Developers sticking to the framework proposed by the brute library don't need to worry about reading the username and password database shipped with Nmap. However, if you find yourself writing scripts without this library for any reason, you could use the unpwdb library to do so.

The unpwdb library provides two functions: usernames() and passwords(). They return a function closure (if successful) that outputs usernames and passwords with each call correspondingly. The returned closures can also take the reset argument to set the pointer at the beginning of the list.

The following snippet illustrates how to use these function closures to interact with the username and password database:

local usernames, passwords
local nmap_try = nmap.new_try()

usernames = nmap_try(unpwdb.usernames())
passwords = nmap_try(unpwdb.passwords())

for password in passwords do
  for username in usernames do
    -- Do something!
  end
  usernames("reset...