Added nmap brute force attack

Author: GrahamMThomas

gauntlt/attacks/nmap-http-brute-force.attack

@@ -0,0 +1,36 @@
+@slow
+
+Feature: Will brute force <hostname> on <tcp_ping_ports> using nmap.lst
+ Background:
+ Given "nmap" is installed
+ And the following profile:
+ | name | value |
+ | hostname | httpbin.org |
+ | path | /basic-auth/user/passwd |
+ | tcp_ping_ports | 80 |
+ | nscript | http-brute |
+
+ Scenario: Verify server is open on expected set of ports using the nmap fast flag
+ When I launch an "nmap" attack with:
+ """
+ nmap -F <hostname>
+ """
+ Then the output should match:
+ """
+ 80/tcp\s+open
+ """
+
+ Scenario: Output to XML
+ When I launch an "nmap" attack with:
+ """
+ nmap --script http-brute -p 80 <hostname> -d --script-args http-brute.path=<path>,unpwdb.timelimit=20s -oX foo.xml
+ """
+ 
+ Then the file "foo.xml" should contain:
+ """
+ <elem key="Statistics">Performed
+ """
+
+ Then the file "foo.xml" should contain XML:
+ | css |
+ | ports port[protocol="tcp"][portid="80"] state[state="open"] |