Using NSE scripts in nmap - Network Security

chroniccommand

[Intro]
Nmap Scripting Language. NSE scripts. What are they? They're scripts written by coders for nmap. They're coded in the LUA language. They can be found at http://nmap.org/nsedoc/

[Using them]
Using NSE scripts is simple. NSE is built right into the nmap command line. For example, lets say we want to use the 'safe' script 'finger'. Which attempts to retrieve a list of usernames from the database. We can use a regular nmap scan and add the script on. For this particular script, we can use it like so:

nmap -sV -sC &lt;target&gt;

And we would get this type output


PORT   STATE SERVICE
79/tcp open  finger
| finger&#58;
| Welcome to Linux version 2&#46;6&#46;31&#46;12-0&#46;2-default at linux-pb94&#46;site !
|  01&#58;14am  up  18&#58;54,  4 users,  load average&#58; 0&#46;14, 0&#46;08, 0&#46;01
|
| Login      Name                  Tty      Idle  Login Time   Where
| Gutek      Ange Gutek           *&#58;0          -     Wed 06&#58;19 console
| Gutek      Ange Gutek            pts/1   18&#58;54     Wed 06&#58;20
| Gutek      Ange Gutek           *pts/0       -     Thu 00&#58;41
|_Gutek      Ange Gutek           *pts/4       3     Thu 01&#58;06

Now we have the user list.

There are more sections on the nmap NSEdoc section. Such as malware, intrusive, auth etc. Lets say we want to use intrusive. Intrusive means system admins will be more alerted by these scripts. Lets say we want to use ftp-brute, which brute forces an ftp password.


nmap -sV --script=ftp-brute &lt;target&gt;

And we would get this output:


PORT   STATE SERVICE REASON
21/tcp open  ftp     syn-ack
|  ftp-brute&#58;
|  |  anonymous&#58; IEUser@
|_ |_ test&#58; password

You can change to any script by changing the '--script=' on the command line.

[more]
So instead of be a bit of a skid and use other users NSE scripts, you can code your own if you'd like. LUA is a pretty portable language and looks pretty easy. More info can be found HERE or you can google how to code NSE scripts. They looks pretty easy if you know what you're doing.

_st4ck3D*

As always well done written. Nice guide too. Thanks for the share.

Xin

Nice guide chronic, i recently read about these in a nmap book i got

Bursihido

great guide chronic :)

Howdy, Stranger!

Top Posters

Who's Online (2)