Here is another example source of an Nmap script.
In addition to the code part which is to execute the job of the script. It includes some additional sections
such as description, categories, usage, author license type etc..
Instead of probing the script code to understand the details of an Nmap script you can use -­script­help parameter
of Nmap command.
You will see the name, the categories, the link, to deep search and the description sections as the result
of the ­-script­help query.
So you've heard me say before but I really need to emphasize the importance of the service and version
detection
once again in this Nmap scripting lecture. As you know, if you don't run the version detection
Nmap supposes that the default service is running on that port. In a script scan, Nmap supposes the default
services running on the port so it runs the scripts as if they are suitable for that service.
It's easy to see it in an Nmap query.
OK.
Open a terminal screen in Kali.
I use netstat command to see the listening ports. As you see, SSH service is running, but it's not running
on port 22.
Instead it's running on port 443 and as you know 443 is the default port of
HTTPS service.
So if I run a port scan for my Kali's port 443 without adding the version detection option,
Nmap signs the port as running an HTTPS service.
Now if I had the SSH scripts in this query using “-­script ssh*”, without the version detection, not
any of the scripts run. Because Nmap thinks that this service is HTTPS, not SSH and does not run the
SSH scripts.
So I call the latest Nmap query and version detection using the "-sV" this time.
Like that, SSH scripts are started with the version detection option Nmap finds that the
service is SSH and not HTTPS.
Very important.
OK.
SSH brute script takes a long time to run.
We already got the point so no need to wait for the results of the scripts.