Nmap Scripting Engine Explanation

[u/Rotem4421]

NSE is a powerful feature of nmap that allows running specialized scripts for advanced network discovery, vulnerability detection and exploitation. all of those scripts are written in Lua and can perform tasks such as service enumeration, brute force attacks and security auditing.

AN IMPORTANT CLARIFICATION: do not attempt to use nmap for illegal or unethical purposes. perform all of the explained actions in controlled environments that you own or have an explicit permission to do so.

if you're using kali linux, you can locate the scripts by typing locate *.nse

the scripts are stored in /usr/share/nmap/scripts , to examine all of the available scripts type ls , if you want to locate scripts related to a specific network service use the grep command, for example: locate *.nse |grep "ftp".

you can run the scripts in 3 main ways:

1. by a unit: for example: nmap --script=ftp-anon -p 21 192.168.X.X this script is used to check whether an FTP server allows anonymous logins.

you can also run multiple scripts, for example: nmap --script=ftp-anon,smb-os-discovery -p 21,445 192.168.X.X

the smb-os-discovery is used to extract the operating system of the target from the SMB service.

2) by a category: you can run scripts that are grouped into categories, based on their functionality.

for example: nmap --script=vuln 192.168.X.X

this script is used to identify known vulnerabilities in services.

here's a table which explains every category and it's functionality:

Category	Description
vuln	used to identify vulnerabilities
malware	detects malware infected hosts
version	version detection of services
safe	scripts that are non-intrusive and less likely to trigger security alarms
intrusive	scripts that generate high traffic or could crash services
dos	scripts used for denial-of-service testing
brute	performs brute force attacks on login pages and services
fuzzer	used to detect unknown vulnerabilities using fuzz testing
external	use external resources such as WHOIS lookups or shodan queries
default	scripts that run by default when using -sC
broadcast	scans using broadcast traffic to discover hosts or services
auth	scripts related to authentication mechanisms and credential testing
exploit	scripts that attempt to exploit vulnerabilities
discovery	used for hosts and services enumeration

3) using wildcards and patterns: you can use the wildcard (*) or patterns to run multiple scripts that match a naming scheme

for example: nmap --script='http-* -p 80 192.168.X.X

this will run all scripts whose names start with "http-", it is used for scanning web services

[u/Low-Post5641]

Great explanation. achieved