Nmap tftp-enum NSE Script

Script Overview

---

Script source code: https://github.com/nmap/nmap/tree/master/scripts/tftp-enum.nse
Script categories: discovery, intrusive
Target service / protocol: udp
Target network port(s): 69
List of CVEs: -

Script Description

---

The tftp-enum.nse script enumerates TFTP (trivial file transfer protocol) filenames by testing for a list of common ones.

TFTP doesn't provide directory listings. This script tries to retrieve filenames from a list. The list is composed of static names from the file tftplist.txt, plus configuration filenames for Cisco devices that change based on the target address, of the form A.B.C.X-confg for an IP address A.B.C.D and for X in 0 to 255.

Use the tftp-enum.filelist script argument to search for other static filenames.

This script is a reimplementation of tftptheft from

• http://code.google.com/p/tftptheft/.

Tftp-enum NSE Script Arguments

---

This is a full list of arguments supported by the tftp-enum.nse script:

filelist

File name with list of filenames to enumerate at tftp server

- - -
To use this script argument, add it to Nmap command line like in this example:

nmap --script=tftp-enum --script-args filelist=value <target>

Tftp-enum NSE Script Example Usage

---

Here's an example of how to use the tftp-enum.nse script:

nmap -sU -p 69 --script tftp-enum.nse --script-args tftp-enum.filelist=customlist.txt <host>

Tftp-enum NSE Script Example Output

---

Here's a sample output from the tftp-enum.nse script:

PORT   STATE SERVICE REASON
69/udp open  tftp    script-set
| tftp-enum:
|_  bootrom.ld

Tftp-enum NSE Script Example XML Output

---

There is no sample XML output for this module. However, by providing the -oX <file> option, Nmap will produce a XML output and save it in the file.xml file.

Author

---

• Alexander Rudakov

References

---

• https://nmap.org/nsedoc/scripts/tftp-enum.html
• https://github.com/nmap/nmap/tree/master/scripts/tftp-enum.nse
• http://code.google.com/p/tftptheft/

See Also

---

Visit Nmap NSE Library for more scripts.

The tftp-enum.nse script may fail with the following error messages. Check for the possible causes by using the code snippets highlighted below found in the script source code. This can often times help in identifying the root cause of the problem.

error %s

---

Here is a relevant code snippet related to the "error %s" error message:

128:	  local status, lhost, lport, rhost, rport = socket:get_info()
129:	  stdnse.debug1("lhost: %s, lport: %s", lhost, lport);
130:	
131:	
132:	  if (not (status)) then
133:	    stdnse.debug1("error %s", lhost)
134:	    socket:close()
135:	    return REQUEST_ERROR
136:	  end
137:	
138:	

Error in bind %s

---

Here is a relevant code snippet related to the "Error in bind %s" error message:

146:	
147:	
148:	  stdnse.debug1("starting listener")
149:	
150:	  if (not (bindOK)) then
151:	    stdnse.debug1("Error in bind %s", error)
152:	    bind_socket:close()
153:	    return REQUEST_ERROR
154:	  end
155:	
156:	

Error in receive %s

---

Here is a relevant code snippet related to the "Error in receive %s" error message:

155:	
156:	
157:	  local recvOK, data = bind_socket:receive()
158:	
159:	  if (not (recvOK)) then
160:	    stdnse.debug1("Error in receive %s", data)
161:	    bind_socket:close()
162:	    return REQUEST_ERROR
163:	  end
164:	
165:	  if (data:byte(1) == 0x00 and data:byte(2) == 0x03) then