Working with NSE Scripts
In the previous section,
we learned about the vuln NSE category and the vulners script.
While the vulners script
provides anoverview of all CVEs mapped to the detected version,
we sometimes want to check for a specific CVE.
This is especially helpful
when we want to scan a network for the existence of a vulnerability.
If we do this with the vulners script,
we would need to review an enormous amount of information.
For most modern vulnerabilities,
we need to integrate dedicated NSE scripts manually.
Let’s practice how to do this with CVE-2021-41773.
In order to find a suitable NSE script,
we can use a search engine to find the CVE number plus NSE.
One of the first search results
is a link to a GitHub page that provides a script to check for this vulnerability.
Let’s download this script
and save it using the same naming syntax as the other NSE scripts.
Before we can use the script,
we’ll need to update script.db with --script-updatedb.
To use the NSE script, we’ll provide the name of the script,
target information,
and port number.
We’ll also enable service detection.
The output indicates that the target is vulnerable to CVE-2021-41773
and provides us with additional background information.
While Nmap is not a vulnerability scanner in the traditional sense,
we found that the NSE is a powerful feature
that allows us to do lightweight vulnerability scanning.
In a penetration test, we can use Nmap
when there isn’t a full-fledged vulnerability scanner available
or when we want to verify findings from other tools.
However, we have the same factors to consider
as with any other vulnerability scanner.
The NSE script categories can provide useful information,
such as if a script is intrusive or safe,
but we also need to keep in mind that an NSE script may contain malicious code
that gives an attacker full access to our system.
For that reason,
we always need to verify that the NSE script
not only provides the needed functionality
but is also safe.