OK.
So let's get to it.
NSE is activated with the "-sC" option or "--script". If you wish to specify a custom set of script.
Script scanning is normally done in combination with a port scan because scripts may be run or not run depending
on the ports states found by the scan.
You can use "-sC" to perform a script scan using the default set of scripts.
It is equivalent to -­­script=default
Now wait a second what is this "default"?
Well it is one of the categories of Nmap scripts.
Let me show you.
Nmap scripting engine and NSE script define a list of categories that they belong to.
So currently defined categories are auth, broadcast, brute, default. discovery, dos, exploit, external, fuzzer,
intrusive, malware, safe, version, and vuln. Category names are not case sensitive.
So let's give you a little detail.
Default scripts are the default set and are run when using the "-sC" rather than listing scripts with
"--script". This category can also be specified explicitly like any other using "-­script=default"
auth scripts deal with authentication credentials or co-incidentally bypassing them on the target system.
Examples include oracle-­enumusers. brute script use brute force attacks to guess authentication credentials
of a remote server. Nmap contains scripts for brute forcing dozens of protocols including http-­brute,
oracle-­brute, snmp-­brute, etc.
dos scripts may cause a denial of service.
Sometimes this is done to test vulnerability to a denial of service method but more commonly it's an
undesired by necessary side effect of testing for a traditional vulnerability.
These tests sometimes crash vulnerable services. exploit scripts aim to actively exploit some vulnerability.
Examples include http-­shellshock. Scripts which weren't designed to crash services use large amounts
of network bandwidth or other resources or exploit security holes that are usually categorized as safe.
intrusive scripts or those that cannot be classified in the safe category, because the risks are just
too high that they're going to crash the target system. Use up significant resources on a target host
such as bandwidth or CPU time or otherwise be perceived as malicious by the target system administrators.
malware script test whether the target platform is infected by malware or backdoors. version scripts are
an extension to the version detection feature and cannot be selected explicitly. They're selected to
run
only if version detection.
That's as (sV) was requested and vuln script check for specific known vulnerabilities and generally
only report results if they're found.
You can alternatively use --script parameter to run a script scan using the comma separated list of file
names, script categories and directories each element in the list may also be a boolean expression describing
a more complex set of script.
For example if you use script parameter using the "default and safe expression" the scripts which are
in both default and safe categories run
-­script-­updatedb option updates the script database found in scripts/script.db which is used
by Nmap to determine the available default scripts and categories. It is only necessary to update the database,
if you have added or removed NSE scripts from the default scripts directory or if you change the categories
of any script. This option is used by itself without argument.
OK so let's see some of these scripts and try to use them
open a terminal screen in Kali to find out the scripts use the "locate" Linux command.
Since the file extension of Nmap scripts are .nse type "locate *.nse" and hit enter. It will
locate the files which end ".nse".
This is where the Nmap scripts are located in Kali by default.
Go to the folder using the "cd" command.
I select the path and press the middle button of my mouse to copy and paste it and hit enter.
Now let's look at the script.db
file first, which is a script database used by Nmap.
It's in this folder.
I use less command to look at the content of the file.
Every row contains a script file name and its categories.
So now we can see the usage of Nmap script.
I want to try SSH scripts on my Metasploitable VM. First with the help of Linux "grep" command once
again I want to list the ssh scripts.
Here are the scripts that have the ssh word in their names. To analyze the content of a script,
I use "less" command.
Now let's look at a file for example.
ssh-­hostkey.nse
The script file has a description or usage section and many more lines. I want to show
the category section of the script. In the last command you can use a / key to search a word /
type "cate" and hit enter.
Here it found "cate" in the word duplicate.
This is not what we're looking for.
So press the "n" key to find the next "cate" word again duplicate press "n" once again and we found the
category section.
Alternatively you can use this "--script-help" and Nmap parameter to get help about an Nmap script.
Type “nmap -­scripthelp”
and then the script name. File extension is optional here
It's OK if you don't use the extension.
Here's a brief summary of the ssh-hostkey script: script name, a link to learn more about it and the description
of the script.
Now look at the description of the ssh-hostkey script.
It shows that target SSH server's key fingerprint and with high enough verbosity level the public key
itself.
Now let's run a few Nmap commands and use scripts prepare the nmap command:
TCP SYN scan
don't forget to define the port of your interest.
First I want to run the default SSH scripts using the "-sC" parameter ssh-­hostkey is the default script
for SSH Service and here are the target SSH server's key fingerprints. In the description of the script,
we saw that if the verbosity level is high enough the script will show the public key itself.
To see it.
I want to run the Nmap command again but this time I use the "-vvv" to increase the verbosity
level.
Now we have the public keys as well as the fingerprints.