Supply additional password via script-args? about nndefaccts

[nnposter]

This is technically doable for the most part. The one issue is that some of the targets are behaving differently if a true default password is used, such as redirecting to a password change dialog, hard or soft, instead of starting a regular authenticated session. Handling such cases would require updating the fingerprint matching logic too, which is impractical.

Just to make sure I understand you correctly, you are not proposing to test additional usernames with passwords, but to try existing default usernames with additional passwords supplied separately, correct?

[rufflabs]

That is correct. In my particular use case this only applies to printers, as that's all I am interested in. Testing an additional known password against a printer/copier with the normal admin/default username.

This may be pretty niche, and not useful to the masses. If that's the case, my fall back is to just manually edit the relevant fingerprint login_combos to add my additional password for my own use.

[nnposter]

The scenario is not quite fitting the intended use so I do not want to "pollute" the standard Nmap script. On the other hand, it should be relatively straightforward to handle this natively inside Lua, instead of having to edit the source code of individual fingerprints.

Append the following Lua fragment to the end of the fingerprint file and adjust the filename on the last line as needed.

local io = require "io"

local function expand_combos (fingerprints, filename)
  for pwd in io.lines(filename) do
    for _, fp in ipairs(fingerprints) do
      local combos = fp.login_combos
      local usernames = {}
      for _, combo in ipairs(combos) do
        if pwd == combo.password then
          usernames = {}
          break
        end
        usernames[combo.username] = 1
      end
      for usr in pairs(usernames) do
        table.insert(combos, {username = usr, password = pwd})
      end
    end
  end
end
        
expand_combos(fingerprints, "/tmp/my_passwords.txt")

This will dynamically modify all fingerprints one by one, enumerating existing fingerprint usernames and adding new username/password combinations from passwords in file /tmp/my_passwords.txt.