Hello, everyone.
So in this video we are going to see in maps
one of the most powerful feature which
is called as the scripting engine.
So what is nmap scripting engine?
By using nmaps scripting engine. We
are going to find vulnerable versions which
are running onto the target IP address
and domain names.
With the help of the nmap scripting engine we can
identify vulnerabilities which are running on web applications
like WordPress. We can
also identify vulnerabilities on SQL servers.
We can also identify vulnerabilities which
are running on WordPress and also we can identify
the web application firewall, which
is running onto any web application.
so
Here in this video. We are going to see default safe
scripts for nmap.
To do this type of scan you have to use the
syntax and map the target IP address
and hyphen SC when you
will give hyphen SC and map will start
scanning the target for some default save Scripts.
So you can always scan the Target by giving this
particular flag, which is hyphen SC.
You can also add hyphen V to see the
output in verbose mode the example of running
this can be and map the target IP
address like this followed by hyphen SC and
if you want to see the output inverse mode, you can give
hyphen V.
So it is practical time and let's see this type
of scan in action.
Over here as you can see on my terminal. I'm
going to type the command, which is nmap.
my target IP address
followed by
Hyphen, SC to run the default
set of scripts which are safe
Scripts.
Then I'm going to scan the ports from 1 to
200 followed by hyphen V to see
the output in verbose mode.
As you can see and map scan has started
already and nmap has identified couple of
things into the scan.
so, let's see what nmap has identified based on the
hyphen SC script
As you can see HTTP methods, what are
the supported methods on the target? As you
can see the supported methods are options head get
and post.
Nmap, has also identified. What is there
on the RPC info? As you can see the RPC
info has also been identified if you
move up you can see on Port 80 which
is the HTTP web server is running and map
is able to do the directory listing and is
able to identify whatever is there into the
servers?
The directory as you can see the files, which is
this file, which is a APK next is
a back door. Then it is a image and different
types of files like JavaScript HTF files
are also present. So by this
way, we can also identify whatever is hosted
onto the particular server.
Also, if you see the port 22, which is running on
SSH we are able to identify the SSH
host key.
Perfect. So this was one of the way to see
whatever was running on that particular.
server by running the SC flag
if I run -script equals to
default the output is exactly the same that you
saw which means you can either use hyphen SC or
either you can use hyphen hyphen default.
It is exactly the same.
So I hope you guys understood this. Thank you.