nse
  357. ms-sql-info.nse
  358. ms-sql-ntlm-info.nse
  359. ms-sql-query.nse
  360. ms-sql-tables.nse
  361. ms-sql-xp-cmdshell.nse
  362. mtrace.nse
  363. murmur-version.nse
  364. mysql-audit.nse
  365. mysql-brute.nse
  366. mysql-databases.nse
  367. mysql-dump-hashes.nse
  368. mysql-empty-password.nse
  369. mysql-enum.nse
  370. mysql-info.nse
  371. mysql-query.nse
  372. mysql-users.nse
  373. mysql-variables.nse
  374. mysql-vuln-cve2012-2122.nse
  375. nat-pmp-info.nse
  376. nat-pmp-mapport.nse
  377. nbd-info.nse
  378. nbstat.nse
  379. ncp-enum-users.nse
  380. ncp-serverinfo.nse
  381. ndmp-fs-info.nse
  382. ndmp-version.nse
  383. nessus-brute.nse
  384. nessus-xmlrpc-brute.nse
  385. netbus-auth-bypass.nse
  386. netbus-brute.nse
  387. netbus-info.nse
  388. netbus-version.nse
  389. nexpose-brute.nse
  390. nfs-ls.nse
  391. nfs-showmount.nse
  392. nfs-statfs.nse
  393. nje-node-brute.nse
  394. nje-pass-brute.nse
  395. nntp-ntlm-info.nse
  396. nping-brute.nse
  397. nrpe-enum.nse
  398. ntp-info.nse
  399. ntp-monlist.nse
  400. omp2-brute.nse
  401. omp2-enum-targets.nse
  402. omron-info.nse
  403. openlookup-info.nse
  404. openvas-otp-brute.nse
  405. openwebnet-discovery.nse
  406. oracle-brute.nse
  407. oracle-brute-stealth.nse
  408. oracle-enum-users.nse
  409. oracle-sid-brute.nse
  410. oracle-tns-version.nse
  411. ovs-agent-version.nse
  412. p2p-conficker.nse
  413. path-mtu.nse
  414. pcanywhere-brute.nse
  415. pcworx-info.nse
  416. pgsql-brute.nse
  417. pjl-ready-message.nse
  418. pop3-brute.nse
  419. pop3-capabilities.nse
  420. pop3-ntlm-info.nse
  421. pptp-version.nse
  422. puppet-naivesigning.nse
  423. qconn-exec.nse
  424. qscan.nse
  425. quake1-info.nse
  426. quake3-info.nse
  427. quake3-master-getservers.nse
  428. rdp-enum-encryption.nse
  429. rdp-vuln-ms12-020.nse
  430. realvnc-auth-bypass.nse
  431. redis-brute.nse
  432. redis-info.nse
  433. resolveall.nse
  434. reverse-index.nse
  435. rexec-brute.nse
  436. rfc868-time.nse
  437. riak-http-info.nse
  438. rlogin-brute.nse
  439. rmi-dumpregistry.nse
  440. rmi-vuln-classloader.nse
  441. rpcap-brute.nse
  442. rpcap-info.nse
  443. rpc-grind.nse
  444. rpcinfo.nse
  445. rsa-vuln-roca.nse
  446. rsync-brute.nse
  447. rsync-list-modules.nse
  448. rtsp-methods.nse
  449. rtsp-url-brute.nse
  450. rusers.nse
  451. s7-info.nse
  452. samba-vuln-cve-2012-1182.nse
  453. script.db
  454. servicetags.nse
  455. shodan-api.nse
  456. sip-brute.nse
  457. sip-call-spoof.nse
  458. sip-enum-users.nse
  459. sip-methods.nse
  460. skypev2-version.nse
  461. smb2-capabilities.nse
  462. smb2-security-mode.nse
  463. smb2-time.nse
  464. smb2-vuln-uptime.nse
  465. smb-brute.nse
  466. smb-double-pulsar-backdoor.nse
  467. smb-enum-domains.nse
  468. smb-enum-groups.nse
  469. smb-enum-processes.nse
  470. smb-enum-services.nse
  471. smb-enum-sessions.nse
  472. smb-enum-shares.nse
  473. smb-enum-users.nse
  474. smb-flood.nse
  475. smb-ls.nse
  476. smb-mbenum.nse
  477. smb-os-discovery.nse
  478. smb-print-text.nse
  479. smb-protocols.nse
  480. smb-psexec.nse
  481. smb-security-mode.nse
  482. smb-server-stats.nse
  483. smb-system-info.nse
  484. smb-vuln-conficker.nse
  485. smb-vuln-cve2009-3103.nse
  486. smb-vuln-cve-2017-7494.nse
  487. smb-vuln-ms06-025.nse
  488. smb-vuln-ms07-029.nse
  489. smb-vuln-ms08-067.nse
  490. smb-vuln-ms10-054.nse
  491. smb-vuln-ms10-061.nse
  492. smb-vuln-ms17-010.nse
  493. smb-vuln-regsvc-dos.nse
  494. smtp-brute.nse
  495. smtp-commands.nse
  496. smtp-enum-users.nse
  497. smtp-ntlm-info.nse
  498. smtp-open-relay.nse
  499. smtp-strangeport.nse
  500. smtp-vuln-cve2010-4344.nse
  501. smtp-vuln-cve2011-1720.nse
  502. smtp-vuln-cve2011-1764.nse
  503. sniffer-detect.nse
  504. snmp-brute.nse
  505. snmp-hh3c-logins.nse
  506. snmp-info.nse
  507. snmp-interfaces.nse
  508. snmp-ios-config.nse
  509. snmp-netstat.nse
  510. snmp-processes.nse
  511. snmp-sysdescr.nse
  512. snmp-win32-services.nse
  513. snmp-win32-shares.nse
  514. snmp-win32-software.nse
  515. snmp-win32-users.nse
  516. socks-auth-info.nse
  517. socks-brute.nse
  518. socks-open-proxy.nse
  519. ssh2-enum-algos.nse
  520. ssh-auth-methods.nse
  521. ssh-brute.nse
  522. ssh-hostkey.nse
  523. ssh-publickey-acceptance.nse
  524. ssh-run.nse
  525. sshv1.nse
  526. ssl-ccs-injection.nse
  527. ssl-cert-intaddr.nse
  528. ssl-cert.nse
  529. ssl-date.nse
  530. ssl-dh-params.nse
  531. ssl-enum-ciphers.nse
  532. ssl-heartbleed.nse
  533. ssl-known-key.nse
  534. ssl-poodle.nse
  535. sslv2-drown.nse
  536. sslv2.nse
  537. sstp-discover.nse
  538. stun-info.nse
  539. stun-version.nse
  540. stuxnet-detect.nse
  541. supermicro-ipmi-conf.nse
  542. svn-brute.nse
  543. targets-asn.nse
  544. targets-ipv6-map4to6.nse
  545. targets-ipv6-multicast-echo.nse
  546. targets-ipv6-multicast-invalid-dst.nse
  547. targets-ipv6-multicast-mld.nse
  548. targets-ipv6-multicast-slaac.nse
  549. targets-ipv6-wordlist.nse
  550. targets-sniffer.nse
  551. targets-traceroute.nse
  552. targets-xml.nse
  553. teamspeak2-version.nse
  554. telnet-brute.nse
  555. telnet-encryption.nse
  556. telnet-ntlm-info.nse
  557. tftp-enum.nse
  558. tls-alpn.nse
  559. tls-nextprotoneg.nse
  560. tls-ticketbleed.nse
  561. tn3270-screen.nse
  562. tor-consensus-checker.nse
  563. traceroute-geolocation.nse
  564. tso-brute.nse
  565. tso-enum.nse
  566. unittest.nse
  567. unusual-port.nse
  568. upnp-info.nse
  569. url-snarf.nse
  570. ventrilo-info.nse
  571. versant-info.nse
  572. vmauthd-brute.nse
  573. vmware-version.nse
  574. vnc-brute.nse
  575. vnc-info.nse
  576. vnc-title.nse
  577. voldemort-info.nse
  578. vtam-enum.nse
  579. vulners.nse
  580. vuze-dht-info.nse
  581. wdb-version.nse
  582. weblogic-t3-info.nse
  583. whois-domain.nse
  584. whois-ip.nse
  585. wsdd-discover.nse
  586. x11-access.nse
  587. xdmcp-discover.nse
  588. xmlrpc-methods.nse
  589. xmpp-brute.nse
  590. xmpp-info.nse

Sidebar

0. COMMON exploits

1. Scan Info

1.2 Passive Gathering

1.3 Active Gathering

2. Pre-attack

2.2 File transfer

3. Get Reverse Shell

4. Exploits

4.2 Windows Exploits

4.3 Linux Exploits

4.4 Password crack

4.5 Buffer Overflow

4.6 Web attacks

6. Escalate Privilege

6.1 Escalate in Windows

6.2 Escalate in Linux

7. Access and further attacks

8. Port redirection and Tunnelling

9. Metasploit

10. Kali

11. Thirdparty scripts

Clone this wiki locally