Writing Nmap Scripting Engine (NSE) Scripts Good Version
If there isn't a can script to do a task that you need doing in Nmap, then the Nmap scripting engine NSE allows you to write simple scripts using the LUA LUA programming language to automate networking tasks or whatever task it is that you want doing LUA LUA is a light.
Cross-platform language that was designed for extending software applications.
So was a good choice for Nmap it's tiny to embed in Nmap with the entire source code binary for some platforms and documentation fitting onto no more than just a floppy disc.
So it doesn't bloat out Nmap LUA is widely used around the community and the internet and as well, the books and has been around since 1993.
All in all a good choice.
It's extensible. It hooks into Nmap fast parallel scripting engine.
So you get the benefit of that.
It's safe and secure.
So you won't end up with buffer overflows format, string vulnerabilities, etc.
It's portable works on all the systems that Nmap dose.
Which is obviously required.
It's interpreted. So you don't have to keep recompiling it as specific advantages for Nmap.
Nmap has added capability.
You can access through LUA, so there's protocol and help, uh, libraries and things like DNS, http, MSRPC, packet SNMP et cetera.
So you don't have to write that stuff yourself.
You can just access it via Lua there's protocol, brute forces, their support for SSL.
You can take the results from one script and plug it into another.
So, yeah, it's a pretty good choice.
LUA will be quick to pick up for anyone with experience with Python, Pearl, see those sorts of things and other security tools like Wireshark and snot also use LUA.
So let's take a look at a LUA script.
So here we all looking at RPC info and we can see the main information for this here.
And that is where the actual NSE script is.
So if we click on there and here we are at the top of the script for this.
Quickly run down.
It's just to give you an idea of what's in the script.
So we can see at the top here, this is the equivalent of imports in other languages and local variables.
We've got a description there.
We've got example output.
These are all comments by the way. So example, output.
We can see, obviously we've got the author, we've got the license, we've got the categories that it says discovery, default safe version.
And then remember I talked about the port role here as the port role. Every script needs a rule, and this is using port rule to indicate that this will run only on 1, 1, 1, or port 1, 1, 1. On TCP and UDP.
We've got the action.
Action is where the script does its work and it takes two parameters.
So you can see host and port, and then we can see RPC info.
This is where it's doing its main work.
And then finally, we can see a very small around of LUA script, which is making up the RPC info script or Nmap.
So you can see with the relatively small amount of code, you can do quite a lot.
Utilizing Nmap, added capabilities to LUA, such as its protocol and help a libraries support for SSL Nmap, fast parallel scripting engine, etc.
If we look here, we can see a reference manual for Lua, which is available for free.
Plus other books are available to buy.
And I would also recommend checking out.
This is a little bit old now, but it's definitely worth a read if you're interested in the Nmap scripting engine and interested in writing your own LUA scripts.
So there you go.
That's the scripting engine.