Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

Brute modes

The brute library supports different modes that alter the combinations used in the attack. The available modes are:

• user: In this mode, for each user listed in userdb, every password in passdb will be tried:

$ nmap --script http-brute --script-args brute.mode=user <target>  

• pass: In this mode, for each password listed in passdb, every user in userdb will be tried:

$ nmap --script http-brute --script-args brute.mode=pass <target>  

• creds: This mode requires the additional argument brute.credfile:

$ nmap --script http-brute --script-args brute.mode=creds,brute.credfile=./creds.txt <target>