The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features and not
sysadmins or pentesters know about it.
It allows you to write and share simple scripts using Lua programming language to automate a wide
variety of networking tasks. Using NSE is crucial in order to automate system and vulnerability
scans.
In particular you'll be able to perform any sort of DNS enumeration, brute force attack,OS fingerprint
and banner grabbing, vulnerability detection and exploitation, backdoor identification, malware discovery, and
much more. In this lecture we’ll use only nmap nse scripts that come with the default installation of
nmap. There are approximately 600 scripts available; if you want to see the scripts available on
your machine you search for them using the locate come comment like this:
First we ran the updatedb to update the file database used by locate:
and thenlocate *.nse I'm searching for all n ac files.
These are the scripts; let's count them!
Let's see how many scripts are available wc -l
So on this machine there are 579 nse scripts available. Among the most useful nse
scripts are the vulnerability scanning scripts; these scripts are usually designed to find a specific
vulnerability of the running services on a target that can be later exploited by a hacker. To search
for those scripts
we run locate *vuln*.nse
These are vulnerabilities scanning scripts. And for example if we want to run a full vulnerability test
against a target we execute nmap --script voln -T4 it will run faster and the
target
This scan can take a few tens of secundes or maximum one minute. I am posing the recording until it's
over;
and we are presented with a full report of vulnerabilities discovered for the services that are running
on that host.
The scan has detected Common Vulnerabilities and Exposures or CVE. CVE stands for the common
vulnerabilities and exposures
and in plain English it simply means that's a way of organizing and categorizing software vulnerabilities.
This information can be highly useful for security researchers and penetration testers in their daily
tasks. With hundreds of NSC scripts available
we may need some help in determining what they do and how they work.
Let's find all available scripts related to ssh
And
now let's see the help of this one nmap --script -help and the name of the script
and we see the help of the script. As a last example of this lecture
let's lunch a brute force attack on an ftp server. This is the target and a ftp server called professional
ftp demon is running
I want to see its logs in real time tail -f /var/log/proftpd/proftpd.log These are the logs of
the server and I'm starting the brute force attack nmap --
script
ftp-brut-p 21 the port and the target.
And on the target host will see the ftp server logs in real time.
We notice the brute force attack that's in progress.
Note that the many nse scripts do not simulate the attack but really lunch it. Take care not to break
systems when testing nmap nse scripts! Okay!
That's all! In this lecture we saw that nmap is one of the most valuable reconnaissance tools used
both by black and white hat hackers.