I'm utilizing Nmap's default account credential scanner. I've built a couple of my own fingerprints and I've tested that the fingerprints work when scanning one host at a time.
Example command line usage:
nmap -p80 --script http-default-accounts --script-args http-default-accounts.category=web,http-default-accounts.fingerprintfile=./my-fingerprints.lua 10.10.10.10
When I try to scan more then one host either using -iL (input file) or by defining multiple IPs at the command line, nmap is not identifying that all of the hosts are utilizing default credentials. Nmap is only reporting that one of the hosts is utilizing default credentials. And the host nmap identifies as utilizing default credentials varies (it is not always the same host). I have also tried adding --scan-delay, but that does not change the scan results.
Example command line usage (input file):
nmap -p80 --script http-default-accounts --script-args http-default-accounts.category=web,http-default-accounts.fingerprintfile=./my-fingerprints.lua -iL hosts.txt
Example command line usage (command line):
nmap -p80 --script http-default-accounts --script-args http-default-accounts.category=web,http-default-accounts.fingerprintfile=./my-fingerprints.lua 10.10.10.10 10.10.10.11
Has anyone had experience with getting different results when scanning multiple hosts? Is there something I need to change when scanning multiple hosts?