Network Enumeration Scripting
Automate recon with Nmap NSE scripts and custom Python scanners.
Network Enumeration Scripting is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Automate Recon?
Manual scanning is slow and error-prone across large networks. Scripting wraps Nmap, Netcat, and other tools into repeatable pipelines that parse output and feed results into further analysis.
Nmap NSE Scripts Overview
The Nmap Scripting Engine (NSE) runs Lua scripts against discovered services. Scripts are organized into categories: auth, brute, default, discovery, exploit, safe, and vuln.
# Run default safe scripts
nmap -sC 192.168.1.100
# List all scripts
ls /usr/share/nmap/scripts/ | grep http
# Run specific script
nmap --script=http-title 192.168.1.100Common NSE Scripts
Key scripts for enumeration: http-title, http-headers, smb-enum-shares, ftp-anon, dns-brute, and ssh-hostkey.
nmap --script=smb-enum-shares -p 445 192.168.1.100
nmap --script=ftp-anon -p 21 192.168.1.100
nmap --script=dns-brute --script-args dns-brute.domain=target.com 192.168.1.1Vuln Category Scripts
The vuln category checks for known vulnerabilities. vuln scripts are noisier and may crash services — only use with explicit authorization.
sudo nmap --script=vuln 192.168.1.100
# Specific vuln checks:
nmap --script=ms17-010 -p 445 192.168.1.100 # EternalBlue
nmap --script=http-shellshock 192.168.1.100Parsing Nmap XML Output with Python
Nmap's -oX XML output is machine-readable. Python's python-libnmap library parses it cleanly for custom reporting or feeding into other tools.
# Install
pip install python-libnmap
# Parse results
from libnmap.parser import NmapParser
report = NmapParser.parse_fromfile("scan.xml")
for host in report.hosts:
for svc in host.services:
if svc.state == "open":
print(f"{host.address}:{svc.port} {svc.service}")Simple Python Port Scanner
Build a minimal port scanner using Python's socket module. Useful when Nmap is unavailable or you need a custom scanning approach.
import socket
from concurrent.futures import ThreadPoolExecutor
def scan_port(host, port):
try:
s = socket.socket()
s.settimeout(0.5)
s.connect((host, port))
print(f"Open: {port}")
s.close()
except: pass
with ThreadPoolExecutor(100) as ex:
for p in range(1, 1025):
ex.submit(scan_port, "192.168.1.100", p)Bash Enumeration One-Liners
Bash can quickly enumerate hosts and ports using /dev/tcp pseudo-device without any external tools.
# Check if port is open (bash built-in)
timeout 1 bash -c "echo >/dev/tcp/192.168.1.100/80" && echo open
# Loop over hosts
for i in $(seq 1 254); do
ping -c1 -W1 192.168.1.$i &>/dev/null && echo "192.168.1.$i up"
doneDNS Enumeration Scripting
Automate DNS enumeration with dnsrecon, amass, or custom scripts that query for A, MX, NS, TXT, and CNAME records and brute-force subdomains.
dnsrecon -d target.com -t std
amass enum -d target.com
# Manual zone transfer attempt
dig axfr target.com @ns1.target.comSMB Enumeration with enum4linux
enum4linux automates SMB enumeration: shares, users, groups, password policies, and OS info from Windows/Samba hosts without authentication.
enum4linux -a 192.168.1.100
# -a = all enumeration
# Shows: shares, users, groups,
# password policy, OS versionSNMP Enumeration
SNMP v1/v2c uses community strings (often "public") for authentication. Querying SNMP reveals system info, running processes, network interfaces, and installed software.
# Query with default community string
snmpwalk -c public -v2c 192.168.1.100
# Get system info only
snmpget -c public -v2c 192.168.1.100 1.3.6.1.2.1.1.1.0
# Brute force community strings
onesixtyone -c community.txt 192.168.1.100Organizing Output
Structured output is key for large engagements. Use directories per target, consistent naming (target_service_date), and tools like tmux logging to capture all terminal output.
Quick Check
Which Nmap NSE category runs checks for known vulnerabilities?
Summary: Enumeration Scripting
Scripting transforms individual tool commands into reproducible recon pipelines. Combine NSE scripts for quick targeted checks, Python for custom parsing and automation, Bash for fast host discovery, and specialized tools (enum4linux, dnsrecon, snmpwalk) for protocol-specific enumeration.
Frequently asked questions
Is the “Network Enumeration Scripting” lesson free?
Yes — the full text of “Network Enumeration Scripting” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Network Enumeration Scripting”?
Automate recon with Nmap NSE scripts and custom Python scanners. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Network Enumeration Scripting” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Nmap Port Scanning Techniques
- Service and OS Fingerprinting
- Netcat: The Swiss Army Knife
- Network Enumeration Scripting