File http-wordpress-brute

脚本使用类型: portrule
脚本所属分类: intrusive, brute
脚本下载地址: http://nmap.org/svn/scripts/http-wordpress-brute.nse

User Summary

performs brute force password auditing against Wordpress CMS/blog installations.

This script uses the unpwdb and brute libraries to perform password guessing. Any successful guesses are stored using the credentials library.

Wordpress default uri and form names:

• Default uri:wp-login.php
• Default uservar: log
• Default passvar: pwd

Script Arguments

http-wordpress-brute.threads

sets the number of threads. Default: 3

Other useful arguments when using this script are:

• http.useragent = String - User Agent used in HTTP requests
• brute.firstonly = Boolean - Stop attack when the first credentials are found
• brute.mode = user/creds/pass - Username password iterator
• passdb = String - Path to password list
• userdb = String - Path to user list

Based on Patrik Karlsson's http-form-brute

http-wordpress-brute.uri

points to the file 'wp-login.php'. Default /wp-login.php

http-wordpress-brute.uservar

sets the http-variable name that holds the username used to authenticate. Default: log

http-wordpress-brute.hostname

sets the host header in case of virtual hosting

http-wordpress-brute.passvar

sets the http-variable name that holds the password used to authenticate. Default: pwd

passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb

http.max-cache-size, http.max-pipeline, http.pipeline, http.useragent

smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername

Example Usage

执行格式

nmap -sV --script http-wordpress-brute <target>
nmap -sV --script http-wordpress-brute
  --script-args 'userdb=users.txt,passdb=passwds.txt,http-wordpress-brute.hostname=domain.com,
                 http-wordpress-brute.threads=3,brute.firstonly=true' <target>

Script Output

PORT     STATE SERVICE REASON
80/tcp   open  http    syn-ack
| http-wordpress-brute:
|   Accounts
|     0xdeadb33f:god => Login correct
|   Statistics
|_    Perfomed 103 guesses in 17 seconds, average tps: 6

Requires

• brute
• creds
• http
• shortport
• stdnse

Author: Paulino Calderon

License: VER007 整理 http://www.ver007.com