Nmap Scripting Engine (NSE) Part 1 Categories

And this lecture we're going to cover the Nmap scripting engine or NSE for short we're in the Nmap, help here.

And you can see some of the options for scripting minus S capital C being one of the main options that you use. If we pop over here to this tab here, if we do a locate on asterix dot N S E press return.

We're going to see a whole bunch of scripts.

These are the Nmap NSC scripts.

The Nmap scripting engine NSC is one of most powerful and flexible features.

It allows users to write and share if they wish simple scripts using the LUA programming language.

That's LUA to automate. A wide variety of network-based tasks.

And that would include things like network discovery, more sophisticated version detection and vulnerability detection.

And it can even be used for vulnerability exploitation too, and brute force attacking.

So you do need to know a little bit of LUA to write your own script, but the good news is there are nearly 600 scripts as of recording.

That are built into Nmap that you can use out of the box.

So think of NSC as the glue that binds all the features of Nmap together and allows you to extend Nmap to do what you wanted to do.

So here we are on the index page for the NSC doc page on nmap.org.

And if you look here, we can see all of the categories for the scripts, and then here the scripts themselves.

And if we click here, we can see all of the scripts just listed out.

So each script contains a field, associating it with one or more of those categories.

So each script fits into one or many of these categories.

So if I click on auth, for example, that will take me through to the auth scripts.

The auth scripts are for authentication or bypassing authentication.

If I click on one of the Auth script.

I scroll down a little bit.

I can see that it's in three categories, auth.

It should be also in default and also in safe.

So let's just pop back and back again.

And actually, if I just pop back here onto this tab, and if I do a locate on star auth star to NSE, Then there we go.

I will see the actual NSE scripts on my system that I can potentially use or back here.

So auth as I said, that's authentication or bypassing authentication.

You've got broadcast.

This is discovery of hosts, not listed on the command line by broadcasting on the local news.

Then you got brute was users, brute force attacks to guess authentication credentials.

You have default, which you saw already default is considered useful for discovery and provides useful information.

And those particular scripts and probes shouldn't look like an attack to a systems administrator.

If we pop back here.

So this tab here, we can see the -S C.

Now that is telling it to ruin the default script.

And I've added a minus V here, so we can just see, and we're scanning the scanme.nmap.org.

And this will take a little longer than usual because we are initiating the default scripts.

All of the scripts that are within default.

So let's press return now we've got it on verbose so he can see some extra data coming back.

And as I said, this will take a little bit longer than usual, but here we have some results already.

So that was pretty good.

So where exactly are the results? Well, you can see that.

So that is the SSH dash host key script.

And those, the results from that port, port 22 for that particular script.

So it's sharing the SSH keys.

Now this can be useful because it can help you uniquely identify machines, especially if they change their IP address.

And then if we look down here on port 80, we can see some more scripts have been run.

This one, this one, this one.

So http faveicon, another script.

This gets the favoricon.

If you're not familiar, that's the icon that you see in the top left of a browser.

If I click on here and that is a faveicon.

So, what this does is it gets the favoricon from the web page and matches it against a database of icons, of known web applications.

If there is a match, the name of the application is printed or otherwise you get this MD five hash of the icon data that you can see printed here.

So essentially that can help identify applications who are HTTP method and other script here.

And it's telling us what options are supporting.

By this HTTP server by sending an options request.

And if you see trace, delete, and port methods, these are potentially risky.

So it would need further investigation.

There's it just got, get head posts and options.

Then finally, the last script we can see that's been run here is http title, which is the names suggest shows the title on the index page.

And this is, go ahead, scan me.

So that gives you an idea of what sort of output you get from the screen.

Let's pop back here.

And we went through more on default.

That was a default that we've just run there against the scan, me Nmap server.

And then we've got discovery.

These scripts try to actively discover more about the network by querying public registries and really discovery the discovery scripts and ability to be Nmap is really their bread and butter.

It's what Nmap is really all about.

Then we have DOS, which is denial of service based scripts.

Exploit these aim to actively exploit some type of vulnerability.

External. These may send data to a third-party database or the network resource.

An example of this is like, who is, who is, would be an external script.

Fuzzer these are scripts which are designed to send service software unexpected, or randomized fields in each packet to discover errors in the way they handle that sort of random data.

Then we have intrusive.

These can crash the target system that can use up significant resources on the target house, such as bandwidth or CPU time or otherwise be perceived as malicious by the target systems administrator.

And we've got malware.

These are scripts that test whether a target platform is infected by a particular malware or backdoor safe as the name suggests these are safe scripts.

So she'll be okay to run.

Not invasive.

Version is an extension to the version detection feature and cannot be selected explicitly.

And then you have volume which will check for specific known vulnerabilities, and generally only reports resource if they are found.

And as you can see here, as of recording, we have 561.

So almost 600 scripts that are available to us.