Nmap ubiquiti-discovery NSE Script

Script Overview

---

Script source code: https://github.com/nmap/nmap/tree/master/scripts/ubiquiti-discovery.nse
Script categories: default, discovery, version, safe
Target service / protocol: ubiquiti-discovery, udp
Target network port(s): 10001
List of CVEs: -

Script Description

---

The ubiquiti-discovery.nse script extracts information from Ubiquiti networking devices.

This script leverages Ubiquiti's Discovery Service which is enabled by default on many products. It will attempt to leverage version 1 of the protocol first and, if that fails, attempt version 2.

Ubiquiti-discovery NSE Script Arguments

---

The ubiquiti-discovery.nse script does not have any arguments.

Ubiquiti-discovery NSE Script Example Usage

---

Here's an example of how to use the ubiquiti-discovery.nse script:

nmap -sU -p 10001 --script ubiquiti-discovery.nse <target>

Ubiquiti-discovery NSE Script Example Output

---

Here's a sample output from the ubiquiti-discovery.nse script:

PORT      STATE SERVICE            VERSION
10001/udp open  ubiquiti-discovery Ubiquiti Discovery Service (v1 protocol, ER-X software ver. v1.10.7)
| ubiquiti-discovery:
|   protocol: v1
|   uptime_seconds: 113144
|   uptime: 1 days 07:25:44
|   hostname: ubnt-router
|   product: ER-X
|   firmware: EdgeRouter.ER-e50.v1.10.7.5127989.181001.1227
|   version: v1.10.7
|   interface_to_ip:
|     80:2a:a8:ae:f1:63:
|       192.168.0.1
|       172.25.16.1
|     80:2a:a8:ae:f1:5e:
|       55.55.55.10
|       55.55.55.11
|       55.55.55.12
|   mac_addresses:
|     80:2a:a8:ae:f1:63
|_    80:2a:a8:ae:f1:5e

PORT      STATE SERVICE            REASON       VERSION
10001/udp open  ubiquiti-discovery udp-response Ubiquiti Discovery Service (v2 protocol, UCK-v2 software ver. 5.9.29)
| ubiquiti-discovery:
|   protocol: v2
|   firmware: UCK.mtk7623.v0.12.0.29a26c9.181001.1444
|   version: 5.9.29
|   model: UCK-v2
|   config_status: managed/adopted
|   interface_to_ip:
|     78:8a:20:21:ae:7b:
|       192.168.0.30
|   mac_addresses:
|_    78:8a:20:21:ae:7b

Ubiquiti-discovery NSE Script Example XML Output

---

Here's a sample XML output from the ubiquiti-discovery.nse script produced by providing the -oX <file> Nmap option:

 <elem key="protocol">v1</elem>
 <elem key="uptime_seconds">113144</elem>
 <elem key="uptime">1 days 07:25:44</elem>
 <elem key="hostname">ubnt-router</elem>
 <elem key="product">ER-X</elem>
 <elem key="firmware">EdgeRouter.ER-e50.v1.10.7.5127989.181001.1227</elem>
 <elem key="version">v1.10.7</elem>
 <table key="interface_to_ip">
 <table key="80:2a:a8:ae:f1:63">
   <elem>192.168.0.1</elem>
   <elem>172.25.16.1</elem>
 </table>
   <table key="80:2a:a8:ae:f1:5e">
    <elem>55.55.55.10</elem>
    <elem>55.55.55.11</elem>
    <elem>55.55.55.12</elem>
   </table>
 </table>
 <table key="mac_addresses">
   <elem>80:2a:a8:ae:f1:63</elem>
   <elem>80:2a:a8:ae:f1:5e</elem>
 </table>

 <elem key="protocol">v2</elem>
 <elem key="version">5.9.29</elem>
 <elem key="model">UCK-v2</elem>
 <elem key="config_status">managed/adopted</elem>
 <table key="interface_to_ip">
   <table key="78:8a:20:21:ae:7b">
     <elem>192.168.0.30</elem>
   </table>
 </table>
 <table key="mac_addresses">
   <elem>78:8a:20:21:ae:7b</elem>
 </table>

Author

---

• Tom Sellers

References

---

• https://nmap.org/nsedoc/scripts/ubiquiti-discovery.html
• https://github.com/nmap/nmap/tree/master/scripts/ubiquiti-discovery.nse

See Also

---

Visit Nmap NSE Library for more scripts.