‫OK, so let's get to it.
‫Nessie is activated with the surrogacy option or scrip if you wish to specify a custom set of scripts.
‫Script scanning is normally done in combination with a port scan because grips may be run or not run,
‫depending on the port states found by the scan.
‫You can use s a C to perform a script scan using the default set of scripts.
‫It is equivalent to script equals default.
‫Now, wait a second now, what is this default?
‫Well, it is one of the categories of map script.
‫Let me show you.
‫And map scripting engine NSC script define a list of categories that they belong to.
‫So currently defined categories are off broadcast brut default.
‫Discovery does exploit external, fuzzier, intrusive malware.
‫Safe version and vom category names are not case sensitive, so let's give you a little detail.
‫Default scripts are the default set and are run when using the RJC rather than listing scripts with
‫script.
‫This category can also be specified explicitly like any other using script equals default.
‫Off script deal with authentication credentials or coincidentally bypassing them on the target system.
‫Examples include Oracle Enum users.
‫Boot script use brute force attacks to guess authentication credentials of a remote server and map contains
‫scripts for brute forcing dozens of protocols, including HTTP.
‫Brute.
‫Oracle Brute.
‫S&P Brute, etc. The scripts may cause a denial of service.
‫Sometimes this is done to test vulnerability to a denial of service method, but more commonly it's
‫an undesired by necessary side effect of testing for a traditional vulnerability.
‫These tests sometimes crash vulnerable services.
‫Export scripts aim to actively exploit some vulnerability.
‫Examples include HTP Shellshock now, scripts which weren't designed to crash services use large amounts
‫of network bandwidth or other resources, or exploit security holes that are usually categorized as
‫safe.
‫Intrusive scripts are those that cannot be classified in the safe category because the risks are just
‫too high that they're going to crash the target system.
‫Use up significant resources on the target host, such as bandwidth or CPU time or otherwise be perceived
‫as malicious by the target system administrators.
‫Malware script test, whether the target platform is infected by malware or backdoors.
‫Version scripts are an extension to the version detection feature and cannot be selected explicitly,
‫they're selected to run only if version detection that s uppercase v was requested and volun script
‫check for specific known vulnerabilities and generally only report results if they're found.
‫You can alternatively use script parameter to run a script scan using the comma separated list of file
‫names, script categories and directories.
‫Each element in the list may also be a Boolean expression, describing a more complex set of scripts.
‫For example, if you use script parameter using the default and safe expression, the scripts which
‫are in both default and safe categories, run that makes sense.
‫Script update DB option updates, the script database found in script slash script that DB, which is
‫used by in map to determine the available default scripts and categories, it's only necessary to update
‫the database if you have added or removed NSC scripts from the default scripts directory, or if you've
‫changed the categories of any script.
‫This option is used by itself without arguments.
‫OK, so let's see some of these scripts and try to use them.
‫Open a terminal screening collie.
‫To find out the scripts used to locate the next command since the file extension and been map scripts
‫are NSC type, locate, asterisk, dot, nrsi and hit enter.
‫It'll locate the files, which end with Dot Nrsi.
‫This is where the end map scripts are located in college by default.
‫Go to the folder using the CD command, I select the path and press the middle button of my mouse to
‫copy and paste it and hit Enter.
‫Now let's look at the script.
‫DB File First, which is a script database used by end map.
‫It's in this folder.
‫I use less command to look at the content of the file.
‫Every row contains a script, file name and its categories, so now we can see the usage of and map
‫scripts.
‫I want to try S.H. scripts on my Metasploit able VM first with the help of Linux grep command.
‫Once again, I want to list the S-H script.
‫Here are the scripts that have the each word in their names.
‫To analyze the content of a script, I use less command.
‫Now let's look at a file, for example, each host I didn't see the script file has a description.
‫A usage section and many more lines.
‫I want to show you the category section of the script in the last command, you can use it slash key
‫to search a word press slash type Kate and hit enter.
‫Here it found Kate in the word duplicate.
‫This is not what we're looking for it.
‫So pressing and key to find the next Kate word again, duplicate press and once again.
‫And we found a category section.
‫Alternatively, you can use this script help and map parameter to get help about an end map, script
‫type and map.
‫Script help.
‫And then the script name file extension is optional here.
‫It's OK if you don't use the extension.
‫Here's a brief summary of the speech host key script script name a link to learn more about it and the
‫description of the script.
‫Now, look at the description of the Sage host key script.
‫It shows the target SSA servers, key fingerprint and with high enough verbosity level, the public
‫key itself.
‫Now, let's run a few and map commands and use some scripts.
‫Prepare the map command TCP Syn scan.
‫Don't forget to find the port of your interest.
‫First, I want to run the default SSA scripts using the sobriquet C parameter.
‫SSA host is the default script for SSA service.
‫And here are the target SSA servers, key fingerprints In the description of the script, we saw that
‫if the verbosity level is high enough, the script will show the public key itself to see it.
‫I want to run the map command again, but this time I use the Turbo V to increase the verbosity level.
‫Now we have the public keys as well as the fingerprints.