Nmap http-brute - Supplying arguments for bruting via GET

Question

I'm attempting to brute a site in my test lab with Nmap's http-brute nse, which has the URL structure https://192.168.101.6/api/[email protected]&password=pass

Unfortunately Nmap's official documentation (https://nmap.org/nsedoc/scripts/http-brute.html) has no information on how to supply arguments such as the email and password fields.

I'm aiming to supply my request as follows (where $1 is the email variable and $2 is the password variable):
https://192.168.101.6/api/auth?email=$1&password=$2
Note: $1 should load my email dictionary emails.txt and $2 should load my password list pass.txt

Is this possible with Nmap's http-brute NSE? Or would i need to use another tool such as burp or hydra?

Answer 1

The http-brute script documentation states that it performs "brute force password auditing against http basic, digest and ntlm authentication." These are HTTP authentication methods, but what you are looking for is form-based authentication.

The http-form-brute script does what you want. You can use the uservar and passvar script-args to tell it which variables to send, but if you are using a version of the script since r35542 (2015-12-31), then it should be able to auto-detect the form on the page you want to brute-force. Read the docs carefully, since you may need some of the other arguments like http-form-brute.method. The online docs always refer to the current development snapshot, but you can get the docs for the version of the script you have by running nmap --script-help http-form-brute.

Answer 2

I fired up Zenmap, pulled up the listing for the http-brute script, and plugged in the address, user cred file, and password cred file in the appropriate GUI fields to produce command line arguments for them. The command line string that Zenmap output for me:

[initial output from Zenmap was here, and was incorrect because of the way in which I selected some arguments to be input. A lesson about tools not making up for mistakes in human skill. Anyways, it's still a good tool.]

Note: I haven't actually tested the above formulation against any targets to see that it actually works. I'm away my test environment, but just happen to have nmap & Zenmap installed on pretty much every single device I own that a version exists for. :)

Really, I'd quite recommend Zenmap as a tool for learning about nmap usage in general, but particularly when it comes to discovering, selecting, and using scripts well. To be honest, in fact, when I started using Zenmap I found it so helpful in building scans with complex qualities (especially with, but not limited to, scripts) that I eventually became a little spoiled by it and lost a bit of sharpness in using the command line. Still, as another non-expert attempting to upgrade my skills I've found it exceedingly useful. (Of course, YMMV.)

Answer 3

Thanks @bonsaiviking for all of your help.

A more in-depth analysis of the --script-trace revealed the primary issues were the user-agent and brute.emptypass=true. Also, since the first pass of the script supplies bogus creds i needed to use a string that matched when a bogus username was supplied aswell a string match on the correct username ("error").

Successful command:
nmap -p 443 --script http-form-brute --script-args "brute.firstonly=true,http-form-brute.path=/api/auth,http-form-brute.method=GET,userdb=user.txt,http-form-brute.uservar=email,http-form-brute.passvar=password,http-form-brute.onfailure=error,http.useragent=" 192.168.101.6