The Nmap Scripting Engine

The Nmap Scripting Engine (NSE) extends Nmap with scripts written in Lua. It turns Nmap from a port scanner into a flexible automation platform for discovery, version detection, vulnerability checks, and more.

Thousands of community scripts ship with Nmap, covering an enormous range of services and tasks.

NSE scripts are grouped into categories that describe their behavior and risk:

• safe: unlikely to harm the target.
• intrusive: may crash or disrupt services.
• vuln: checks for known vulnerabilities.
• auth, brute, discovery, exploit, malware: focused purposes.

Categories let you run a whole class of scripts at once.

The -sC flag runs the default script set, a curated group of safe, useful scripts. It is equivalent to --script=default.

This is a great first pass: it grabs banners, enumerates basic info, and finds low-hanging detail without being intrusive.

Use --script to run a named script, a comma list, a category, or even a wildcard pattern.

You can launch entire categories. Running the vuln category checks the target against many known-vulnerability scripts at once.

Combine categories with boolean expressions to control exactly what runs.

Many scripts accept arguments via --script-args, for example credentials, wordlist paths, or target URLs.

NSE includes powerful vuln scripts. vulners queries a CVE database based on detected versions, while service-specific scripts test exact flaws like smb-vuln-ms17-010 (EternalBlue).

These checks must be authorized; vuln scripts can be intrusive and may affect fragile systems.

Scripts are stored in Nmap's scripts directory, typically /usr/share/nmap/scripts. An index database lets Nmap resolve categories and names.

After adding new scripts, refresh the index so they are recognized.

To discover useful scripts, search the scripts directory or read help text. The --script-help flag prints a script's description and arguments before you run it.

NSE shines when combined with version detection so scripts know which services to target. A typical thorough scan pairs -sV with scripts and saves output.

Use intrusive categories cautiously and always within your authorized scope.

Because NSE uses Lua, you can write custom scripts for unusual services or repeated checks. A script defines which ports/services it targets (a rule) and an action function that runs against matches.

You do not need to write scripts to be effective, but knowing the engine is extensible explains why NSE keeps growing and why a script likely exists for almost any service you meet.

Reason about script categories and risk.

You learned the Nmap Scripting Engine:

• NSE runs Lua scripts grouped into categories (safe, intrusive, vuln, brute, etc.).
• -sC runs the safe default set; --script runs names, patterns, or categories.
• Pass --script-args for credentials and options; check --script-help first.
• Vuln scripts like vulners and smb-vuln-ms17-010 find known flaws.
• Combine with -sV and save with -oA; use intrusive scripts only when authorized.

This completes Nmap Deep Dive and the EthicalHacking extra modules.