Nmap Scripting Engine (NSE) Part 2 - Usage and Cool Scripts

Continuing on now with Nmap scripts, we've got script types to talk about.

So there are four script types that you need to be aware of.

Every script has a rule and there are four types of those rules and we can see them here.

We've got the pre rule, we've got the host rule, we've got the port rule and we've got the post rule.

So the pre-rolls the pre-roll scripts, these run wants, and it's before any houses scanned is during the script pre scanning phase, and you've got the host role and the port role scripts.

And these run after each batch of hosts is scanned.

And then you have the post roll scripts, which run once after all hosts have been scanned in the script post scanning phase, and a script may run in more than one phase if it has several rules within it.

So let's pop over to.

And let me give you some examples of how to use scripts and go through some of the more useful scripts that you might want to use.

So here we can see that I've added the minus minus script as usual, and then I've added the default category as we've gone through the categories.

And you can see here with a calmer, I've also added the safe category.

Plus I'm adding verbose.

I'm also adding operating system detection and I'm also adding the detection of versioning.

Now that's because some script needs the input from versioning and arrest detection in order for the scripts to function correctly.

So I've added them here.

So what we've got here is a collection of the ones that don't cause any harm.

So let's hit return there and we're doing this against the host. Number 43 or 192.168.1.43. So we can see here.

Those are all the pre-rolls that are going through now that has gone through the discovery phase and it's running host rules and port rules that after it's done, those is going to do the post role.

And this will take a bit of time because we're asking Nmap to do quite a lot against this single host.

And it's finished there and we can also see the post-scan scripts here.

So if we scroll up, we'll see quite a number of scripts.

Cause obviously we've got default and safe, which is quite a lot of scripts and we can see them all.

So we can see we've got http dash comments, dash display.

We've got http day, http fetch, headers we can see all the different scripts that have been run and then all the results for those scripts.

And that of course is quite noisy and also takes quite a long time.

So often you would be more specific.

And of course you can see how it's detailed per port.

So on this particular port on this particular port, these are the scripts have been.

Against that port.

So instead of running against the entire categories, we can run against a single script.

So here, for example, we're running just the banner script.

We're just picking the ones that we want to run.

We can see initializing NSE script.

And there we go.

So the banner script is a banner grabber, which connects through an open TCP port and prints out anything sent by the listening service within five seconds.

And the more verbose as you had, the more viz, the more lines that it will return.

As you can see here, this is starting to give us the ciphers that it support. And if we scroll up, you'll notice here that I've got N = N.

Now you can have an equals in that, or you don't have to have one, so that's entirely optional.

So you can have dash dash script space banner, or you can have, as you can see here.

And here, we've got another example of a single script.

This will look for cross site scripting vulnerabilities, and we're using the minus capital PN and that's to skip the discovery.

Now that is a little tip there so that you can speed up the process because you know, you don't need a discovery in this instance, if like we now hear that this is a host that is op.

So why bother doing a discovery?

And we see the results here on port 80.

There is no previously reported cross-site scripting vulnerabilities.

Probably over the next tab here.

And again, we've got another single script example and this is HTTP dash site map desk generator.

And let's press return on this one.

I'll show you what this one does as a names.

Yes. This is a site map generator, and we can see the directory structure of this particular site on this poor.

Now this is far from perfect.

It's not a great spider, but it will find some base directory structures for you.

Problem to this tab.

Now, if it all we've done here, we don't have an equals.

We can't have an equals if we want.

And within quotes, we're putting http dash and then the wildcard, you can use wildcards in Nmap for the scripts.

So this would mean that we'll run all. http dash and then any name after that.

So this will effectively run all http script.

This will take a long time to run.

And one of the reasons for that is because it does brute force attack.

Some of the HTTP scripts do brute force attacks.

So you want to be careful with wildcards because they could include attacks like brute forcing, but now you can use the wildcards and you can use them at the beginning and the middle and the.

And http would also look for vulnerabilities.

So for example, there's an HTTP vulnerability called the method Tamper.

So that previous scan would have identified or would have run this script.

And we would have found potentially what this is finding on its own.

And we can see on this particular device, it as identified that it has got a vulnerability authentication bypass by http, verb, tampering.

And that's been identified by the http dash method dash Tamper script.

You have to spend a little bit of time going through the scripts, just identifying the ones that might be of interest to you.

But like I said, I'm go through some of the more interesting ones for you now.

Maybe we want to do a fast search for web servers or any type of server.

Really? We could do port 22 for SSH port 21 for FTP. No, to speed up the search, I'm going to add the -N so there is no name resolution that will speed it up.

Adding the minus a P N. So that will prevent discovery.

I specified. Just look at port 80 so that it doesn't waste time on the other ports.

And this dash dash open means it will only show results of ports are open or possibly open.

We're doing versioning, we're doing verbose and then we're adding the banner and we're heading the title and we're looking at 100 random web service.

So let's see what we get. So it found one.

So we're doing 100 random IP addresses.

So there we go. We randomly found an Apache server at shrine, 2.4.7 on, ubuntu.

This is the dance heritage coalition demo. And there we go.

It's providers, they requested resource, which is some sort of authentication.

They go a fast way of finding web servers or any particular server, depending on what port you put in there.

There's probably one to the next tab.

Here's another interesting thing you can do.

So you can attempt to enumerate DNS host names by brute force, guessing of common sub domains.

And I've also removed discovery to make this quicker.

I'm doing it on Facebook. So we'll see what sort of sub domains that Facebook has.

And there we go. So it's brute force or brute forced quite a few.

So we can see we've got app. We've got internet, we've got AP direct alpha.

Blog Citrix Citrix farm. They're mobile.

They're not a bad little tool. There's a reasonable list.

Actually, if you want a conclusive list of sub-domains, I would also recommend tools like fierce, the harvester and recon -N G.