In the Nmap lectures we have seen no port scan also known as ping scan,
different ways of scanning ports, SYN scan also known as half-open scanning, TCP scan, also known as TCP
connect scan, UDP scan, service and version detection and operating system detection.
Now let's deep dive and in Nmap. Nmap scripting engine or NSE is one of Nmap's most powerful and flexible
features.
It allows users to write simple scripts to automate a wide variety of networking tasks.
Now those scripts are then executed in parallel with the speed and efficiency you would expect from
Nmap.
Users can rely on the growing and diverse set of scripts distributed Nmap or write their own to
meet customer needs.
So, also a couple of things here.
Scripts are written in the embedded Lua programming language version 5.3. and NSE is activated
with the -sC option (or -­script if you wish to specify a custom set of scripts) and results are
integrated into Nmap normal and XML output.
The default place of Nmap embedded scripts is "/usr/share/nmap/scripts"
NSE was designed to be versatile with the following tasks in mind. Network Discovery: This is
the most powerful part of Nmap.
Examples include looking up whois data based on the target domain, querying RIPE for the target IP to
determine ownership,
SNMP queries, and listing available SMB shares and services. More sophisticated version detection:
The Nmap version detection system is able to recognize thousands of different services through its
probe and regular expression signature based matching system but it cannot recognize everything.
For example identifying the skype version 2 to service requires two independent probes which version detection
isn't flexible enough to handle. Nmap could also recognize more SNMP services
if it tried a few hundred different community names by brute force. But neither of these tasks are
well suited to traditional Nmap version detection but both are easily accomplished with NSE.
Vulnerability detection: when a new vulnerability is discovered you often want to scan your networks quickly. Identify
vulnerable systems before the bad guys do. While Nmap isn't a comprehensive vulnerability scanner NSE is
powerful enough to handle even demanding vulnerability checks.
Remember when the Heartbleed bug infected hundreds of thousands of systems worldwide and Nmap developers
responded with the SSL Heartbleed detection script within hours, under two days. Backdoor detection: Many
attackers in some automated worms leave backdoors to enable later entry.
Some of these can be detected by an Nmap's regular expression based version detection, but more complex
worms and back doors require NSE's advanced capabilities to reliably detect them. Vulnerability
exploitation: As a general scripting language NSE can even be used to exploit vulnerabilities rather
than just find them.
But of course it's not as powerful as exploit frameworks such as Metasploit.