Nmap NSE net: domino-enum-users

Attempts to discover valid IBM Lotus Domino users and download their ID files by exploiting the CVE-2006-5835 vulnerability. SYNTAX: userdb: The filename of an alternate username database. domino-id.username: the name of the user from which to retrieve the ID. If this parameter is not specified, the unpwdb library will be used to brute force names of users. For more information see the references. Credits - ------ o Ollie Whitehouse for bringing this to my attention back in the days when it was first discovered and for the c-code on which this is based. passdb: The filename of an alternate password database. unpwdb.passlimit: The maximum number of passwords 'passwords' will return (default unlimited). domino-id.path: the location to which any retrieved ID files are stored unpwdb.userlimit: The maximum number of usernames 'usernames' will return (default unlimited). unpwdb.timelimit: The maximum amount of time that any iterator will run before stopping. The value is in seconds by default and you can follow it with 'ms', 's', 'm', or 'h' for milliseconds, seconds, minutes, or hours. For example, 'unpwdb.timelimit=30m' or 'unpwdb.timelimit=.5h' for 30 minutes. The default depends on the timing template level (see the module description). Use the value '0' to disable the time limit.