>> Welcome to the Nmap scripting engine lab.
The goal of this lab is to
find a Cisco switch on the network.
I'm going to run a vulnerability scan against it,
and then I'll exploit it,
and then we'll look at the results together.
I'm running Windows 10 on this scanning station.
I'm going to go ahead and navigate to
the Nmap directory
[NOISE].
I'll clear the screen.
First, we'll run a ping sweep,
like we've run a lot of times in the past.
We use CIDR notation,
but I'm going to limit the scope of
this scan since I
have a little bit of insight into this network.
We have two Cisco devices here.
I happen to know that we're most interested in
this device at 192.168.1.2.
I'll clear the screen again.
I'm going to do an OS discovery on that device,
we'll do it nmap-O.
There's our results.
It says no exact OS matches for
hosts and gives us the fingerprint.
Does show us that port 23 and port 80 are open,
but doesn't really give us
very good information about what operating system
that host is running other than we know
the MAC address is here and it's a Cisco device.
I'll clear the screen again [NOISE].
If you remember from our OS
detection scans in the past, the previous lesson,
we did a nmap-osscan-guess.
What the scan does is it gives us
a reasonable amount of certainty
about the operating system that the target is running.
Scroll up. Here you see aggressive OS guesses,
Cisco 2950 switch running IOS 12.1,
and that's a 98 percent degree of certainty.
That's pretty good, that's good enough for me.
I'll go ahead and clear the screen again.
First of all, we'll run a typical
>> default Nmap nse scan,
>> and that is with nmap-sC against our target.
This runs every nse script
that is categorized as a default.
It does give us some good information,
shows us the ports again that are open,
and you can see that the HTTP off-script
came back with results.
Not earth-shattering,
but I wanted to show you that scan nonetheless.
Next, what I really wanted to show you was,
currently we're in the Nmap default directory
on a Windows 10 device.
This applies to any operating system
that you're running really,
but if I go back a folder,
a directory, and run
an Nmap scan against that same target,
obviously, it'll still run because Nmap is in the path.
I'm going to cancel that,
get back in the Nmap folder, clear the screen.
[NOISE] The reason I'm showing you that is
because one of the ways that you can
run an Nmap scan is simply by using
the command nmap --script,
and then the name of the script that you want to run.
Well, where we're at right now,
we don't know the name of any of the scripts.
Unless you just happen to memorize them all,
you wouldn't really know what to run.
Well, what I like to do when I'm running
Nmaps scripts, personally,
if I'm doing it from the command line,
is I like to navigate into the scripts directory.
I'll do a dir*., which
will show me all the folders in the Nmap directory.
You see this directory right here, which is scripts.
When I run Nmap scripts,
I like to navigate to that folder.
We'll do a cd scripts.
I'll clear the screen again
because it's getting a little lot messy.
You do a dir here,
you'll see every single Nmap script that
downloads and installs with a default Nmap install.
There's going to be a lot of them.
You can see there's 591 scripts,
all with the extension of nse.
Any of these scripts can be run
from any location at the command line because Nmap,
as we learned earlier,
is in the path in this operating system.
But I like to run
the nse scripts from the scripts folder simply
because I can narrow down
what script I'm interested in the most,
and there's just a ton of them here.
I think you get my main point.
For instance, we see this xmpp-info.nse.
If I want to run that script,
we can do an nmap --script xmpp-info.
Nmap has a lot of flexibility.
We can do nmap --script equals xmpp-info,
or you can add the nse if you want,
or you can leave out the equal sign and do
xmpp-info alone or add the nse, both will run.
I actually don't know what that script does.
As we learned in the past,
if you're interested in learning
what a particular script does,
you run a nmap --script help.
I can run it like that,
or like I said, I can add the nse.
We'll go ahead and run it like this,
and just for giggles,
I'll add the equal sign.
The xmpp info,
here are the categories that it belongs to: default,
safe, discovery, and version.
Here's a brief description that
the programmer provided for us connects to
xmpp server port 5222 and collect
server information and so forth.
If we want more information,
we can highlight that URL and go to it in our browser.
The main point I wanted to provide to you was that
there's multiple ways that you can run scripts in nse.
You can run them from multiple locations,
but I like to run them in the scripts folder personally
because it's easy to get help on them,
learn about them, and easy
to see a list of all the ones that
>> you're interested in.
>> Another thing I want to show you is that
you can run scripts.
For instance, this is in the category default,
safe, discovery, and version.
You can run scripts by their category
by simply doing nmap --script,
and then putting the category.
This one is a default script,
but it's also a safe script.
If I wanted to,
I could also add safe to it, and then put your target.
I'll go ahead and run this.
I'm going to run all of the default and safe scripts
against the target that we found earlier.
That script was taking a little bit too long,
so I'm going to clear the screen.
But you get the point.
You can run multiple categories by
simply naming the category and separating by a comma.
The same is true with a particular script.
I'm currently in the scripts folder of Nmap.
I'll do a dir again,
there's a ton of them here.
Let's say I'm interested in these vnc scripts.
I'll do a dir *vnc*.* wildcards.
Here's all the scripts related to vnc.
I'm interested in vnc info and vnc title.
I can do nmap --script
and see info and vnc tittle.
We'll do against the same target.
My point is, next to the script,
you can put an equals sign if you want,
and you can either list the categories
that you're interested in or you can actually
put the specific scripts.
We've got our results. I'll move on to the next thing,
and that is one of the most important reasons
why I wanted to do this lab.
That is, now that we found
our Cisco switch on our network,
I want to do a vulnerability scan against it.
In Nmap, one of the simplest ways that you can do
a vulnerability scan against
any device is by using the category vuln.
We'll do nmap --script category
vuln against the Cisco switch.
The script takes a little bit of time,
so I'll cut the video and once the results come back,
we'll talk about them. There's our results.
I'm going to scroll up.
Essentially that ran every nse script
that had a category of vulnerability or vuln.
I entered a bunch of times to see the status,
but you can see several different vulnerabilities here.
It's not vulnerable to this dos attack.
Does that telnet open,
shows that it's vulnerable to
authentication bypass by HTTP Verb tampering,
gives all the details here,
the URLs where you can find
out more information about those vulnerabilities.
It's really interesting information to me.
I would like to try to
attack and exploit some of those vulnerabilities.
I'm going to clear the screen.