File `http-joomla-brute`

脚本使用类型: portrule
脚本所属分类: intrusive, brute
脚本下载地址: http://nmap.org/svn/scripts/http-joomla-brute.nse

User Summary

Performs brute force password auditing against Joomla web CMS installations.

This script initially reads the session cookie and parses the security token to perfom the brute force password auditing. It uses the unpwdb and brute libraries to perform password guessing. Any successful guesses are stored using the credentials library.

Joomla's default uri and form names:

Default uri:/administrator/index.php
Default uservar: username
Default passvar: passwd

Script Arguments

http-joomla-brute.uservar

sets the http-variable name that holds the username used to authenticate. Default: username

http-joomla-brute.threads

sets the number of threads. Default: 3

Other useful arguments when using this script are:

http.useragent = String - User Agent used in HTTP requests
brute.firstonly = Boolean - Stop attack when the first credentials are found
brute.mode = user/creds/pass - Username password iterator
passdb = String - Path to password list
userdb = String - Path to user list

Based on Patrik Karlsson's http-form-brute

http-joomla-brute.uri

Path to authentication script. Default: /administrator/index.php

http-joomla-brute.hostname

Virtual Hostname Header

http-joomla-brute.passvar

sets the http-variable name that holds the password used to authenticate. Default: passwd

passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb

See the documentation for the unpwdb library.

http.max-cache-size, http.max-pipeline, http.pipeline, http.useragent

See the documentation for the http library.

smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername

See the documentation for the smbauth library.

Example Usage

执行格式

nmap -sV --script http-joomla-brute 
  --script-args 'userdb=users.txt,passdb=passwds.txt,http-joomla-brute.hostname=domain.com,
                 http-joomla-brute.threads=3,brute.firstonly=true' <target>
nmap -sV --script http-joomla-brute <target>

Script Output

PORT     STATE SERVICE REASON
80/tcp open  http    syn-ack
| http-joomla-brute: 
|   Accounts
|     xdeadbee:i79eWBj07g => Login correct
|   Statistics
|_    Perfomed 499 guesses in 301 seconds, average tps: 0

Requires

Author: Paulino Calderon

License: VER007 整理 http://www.ver007.com

File http-joomla-brute