Hello everyone. So in
this video we are going to see how to
use nmap script arguments. So
what are script arcs?
So in nmap, whenever you're going to use any script,
you can specify your own
arguments also, so basically in
this video we are going to see how we
can specify arguments to a
NEC script in which we are going to give our
own username and password word list.
So the syntax of doing this particular scan is
and map Target IP hyphen hyphen
script equals to the script name and then
hyphen hyphen script
hyphen, args and the arguments
you can always add hyphen V to see the output in verbose mode
the example of doing this scan is nmap. The
target IP address followed by hyphen hyphen
script equals to the script name and hyphen hyphen script hyphen
arcs and you can specify the arguments.
So it is the Practical time and let's see this type of
scan in action.
as you can see on the screen, I have written nmap
-script FTP hyphen
brute, which means I'm going to use a script
which is
used for brute forcing the FTP username and
password
now you should know that nmap has its own
word list of username and password, but I
want to specify my own made custom
word list, which is basically nothing a
username.
dot txt file and a password dot txt
file in which I have put
some usernames and passwords
so you can see here. I'm going to use this particular script
and I'm going to specify some arguments.
Which is hyphen hyphen script hyphen args,
what are the arguments?
Here I'm saying the user DB which is
the username should be located from this particular
path that is uses Rohit and
map for list username.txt. This is
the part that I have given and the password should be
retrieved or the password should be
fetched from this particular path. Where is the
passwords are saved?
Run the script on put 999 because
FTP is running on this particular
port.
on the target
Okay - p n not to do ping
Discovery. This is our Target IP hyphen
SV stands for service version detection
and I want to see all the output on my screen in
verbose mode.
Perfect.
So now we are going to copy this particular script
and then we are going to paste this onto
our terminal and the brute forcing will
automatically start.
Remember in user DB you have to
give the path of the username file in
past DB you have to give the path of
the password file.
this is the custom port number where FTP is running the target IP
address followed by hyphen SV and
to see the output inverse mode - we
so now let me just copy this go into my
Terminal as you can see, this port number is running
FTP. We have already identified by running a
scan as you can see over here.
now
I'm going to paste our script and I'm going to hit enter.
So the brute forcing will automatically start
and nmap will identify the correct
username and password.
This is the username file.
And this is the password file, which is
been used by nmap.
Let me show you where I have created. This this have been created in
the users Rohit and map word list folder. This
is the same path which nmap is
using right now.
I will just skip this scan.
And directly jump to the output the results.
As you can see here, we have got the output wherein
we have we can see the output of
the FTP root script is we have found out
two valid credentials. What are those two valid
credentials? First one is Rohit.
And Rohit username is Rohit password is Rohit the second
one we have found out is admin admin. So we have
found out two valid credentials and one more which is
anonymous anonymous. So in total, we have
found out three valid credentials which
are running on this particular port and
these are the username and password through which an attacker
can login into
so I hope you guys understood this.
Thank you.