Skip to content

Feaure skipping closed ports #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
salvoM wants to merge 2 commits into
base: main
Choose a base branch
from
+28 −0
Open

Feaure skipping closed ports #2

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
84b3467
Added ping probes to check if target is pingable
salvoM May 26, 2026
47184b6
Skip unreachable protocol tests
salvoM May 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions credspray.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -536,6 +536,20 @@ PROTOCOL_MAP[8]="wmi"
PROTOCOL_MAP[9]="vnc"
PROTOCOL_MAP[10]="nfs"

declare -A protocol_ports=(
Copy link
Copy Markdown
Owner

@strikoder strikoder May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since protocol_ports already defines all protocols as keys, the "all" branch in the if/else below is redundant. You can replace PROTOCOLS=("smb" "winrm" ...) with PROTOCOLS=(${!protocol_ports[@]}) to derive it directly from the array. This way if someone adds a new protocol to protocol_ports in the future, the "all" case picks it up automatically without needing to edit two separate parts of the code.

Nevertheless, that said, see my comment below about replacing the nc port check entirely: if we go that route, protocol_ports itself may no longer be needed, which would make this point irrelevant anyway.

[smb]=445
[winrm]=5985
[rdp]=3389
[ssh]=22
[mssql]=1433
[ldap]=389
[ftp]=21
[wmi]=135
[vnc]=5900
[nfs]=111
)


if [[ "$protocol_choice" == "all" ]]; then
PROTOCOLS=("smb" "winrm" "rdp" "ssh" "mssql" "ldap" "ftp" "wmi" "vnc" "nfs")
else
Expand Down Expand Up @@ -761,13 +775,27 @@ echo -e "${BLUE}[*] Protocols: ${PROTOCOLS[*]}${NC}"
echo -e "${BLUE}[*] Starting credential validation...${NC}"
echo -e "${YELLOW}[*] Press Ctrl+C once to skip current test, twice within ${INTERRUPT_TIMEOUT}s to exit${NC}\n"

# Ping could be disabled, so just warn the user
Copy link
Copy Markdown
Owner

@strikoder strikoder May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not a fan of the ping warning. In most real pentesting scenarios ICMP is blocked at the firewall, so this will almost always fire as a false alarm and just adds noise, and you most likely won't need it in a ctf env.

if !(ping -c 1 -W 2 $TARGET > /dev/null 2>&1); then
echo -e "${YELLOW}[*] WARNING: target ${TARGET} does not respond to ping probes${NC}\n"
fi

# Test each protocol
for protocol in "${PROTOCOLS[@]}"; do
# Reset skip flag for new protocol
SKIP_CURRENT=false

echo -e "\n${BLUE}========== Testing protocol: $protocol ==========${NC}"

# First test if target is running service on the expected port
if ! [[ -z "${protocol_ports[$protocol]}" ]]; then
# We have a port to test this protocol
if !(nc -z -w 5 $TARGET ${protocol_ports[$protocol]} > /dev/null 2>&1); then
Copy link
Copy Markdown
Owner

@strikoder strikoder May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of using nc for port checking, I think it would be cleaner to inspect the nxc output after the first domain auth attempt. If nxc failed to connect (e.g. Connection refused, timed out, no route to host), there's no point running the local auth attempt right after; the port is clearly closed or unreachable. This way we avoid the nc dependency entirely and the existing sleep 1 between domain and local auth is a natural place to add that check.

echo -e "${YELLOW}[*] WARNING: skipping test for protocol $protocol. ${TARGET} does not respond to probes on port ${protocol_ports[$protocol]} ${NC}\n"
continue
fi
fi

# Test with passwords if we have them
if [[ "$HAS_PASSWORDS" == true ]]; then
# Determine which auth types to test
Expand Down