Scanning multiple hosts with Nmap's Default Accounts NSE script not producing the expected result

Question

I'm utilizing Nmap's default account credential scanner. I've built a couple of my own fingerprints and I've tested that the fingerprints work when scanning one host at a time.
Example command line usage:

nmap -p80 --script http-default-accounts --script-args http-default-accounts.category=web,http-default-accounts.fingerprintfile=./my-fingerprints.lua 10.10.10.10

When I try to scan more then one host either using -iL (input file) or by defining multiple IPs at the command line, nmap is not identifying that all of the hosts are utilizing default credentials. Nmap is only reporting that one of the hosts is utilizing default credentials. And the host nmap identifies as utilizing default credentials varies (it is not always the same host). I have also tried adding --scan-delay, but that does not change the scan results.

Example command line usage (input file):

nmap -p80 --script http-default-accounts --script-args http-default-accounts.category=web,http-default-accounts.fingerprintfile=./my-fingerprints.lua -iL hosts.txt

Example command line usage (command line):

nmap -p80 --script http-default-accounts --script-args http-default-accounts.category=web,http-default-accounts.fingerprintfile=./my-fingerprints.lua 10.10.10.10 10.10.10.11

Has anyone had experience with getting different results when scanning multiple hosts? Is there something I need to change when scanning multiple hosts?

Answer 1

Scanning multiple targets at once should not make a difference. You may have a bug in your fingerprint code, but I can't tell without seeing it. If you want better support, open a new issue on the Nmap issue tracker with the following info:

• output of nmap --version
• output of your scan with the -d option for debugging output
• Relevant contents of my-fingerprints.lua
• Does the script work with the built-in default accounts fingerprints, or do those show the same irregularities?

I'm willing to bet that just running your scan with -d will show output from the script under each target, and the output will be a useful error message.