I'm running an Nmap brute force against metasploitable2 (telnet). The script is stopping on the first found username/password and is not iterating through the entire user/password file i have provided. I have tried using all appropriate args but no luck. Any ideas?

nmap -vv -p 23 --script telnet-brute --script-args userdb=users.txt,passdb=pw.txt --script-args telnet-brute.emptypass=true --script-args telnet-brute.firstonly=false TARGETIP

  • Could you try it this way and report back? nmap -p 23 --script telnet-brute --script-args userdb=users.txt,passdb=pw.txt,brute.emptypass=true,brute.firstonly=false <targetip> Dec 18, 2015 at 14:49
  • 1
    i think it's because any instance of firstonly causes the condition to be true. just leave it out. the default is to keep bruting
    – atdre
    Dec 18, 2015 at 18:33
  • @duckcake use @username to address people - they will get a notification when you do that
    – schroeder
    Dec 19, 2015 at 5:14
  • @GreatSeaSpider for some reason your command didn't return any positive results, even though the correct words were in the respective files. Dec 19, 2015 at 11:03
  • @atdre This is what i tried initially, but it didn't work, which is why i included the telnet-brute.firstonly=false arg. Dec 19, 2015 at 11:04

1 Answer 1


Solution found. --script-args can only be called once, contrary to the documentation at: https://nmap.org/nsedoc/scripts/telnet-brute.html.

The successful command is:
nmap -d -vv -p 23 --script telnet-brute --script-args "userdb=users.txt,passdb=pass.txt,telnet-brute.emptypass=true,telnet-brute.firstonly=false" TARGETIP

Thanks for your help @GreatSeaSpider, @atdre, @schroeder

  • Thanks for pointing this out. Fixed the documentation in r35530, should propagate to the web docs shortly. Dec 19, 2015 at 15:27
  • Also want to point out: --script-args-file is a handy way to deal with long or complicated arguments, especially since it removes the need to quote stuff for the shell and lets you use newlines instead of commas to separate args. Dec 19, 2015 at 15:30
  • awesome, trying --script-args-file now. Dec 20, 2015 at 2:24
  • @bonsaiviking. I think may have found another issue. The args are all being passed correctly but telnet-brute is only brute forcing the first 2 correct instances. Is there a way of making it brute force all instances? Dec 20, 2015 at 2:29
  • It shouldn't be doing that. Are you using Nmap 7.01? telnet-brute got an overhaul recently. If so, we can take a look at your logs with -d3 --script-trace to determine the reason. #nmap on freenode IRC or [email protected] Dec 20, 2015 at 4:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .