Nmap Scripting Engine (NSE) Part 4 - Usage and Cool Scripts

Continuing with Nmap scripts.

Third parties have created scripts that are not included in the main script base on Nmap.

So you need to download them, install them if you want to use on that is of course, and I've picked an example here. This is vulscan.

So in this example, you need to go here and you need to find these scripts to download here.

It is in download and you would make a note of this here.

You can see there in the bottom, left the tar file that you would download and let's pop back to here, vulscan, which is the example I'm using here.

What this does is based on this, which is the version information, the version discovery, the minus S capital.

V vulscan searches, downloaded databases for known vulnerabilities.

So think of it as a basic vulnerability scanner and asked, talked about known databases.

So let's pop over to here. I talked about the download a database.

So I said note the URL from before, and that is this, we need to go to the Nmap, script directory.

And from there we want to download the script and this case is actually a tar file and not just a straight NSE file.

So this is a little bit more complicated because we have to untie it as well, but let's download that and see there it's downloading.

So then we've got. untar this file.

So we need to do a tar X V F, and importantly, we need Z as well, because this is a tar and a gun zip file.

And then we need to select the file, which is there.

So that's untar that. If you do an LS - LA and we can see that it is now in there.

And if we change to that directory, And there he would go, we can see the vulnerability databases there and we can also see the vulscan script.

So that's how you download and install a script.

If we Pop back here, this then allows us to run this script because it can see it because it's in the right directory.

So let's give that a quick run.

And there we go. We can see the output of it, which is quite a lot.

But as I said, that is a basic vulnerability scanner.

And based on the version, it gives you feedback on what it sees as vulnerabilities.

I've actually found the script to not be that useful.

There are better vulnerability scanners that are out there that you can get your hands on, such as Qualys, Nessus and openvas.

Let's pop onto this tap here. I want to introduce something new to you as well.

If we pop over to help, actually, this is the arguments option, which you can see here. We brought back here.

We can see I've included an argument in here. vulscan interactive equals warm.

This will make this script. In this case, in this example, interactive through an identifies certain software, it gives you the option to edit it.

But the point is I'm letting you know that there are arguments for many screens.

But you can also include how'd, you know, if they have an argument or not.

Well, if you look in the Nmap, script categories, page, you'll find details about vul script arguments are available for each script.

If you're not quite sure where that is, then you can run this command here, which is Nmap.

And then the name of the script. So I've chosen this script.

And there we go. It's got the URL here.

If we click on there, that's going to provide more information on the arguments that are available, that we can invoke with this dash dash scripts args.

And here is another example.

So I'm using that SNMP, SYSdescR again, revoking the script args, and then I'm including an argument here.

With the variable. So in this case, I'm telling it to use admin as the SNMP community ID or the community string.

And as I said to find out more about that, you would go to this URL here and you can simply put in anything here.

So banner could find out about the banner script, et cetera, also. There is this too.

Some scripts receive a file as part of an argument.

So you can include a file name in there as well.

So that's the arguments, the fact that you can include arguments in Nmap and how to do it, we'll go through some other interesting scripts now and how to use them and the arguments that you need to.

Here. This is a script that enables you to check if a http proxy is up as the http dash open dash proxy, and then you specify the port or where the proxy is, and then the IP address and the range.

And then we'll let you know whether or not there is a proxy up on any of those, which there is not on this network.

Pop onto this one. As I've mentioned, there are brute force scripts to try and crack passwords of accounts with various services like http, like WordPress, specifically, SSH, email, et cetera, that are bundled in with Nmap.

And there's, here's an example of, http brutes, and how to use it.

We're specifying the port http brute.

Is the name of the script and we're giving it arguments.

And the argument we're giving it is http brute and the path, the path, the way we're trying to brute force that's one example of how you might use it.

Well, there are arguments that you can use here.

We can specify, for example, the user database, the password database, based on files that we're giving it.

And many of the brute forcing tools work with similar syntax.

But again, as I've said, you need to go to the Nmap.Org page for the script, and it will show you the various arguments that you can use for the scripts.

Another argument that it will show you is the script-args argument, brute. first only.

And that will enable the script to quit after finding one valid account, which could be useful if you're just looking for a single account to access something.

And as I mentioned, even have specific brute force attackers.

This one is for WordPress and you can specify arguments.

Like in this case, we can specify the number of threads that it is used.

And quite a few other arguments as well.

And there are brute force script for other content management systems as well, like Joomla.

And the final brute force example that I provide is SMTP brute, which is a brute force for pop and iMac and SMTP.

And as I said, if you're interested in force scripts, then go check out the Nmap page on that particular script or those particular scripts for more details on the arguments that you need to use.

Another interesting script we've got here.

There's a script that can detect or attempt to detect if a server is behind an application firewall such as mod secure.

So you run this against the web server and it will provide you it's feedback on whether or not it thinks it is behind a application firewall.

Let's try that one and we've got no results.

So it does not believe it's behind a firewall.

Not at this time, I showed you a script before for detecting cross site scripting.

Here's another one for detecting cross site scripting vulnerabilities, which we can run and new specify port 80, or port 4 43, which returns no results.

Pop onto this tab. And equally we can look for sequel injection vulnerabilities on port 80 using this http-sql-injection.

There are a lot of scripts within Nmap that query databases and my sequel in particularly and other databases.

So here is an example of my SQL dash databases, giving it the arguments of the usernames or username in this case and password and other database scripts include brute forcing queries and other features.

You can use Nmap detect open relays.

If you're not aware and open relay or insecure email servers that allow third-party domains to use them without authorization, they are abused by spammers and fishers, and they present a reasonably serious risks to organizations because.

Public spam blacklist may then add those servers that are being used, which then affects your entire organization in terms of its use of email.

You don't have so many SMTP open relays anymore because people just, well, really aren't that stupid anymore, but this is how you can search and find them.

And there certainly are some, the ostial out there and this might be something that you would do more likely with something like i capital R.

And then a whole bunch of servers that you're going to randomly check, but if you were going to do that, you'd want to specify the port and you'd want to do no name, resolution, and pause the discovery as well, just to make sure you speed it up.

And finally for this lecture, this option updates, the script database found in scripts dash script dot DV, which is used by Nmap to determine the available default scripts and categories.

It is only necessary to update the database.

If you have added or removed NSE scripts from the default scripts directory, or if you've changed the categories of any of the scripts.

So there you go. That's the output. So there you go.

I've gone through quite an eclectic collection of various scripts and how to use them, the arguments, how to use arguments and all the various variables.

And you can see here in help, it provides somewhat of a breakdown of how to use scripts there.