The script detects web applications by looking at known paths and initiating a login routine using the stored, default credentials. It depends on a fingerprint file located at /nselib/data/http-default-accounts.nse. Entries are LUA tables and they look like the following: