Git Product home page Git Product logo

nndefaccts's Introduction

NNDefaccts

TL;DR

NNdefaccts is nnposter's alternate fingerprint dataset for Nmap script http-default-accounts.

Overview

One of Nmap scripts, http-default-accounts, can be used to test a web target for presence of default credentials specific to various platforms, applications, and management interfaces. The script relies on a fingerprint dataset for correctly identifying the target and performing a login sequence.

Nmap comes with its own default fingerprint dataset; there is no inherent necessity to seek an alternative, such as this one. The key difference is that the NNdefaccts dataset is much larger so many more target types can be tested. Note though that this dataset is not provided, licensed, supported or endorsed by the Nmap project.

To various degrees, checking for default credentials is possible with other well-recognized tools besides Nmap: Metasploit, OpenVAS, Nessus, Qualys, Nexpose, Acunetix, and similar. Based on our evaluation, Nmap with the NNdefaccts dataset is one of the best with respect to web interfaces. Compared to some, it is an order of magnitude difference.

Besides good coverage, scanning for default usernames and passwords with Nmap and the NNdefaccts dataset is straightforward, lightweight, and fast. A target on a local network can be typically tested in less than 30 seconds from start to finish.

Installation, Usage

For simple one-off use, just copy file http-default-accounts-fingerprints-nndefaccts.lua to your home directory and, instead of running:

nmap --script http-default-accounts -p 80 192.168.1.1

add --script-args http-default-accounts.fingerprintfile=... to the command line:

nmap --script http-default-accounts --script-args http-default-accounts.fingerprintfile=~/http-default-accounts-fingerprints-nndefaccts.lua -p 80 192.168.1.1

For more permanent use, you might consider replacing the default fingerprint dataset with this one. The default dataset is typically installed as /usr/share/nmap/nselib/data/http-default-accounts-fingerprints.lua (on Linux).

Support

For help with running script http-default-accounts or Nmap in general, see https://nmap.org/.

For issues specific to NNdefaccts, see below.

Contributing

Contributions are appreciated but please review the rest of the section first.

Bug Reports

Identifying and reporting issues in the dataset is highly valuable. If you believe that you have found a defect, please make sure that you are using the latest version of the dataset and review currently open issues on GitHub to verify that the defect has not been already submitted. If not, create a new issue and be as specific as possible to help with reproducing the problem.

In many cases it is necessary to capture and inspect relevant HTTP traffic in detail. Please use ZAP, Fiddler or Burp to capture the traffic and send the resulting session/project file to nndefaccts /at/ shared-files.de, referencing the issue. (Do not upload the file to GitHub because of its potentially sensitive content.)

Code Contributions

Patches for fixing defects are welcome. Please note that by submitting any code related to the dataset to the NNdefaccts repository or passing it onto nnposter by other means you are assumed to have granted nnposter unlimited, irrevocable, perpetual non-exclusive license to the code, including reuse, modification, and relicensing.

Fingerprint Contributions

All fingerprints included in the dataset are developed and quality-tested against real targets. As a result, it is not currently possible to contribute new fingerprints directly, as a code. If your particular target is not covered by the dataset but you have access to a target instance and able to log in with its default credentials then you can instead contribute by submitting an HTTP session file, capturing the login.

Please send a Fiddler, Burp, or ZAP session file to nndefaccts /at/ shared-files.de, prepared as follows:

  1. Close any browser tabs with the target loaded.
  2. Clear your browser cache, cookies, and local storage.
  3. Visit the target top/home page, navigate to the login page, and log in with the correct default username but obviously wrong password, such as "wrongpassword".
  4. Repeat the first three steps but log in with the correct username and password.
  5. Name the file vendor-product-version, such as Apache-Tomcat-8.0.saz.
  6. Send it to the above-mentioned e-mail.

Author, License

NNdefaccts is Copyright (c) 2012-2018 by nnposter (nnposter /at/ users.sourceforge.net, https://github.com/nnposter), a party separate from Fyodor, Nmap Project, and Insecure.Com, LLC.

NNdefaccts is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

For details see the full license at COPYING.

nndefaccts's People

Contributors

nnposter avatar

Watchers

 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.