Advanced Nmap: Scripting Engine (NSE)

The Nmap Scripting Engine (NSE) is a powerful extension that allows users to write and run scripts to automate a wide variety of networking tasks. Before NSE, Nmap was primarily a port scanner and OS/fingerprinting tool. With NSE, it becomes a full-fledged vulnerability scanner, service enumerator, and even a brute-forcing tool. The key motivation: penetration testers need to not only find open ports but also determine what services are running, their versions, and whether they have known vulnerabilities. NSE scripts can perform banner grabbing, SSL/TLS testing, brute-force attacks on authentication, and even exploit certain vulnerabilities.

NSE is built on the Lua programming language (version 5.3 in modern Nmap). Each script is a .nse file that contains a set of functions and rules. The NSE engine (the Nmap executable) loads scripts, parses their metadata (categories, dependencies, port rules), and executes them in parallel using a cooperative multitasking scheduler. The scheduler uses Lua coroutines — each script runs as a coroutine that can yield control back to the engine when waiting for network I/O. This allows hundreds of scripts to run concurrently without the overhead of threads or processes.

When Nmap starts with NSE enabled (e.g., via -sC or --script), it first performs the normal Nmap phases: target enumeration, host discovery, port scanning, and service/version detection. After that, it enters the script phase. The engine checks each script's prerule (a function that determines if the script should run before any scan), hostrule (runs once per host after scanning), portrule (runs per open port), or postrule (runs after all scans). Most scripts use portrule to target specific services (e.g., HTTP on port 80, SSH on port 22). The engine evaluates these rules and schedules scripts for execution.

A basic NSE script has the following structure:

local nmap = require "nmap"
local shortport = require "shortport"
local stdnse = require "stdnse"

-- Rule to run only on open port 80
portrule = shortport.portnumber(80, "tcp")

-- Action function
action = function(host, port)
    local socket = nmap.new_socket()
    socket:connect(host, port)
    socket:send("GET / HTTP/1.0\r
\r
")
    local response = socket:receive_lines(1)
    socket:close()
    return response
end

This script connects to port 80, sends an HTTP GET request, and returns the first line of the response. For the exam, you should understand the structure: description (metadata), author, license, categories, portrule, and action.

Running many scripts can be slow. Use --script-timeout to limit each script's runtime (default is 10 minutes). The --script-trace option shows detailed script execution (useful for debugging). For large scans, consider running only safe scripts first, then vuln on identified services.

The PT0-002 exam expects you to know:

Trap: Candidates often confuse -sC (default scripts) with -sV (version detection). Remember: -sC is for scripts, -sV is for version detection. Another trap: using --script=all runs every script, including intrusive ones that may crash services or trigger alarms. In a pentest, you typically start with safe and escalate.

A pentester is engaged to assess an internal network with 500 hosts. The goal is to identify vulnerable services without causing disruption. The pentester starts with a ping sweep (nmap -sn 10.0.0.0/16) to find live hosts, then runs a TCP SYN scan on top 1000 ports (nmap -sS -T4 --top-ports 1000 10.0.0.0/16 -oA initial). After identifying open ports, the pentester runs NSE default scripts (-sC) on each host. This reveals that several Windows servers have SMB signing disabled (smb-security-mode), a web server is running Apache 2.4.49 (vulnerable to path traversal via http-vuln-cve2021-41773), and an FTP server allows anonymous login (ftp-anon). The pentester then runs --script=vuln on those specific hosts to confirm vulnerabilities. The NSE output is saved as XML and imported into a reporting tool. Scale: scanning 500 hosts with default scripts takes about 30 minutes with -T4. Performance consideration: using --max-scan-delay 1000 prevents overwhelming the network. Misconfiguration: running --script=all would have included dos scripts that could crash services, alerting the blue team prematurely.

A pentester targets a public-facing web application. After discovering open ports 80 and 443, they run NSE scripts against the web server: nmap -p 80,443 --script=http-* target. This runs all HTTP-related scripts, including http-enum (directory brute-force), http-headers, http-methods, http-csrf, http-xssed, and http-sql-injection. The http-enum script uses a wordlist to find hidden directories like /admin and /backup. The http-methods script checks for dangerous HTTP methods (e.g., PUT, DELETE). The http-sql-injection script attempts basic SQL injection payloads. The pentester finds that the server allows PUT on /uploads, allowing file upload. They then use http-put script (custom) to upload a test file. Common pitfall: running http-sql-injection on a login page may cause account lockouts due to failed login attempts. The pentester should first run safe scripts, then intrusive ones with caution.

A pentester is testing an AWS VPC. Since Nmap scans can be noisy and may trigger IDS/IPS, they use a stealthy approach: nmap -sS -T2 --script=default --script-args=userdb=users.txt target. They focus on a single instance to minimize logs. The default scripts reveal an open Redis port (6379) without authentication (redis-info). The pentester then runs redis-brute to guess the password. They also run ssl-enum-ciphers on port 443 to check for weak ciphers. In cloud environments, NSE scripts like http-enum can be used to enumerate S3 buckets if the web application leaks bucket names. Performance: scanning across the internet requires careful timing to avoid rate limiting. Misconfiguration: forgetting to exclude the Nmap scanner's own IP from the target list (e.g., scanning a subnet that includes the scanner's own host).