Here we have some scripts which are very helpful in penetration tests. The scripts that end with “brute”
perform brute-­force password guessing against the named services. Scripts ending with “­info” gets the
information about the named services. "dns­recursion" checks of a DNS server allows queries for third-party
names.
dns­zone­transfer request zone transfer A(AXFR) from a DNS server.
If the query is successful all domains and domain types are returned along with common type-specific
data (SOA, MX, NS, PTR or A). http­slowloris­check tests a web server for vulnerability to the Slowloris DoS
attack without actually launching a DoS attack.
ms-­sql-­info attempts to determine configuration and version information for Microsoft
SQL Server instances. ms­sql­dump­hashes dumps the password hashes from an MS-SQL server
in a format suitable for cracking by tools such as John-the-ripper. nbstat attempts to retrieve
the target's
NetBIOS names and MAC address.
By default the script displays the name of the computer and the logged-in user.
If the verbosity is turned up, it displays all the names the system thinks it owns.
smb-­enum-­users attempts to enumerate the users on a remote window system with as much information as
possible.
The goal of this script is to discover all user accounts that exist on a remote system.
This can be helpful for administration by seeing who has an account on a server or for penetration testing
or network foot printing by determining which accounts exist on a system. smbenumshares
attempts to list shares finding open shares is useful to a penetration tester because there may be private
files shared or if it's writable it could be a good place to drop a Trojan or to infect a file that's
already there.
Knowing where the share is could make those kinds of tests more useful except that determining where
the share is requires administrative privileges already in a penetration test.
You should try the pass the hash method to compromise system.
And the last three scripts will be very helpful for your pass the hash attacks.
Here you see some useful brute force or dictionary attack scripts for FTP, Databases such as My SQL,
Oracle, or MS SQL,
SNMP, Telnet etc.