1

How can i improve this by passing arguments to http-default-accounts. I feel like I'm doing something wrong. I'm not getting any good results

# Find vulnerable web logins

# How many random hosts do you want to scan ?

N_HOSTS=5000

nmap\
 -Pn\
 -sS\
 -sV\
 -n\
 -T5\
 -p 8080, 80, 8000\
 --script http-default-accounts\
 --open\
 -oX results.xml\
 -iR $N_HOSTS
1

Passing arguments to NSE script is very easy once understood properly. Basically it follows the format of lua table. Also, if you get any doubt with your Nmap's options usage you can turn on debug mode using -d<level> flag. Usually -d2 is sufficient for looking at scripts. For the given script http-default-accounts it would be like -

nmap <options> --script http-default-accounts --script-args "http-default-accounts.basepath='/admin', category='web', fingerprintfile=/usr/share/nmap/nselib/data/http-default-accounts-fingerprints.lua"

Notice that I've used script-name.argument format as well as argument format in the arguments. Both of them work same while former is used when different scripts assume same argument variables and you want to give different values. In the current state, this script does not take multiple basepath or category or fingerprintfile. To master the script argument usage, you can try using the http-form-fuzzer script which can take up nested table of any depth.

| improve this answer | |
  • Is there a way to specify the list of user names and passwords – Ricky Wilson Jul 11 '17 at 12:35
  • What does this do "http-default-accounts.basepath='/admin' – Ricky Wilson Jul 11 '17 at 12:44
  • Yes, you can specify username and passwords. For that you have to have a fingerprintfile. The default one used by Nmap is http-default-accounts-fingerprints.lua. This argument http-default-accounts.basepath will make Nmap go to the path specified and then perform target's enumeration. For example, if I put http-default-accounts.basepath='/login' and target IP is 192.168.1.5` then it will perform enumeration for default accounts on 192.168.1.5/login – Abhishek Singh Jul 11 '17 at 14:40
  • where is the list of user names and passwords stored and can i specify my own. Thanks for the help – Ricky Wilson Jul 11 '17 at 15:49
  • As @bonsaiviking answered already you can not specify list of usernames and password explicitly. Although, you can write your own fingerprint file which would be really burdensome for you in my view. – Abhishek Singh Jul 13 '17 at 6:58
0

You have essentially 2 questions here:

  • Why am I not getting good results?
  • What script arguments can I use to improve my results?

The most likely reason you're not getting good results for the http-default-accounts script is that there are not that many systems on the Internet with default accounts that the script knows about. 5000 addresses may seem like a lot, but it's only 0.00012% of the routable Internet. Your chances would be greatly increased if you limited your scan to lists of addresses known to be active. Also, if you know of some default accounts that the script doesn't cover, adding those to the fingerprints file (and submitting to the Nmap Project) will help catch more of those systems.

Scripts inherit script arguments from the libraries they use. You can find the list of arguments and library arguments for a script on the NSEdoc portal. Here's how to find them for your particular script.

First, get the URL to the documentation by running nmap --script-help your-script-name:

$ nmap --script-help http-default-accounts

Starting Nmap 7.50 ( https://nmap.org ) at 2017-07-11 09:05 CDT

http-default-accounts
Categories: discovery auth intrusive
https://nmap.org/nsedoc/scripts/http-default-accounts.html
  Tests for access with default credentials used by a variety of web applications and devices.
<snip>

That URL below the Categories: line links to the NSEdoc page for http-default-accounts. There, under the Script Arguments header you can see the list of arguments the script supports.

A quick review of those arguments shows that they are mostly concerned with limiting or changing the scope of the test:

  • http-default-accounts.category - limit tests to only this category instead of trying all of them.
  • http-default-accounts.fingerprintfile - Use a different fingerprint file, if you wrote one yourself.
  • http-default-accounts.basepath - Check for web apps installed in a different base URI. Not useful for broad scanning like this.

The arguments inherited from the http library are mostly for tuning performance, though http.useragent can be set to avoid announcing that you are scanning with NSE. The other libraries (creds, smbauth) are not really relevant here, since they are used to pass credentials in to scripts to use, and this script uses its own list instead.

You asked in a comment on a different answer whether there is a way to specify the list of usernames and passwords. There is not, for http-default-accounts, because that uses the default usernames and passwords for various applications. You may instead want http-brute or http-form-brute, to test various forms of web authentication for a specific list of usernames and passwords.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.