Enhance security audits with Nmap and NSE scripts

<p>Nmap is one of the most critical network scanning and security assessment tools in a security admin’s arsenal. While many use it regularly to run basic scans, most admins are not familiar with the available Nmap Scripting Engine (NSE), which automates many useful functions and extends Nmap’s capabilities well beyond the basic singular commands.</p>
<p>One key use case is combining an Nmap scan with an NSE <a href=”https://www.techtarget.com/searchsecurity/definition/brute-force-cracking”>brute-force password attack</a> against detected SSH systems. Follow along for instructions and to learn more about Nmap’s extensibility in modern network assessment and penetration testing.</p>
<section class=”section main-article-chapter” data-menu-title=”Background: Nmap and the Nmap Scripting Engine”>
<h2 class=”section-title”><i class=”icon” data-icon=”1″></i>Background: Nmap and the Nmap Scripting Engine</h2>
<p>Learning to use Nmap effectively enables system, network and security admins to explore and audit their environments, proving compliance and validating configurations. Begin by learning Nmap basics before exploring the NSE.</p>
<h3>What is Nmap?</h3>
<p>Nmap is a revolutionary tool that has aided network admins and pen testers for decades. It scans network environments and generates reports on host discovery, <a href=”https://www.techtarget.com/searchsecurity/feature/How-to-use-Nmap-to-scan-for-open-ports”>open ports</a>, OSes, service enumeration and more.</p>
<p>Review the following basic Nmap examples to understand the command syntax.</p>
<p>Basic scan of a single host using the top 1000 ports:</p>
<pre><span style=”font-family: ‘courier new’, courier, monospace;”>nmap 192.168.2.200</span></pre>
<p>Basic scan of an entire subnet:</p>
<pre><span style=”font-family: ‘courier new’, courier, monospace;”>nmap 192.168.2.0/24</span></pre>
<p>Advanced and aggressive stealth and detection scan:</p>
<pre><span style=”font-family: ‘courier new’, courier, monospace;”>nmap -sS -sV -O -A -p- 192.168.2.200</span></pre>
<p>Many admins generate a large amount of useful information with these simple scans, and some never use Nmap beyond these fundamental capabilities. However, Nmap includes far more functionality, including automation options.</p>
<h3>What is the Nmap Scripting Engine?</h3>
<p>NSE is a Lua-based framework built into Nmap to automate workflows and extend the tool’s functionality beyond standard discovery scans. It enables users to share scripts that turn Nmap into an even more helpful tool. The NSE is an <a target=”_blank” href=”https://nmap.org/book/man-nse.html” rel=”noopener”>official component of Nmap</a> and can be found at the primary Nmap homepage. It includes <a target=”_blank” href=”https://nmap.org/book/nse.html” rel=”noopener”>extensive documentation</a>.</p>
<p>Scripts are identified by one or more categories to help admins find them and understand their use. Category examples include the following:</p>
<ul class=”default-list”>
<li><span style=”font-family: ‘courier new’, courier, monospace;”>auth</span> examines authentication credentials.</li>
<li><span style=”font-family: ‘courier new’, courier, monospace;”>brute</span> attempts brute-force authentication.</li>
<li><span style=”font-family: ‘courier new’, courier, monospace;”>discovery</span> queries additional resources to find more detailed target information.</li>
<li><span style=”font-family: ‘courier new’, courier, monospace;”>fuzzer</span> sends unexpected information to targets to test capabilities.</li>
<li><span style=”font-family: ‘courier new’, courier, monospace;”>safe</span> contains scripts not designed to disrupt services.</li>
<li><span style=”font-family: ‘courier new’, courier, monospace;”>vuln</span> checks for and reports known vulnerabilities without disrupting services.</li>
</ul>
<p>The <span style=”font-family: ‘courier new’, courier, monospace;”>default</span>&nbsp;category consists of a standard set of automated tasks. Explore its capabilities before running it on production systems. Check out the <a target=”_blank” href=”https://nmap.org/book/nse-usage.html#nse-categories” rel=”noopener”>full list of NSE script categories</a>.</p>
<p>Call these scripts by adding the <span style=”font-family: ‘courier new’, courier, monospace;”>-sC</span> or <span style=”font-family: ‘courier new’, courier, monospace;”>–script</span> options to standard Nmap commands

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.