1

I'm utilizing Nmap's default account credential scanner. I've built a couple of my own fingerprints and I've tested that the fingerprints work when scanning one host at a time.
Example command line usage:

nmap -p80 --script http-default-accounts --script-args http-default-accounts.category=web,http-default-accounts.fingerprintfile=./my-fingerprints.lua 10.10.10.10

When I try to scan more then one host either using -iL (input file) or by defining multiple IPs at the command line, nmap is not identifying that all of the hosts are utilizing default credentials. Nmap is only reporting that one of the hosts is utilizing default credentials. And the host nmap identifies as utilizing default credentials varies (it is not always the same host). I have also tried adding --scan-delay, but that does not change the scan results.

Example command line usage (input file):

nmap -p80 --script http-default-accounts --script-args http-default-accounts.category=web,http-default-accounts.fingerprintfile=./my-fingerprints.lua -iL hosts.txt

Example command line usage (command line):

nmap -p80 --script http-default-accounts --script-args http-default-accounts.category=web,http-default-accounts.fingerprintfile=./my-fingerprints.lua 10.10.10.10 10.10.10.11

Has anyone had experience with getting different results when scanning multiple hosts? Is there something I need to change when scanning multiple hosts?

1

Scanning multiple targets at once should not make a difference. You may have a bug in your fingerprint code, but I can't tell without seeing it. If you want better support, open a new issue on the Nmap issue tracker with the following info:

  • output of nmap --version
  • output of your scan with the -d option for debugging output
  • Relevant contents of my-fingerprints.lua
  • Does the script work with the built-in default accounts fingerprints, or do those show the same irregularities?

I'm willing to bet that just running your scan with -d will show output from the script under each target, and the output will be a useful error message.

  • thanks for your comment. I executed the script using the -debug option and the message for the false negative hosts is that a valid 404 was obtained. When I test my custom fingerprint file against individual hosts I get the Negative and Positive results I'm looking for, so I don't think its my fingerprint file. In the meantime I have created a python script that executes the nmap scan against each host individually. I will open an issue on the nmap issue tracker. Thanks. – dmittakarin8 Apr 18 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.