Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

There's more...

The script http-form-brute depends on the correct detection of the form fields. Often you will be required to manually set via script arguments the name of the fields holding the username and password variables. If the script argument http-form-brute.passvar is set, form detection will not be performed:

$ nmap -p80 --script http-form-brute --script-args http-form-brute.passvar=contrasenia,http-form-brute.uservar=usuario <target>  

In a similar way, often you will need to set the script arguments http-form-brute.onsuccess or http-form-brute.onfailure to set the success/error messages returned when attempting to authenticate:

$nmap -p80 --script http-form-brute --script-args http-form-brute.onsuccess=Exito <target>