You have essentially 2 questions here:
- Why am I not getting good results?
- What script arguments can I use to improve my results?
The most likely reason you're not getting good results for the http-default-accounts
script is that there are not that many systems on the Internet with default accounts that the script knows about. 5000 addresses may seem like a lot, but it's only 0.00012% of the routable Internet. Your chances would be greatly increased if you limited your scan to lists of addresses known to be active. Also, if you know of some default accounts that the script doesn't cover, adding those to the fingerprints file (and submitting to the Nmap Project) will help catch more of those systems.
Scripts inherit script arguments from the libraries they use. You can find the list of arguments and library arguments for a script on the NSEdoc portal. Here's how to find them for your particular script.
First, get the URL to the documentation by running nmap --script-help your-script-name
:
$ nmap --script-help http-default-accounts
Starting Nmap 7.50 ( https://nmap.org ) at 2017-07-11 09:05 CDT
http-default-accounts
Categories: discovery auth intrusive
https://nmap.org/nsedoc/scripts/http-default-accounts.html
Tests for access with default credentials used by a variety of web applications and devices.
<snip>
That URL below the Categories:
line links to the NSEdoc page for http-default-accounts. There, under the Script Arguments header you can see the list of arguments the script supports.
A quick review of those arguments shows that they are mostly concerned with limiting or changing the scope of the test:
http-default-accounts.category
- limit tests to only this category instead of trying all of them.
http-default-accounts.fingerprintfile
- Use a different fingerprint file, if you wrote one yourself.
http-default-accounts.basepath
- Check for web apps installed in a different base URI. Not useful for broad scanning like this.
The arguments inherited from the http
library are mostly for tuning performance, though http.useragent
can be set to avoid announcing that you are scanning with NSE. The other libraries (creds
, smbauth
) are not really relevant here, since they are used to pass credentials in to scripts to use, and this script uses its own list instead.
You asked in a comment on a different answer whether there is a way to specify the list of usernames and passwords. There is not, for http-default-accounts
, because that uses the default usernames and passwords for various applications. You may instead want http-brute
or http-form-brute
, to test various forms of web authentication for a specific list of usernames and passwords.