Nmap Scripting Engine
💡
Overview:
NSE allows creation and execution of Lua scripts to interact with various services.
It is divided into 14 categories based on the type of tasks the scripts perform.
Script Categories
Category
Description
auth
Determination of authentication credentials.
broadcast
Scripts for host discovery via broadcasting; discovered hosts can be added automatically to scans.
brute
Executes scripts that attempt to log in by brute-forcing credentials.
default
Default scripts executed using the -sC option.
discovery
Evaluates accessible services.
dos
Checks services for denial-of-service vulnerabilities (used sparingly as they can harm services).
exploit
Tries to exploit known vulnerabilities on the scanned port.
external
Uses external services for further processing.
fuzzer
Sends varied fields to detect vulnerabilities and unexpected packet handling (can be time-consuming).
intrusive
Intrusive scripts that might negatively affect the target system.
malware
Checks if the target system is infected with malware.
safe
Defensive scripts that do not perform intrusive or destructive actions.
version
Extensions for service detection.
vuln
Identifies specific vulnerabilities.
Defining Scripts in Nmap
1. Default Scripts
Command Example:
2. Specific Scripts Category
Command Example:
3. Defined Scripts (Multiple Specific Scripts)
Command Example:
Example: Specifying Scripts on an SMTP Port
Scenario: Use two defined scripts (
bannerandsmtp-commands) against the SMTP port (25).Command:
Sample Output:
Scanning Options Explanation:
10.129.2.28: Target IP.p 25: Scan only port 25.-script banner,smtp-commands: Run the specified NSE scripts.
Key Observations:
The
bannerscript reveals the SMTP server banner (shows Ubuntu distribution).The
smtp-commandsscript displays available SMTP commands, which can help identify existing users on the target.
Aggressive Scan Option (-A)
Purpose: Combines multiple scanning options:
Service detection (
sV)OS detection (
O)Traceroute (
-traceroute)Default NSE scripts (
sC)
Example Command:
Sample Output (Partial):
Scanning Options Explanation:
10.129.2.28: Target IP.p 80: Scan only port 80.A: Performs aggressive scan combining multiple options.
Key Findings:
Identifies the web server (Apache 2.4.29 on Ubuntu).
Detects the web application (WordPress 5.3.4) and webpage title.
Provides OS detection (likely Linux, 96% confidence).
Vulnerability Assessment Using NSE (vuln Category)
Goal: To check the HTTP service (port 80) for known vulnerabilities.
Command:
Sample Output (Partial):
Scanning Options Explanation:
10.129.2.28: Target IP.p 80: Scan only port 80.sV: Performs service version detection.-script vuln: Runs all vulnerability-related NSE scripts.
What the Scripts Do:
Interact with the webserver and its application to gather version details.
Query vulnerability databases to identify known vulnerabilities.
Examples include enumerating web directories (
http-enum), checking server headers, and listing potential exploits (via thevulnersscript).
Additional Resources
For more details on NSE scripts and categories, visit:NSE Documentation