NSE Vulnerability Scripts
As an alternative to Nessus,
we can also use the Nmap Scripting Engine (NSE)
to perform automated vulnerability scans.
NSE scripts extend the basic functionality
of Nmap to conduct a variety of networking tasks.
These tasks are grouped into categories around cases such as
vulnerability detection,
brute forcing, and network discovery.
The scripts can also extend the version detection
and information gathering capabilities of Nmap.
An NSE script can have more than one category.
For example, it can be categorized as safe and vuln, or intrusive and vuln.
Scripts categorized as “safe” have no potential impact to stability,
while scripts in the “intrusive” category might crash a target service or system.
To avoid any stability issues, it’s imperative to check how the scripts
are categorized and we should never run an NSE script
or category without understanding the implications.
We can determine the categories of a script by browsing the NSE Documentation
or locally in the NSE scripts directory.
In this section, we will focus on the vuln category to leverage Nmap
as a lightweight vulnerability scanner.
On our Kali VM, the NSE scripts can be found in the
/usr/share/nmap/scripts/ directory with the .nse filetype.
This directory also contains the script.db file,
which serves as an index to all currently available NSE scripts.
We can use it to get a list of scripts in the vuln category.
Each entry has a file name and categories.
The file name represents the name of the NSE script in the NSE directory.
Some of the standard NSE scripts are quite outdated.
Fortunately, the vulners script was integrated, which provides current
vulnerability information about detected service versions from
the Vulners Vulnerability Database.
The script itself has the categories safe, vuln, and external.
Before we start our first vulnerability scan with the NSE,
we will examine the Nmap --script parameter.
This parameter is responsible for determining which NSE scripts
get executed in a scan.
The arguments for this parameter can be a category,
a Boolean expression, a comma-separated list of categories,
the full or wildcard-specified name of a NSE script in script.db,
or an absolute path to a specific script.
Let’s start with an Nmap scan using all of the NSE scripts from the vuln category.
The command we’ll use contains the previously mentioned --script parameter
with the vuln argument, which specifies all of the scripts with this category.
Furthermore, we’ll provide -sV to activate the Nmap’s service detection capabilities.
Finally, we’ll use -p to only scan port 443.
Nmap detected the Apache service with the version 2.4.49 and tried all of the
NSE scripts from the vuln category.
Most of the output comes from the vulners script,
which uses the information from the detected service and version to
provide related vulnerability data.
The vulners script not only shows us information about the CVEs found
but also the CVSS scores and links for additional information.
For example, our output shows that Nmap, in combination with the vulners script,
detected that the target is vulnerable to CVE-2021-41773.
Another useful feature of the vulners script is that it also lists
Proof of Concepts for the found vulnerabilities,
which are marked with “*EXPLOIT*”.
However, without a successful service detection,
the vulners script will not provide any results.