NSE Nmap has Hidden Potential

Nmap is THE go-to tool for network mapping. What you might not know is that it also has an absurd amount of power and flexibility due to the fact that it also functions as a vulnerability scanner and an exploitation framework! Not only that, but it also doubles as a replacement for netcat, aka The hacker’s sswiss army knife. Yep. every recent Nmap installation comes with Ncat, the modernized clone of netcat that supports ssl encryption. Making it the more practical of the two in today’s age of encryption.

Example usage:

$ ncat 192.168.1.100 80

Image result for billy mays

But wait there’s more!

Nmap now has the Nmap Scripting Engine. This gives it way more versatility than ever before. None of this is new news to alot of people I realize, but its a bit impressive if you take a step back and think about the fact that Nmap started off as a simple portscanner.

To use NSE we must first locate where all the scripts are so we can know what we’ve got as well as where to put new scripts that we might code ourselves and also where to put scripts we’ve taken from the internet.

If you’re on linux just type “locate *.nse”

$ locate *.nse
/usr/share/nmap/scripts/acarsd-info.nse
/usr/share/nmap/scripts/address-info.nse
/usr/share/nmap/scripts/afp-brute.nse
/usr/share/nmap/scripts/afp-ls.nse
/usr/share/nmap/scripts/afp-path-vuln.nse
/usr/share/nmap/scripts/afp-serverinfo.nse
/usr/share/nmap/scripts/afp-showmount.nse
/usr/share/nmap/scripts/ajp-auth.nse
/usr/share/nmap/scripts/ajp-brute.nse
/usr/share/nmap/scripts/ajp-headers.nse
/usr/share/nmap/scripts/ajp-methods.nse
/usr/share/nmap/scripts/ajp-request.nse
/usr/share/nmap/scripts/allseeingeye-info.nse
/usr/share/nmap/scripts/amqp-info.nse
/usr/share/nmap/scripts/asn-query.nse
...

Now we know where the scripts are installed, but how do we use it?

$ nmap -sC TargetNameHere

The above command will run the default scripts against a target (url or IP). The following is an example of how to use a specific script against a target.

$ nmap --script smb-check-vulns-nse 192.168.1.1

Now you know the basics, but the trick is to go out and learn how to write your own scripts. I’ll do that in a later tutorial if its asked for, but in the mean time, go and see if you can find some nse scripts written by other people. There is alot that people have accomplished on their own. Thats the beauty of open source. One example of this is nmap vulnerability scan on github (link below) They have a script that connects to several regularly updated vulnerability databases and scans from those. Check the github for usage and installation instructions. This is a powerful tool, so I leave it in your hands. Don’t do anything stupid with it.

https://github.com/scipag/vulscan

Leave a Reply

Your email address will not be published. Required fields are marked *