# NSE

With nearly [600 scripts](https://nmap.org/nsedoc/) at your fingertips; You’ll be able to perform any sort of DNS enumeration, brute force attack, OS fingerprinting and banner grabbing, vulnerability detection and exploitation, backdoor identification, malware discovery, and much more.
\ <mark style="color:orange;">All NSE scripts can be found in the</mark> <mark style="color:orange;"></mark><mark style="color:orange;">**`/usr/share/nmap/scripts`**</mark> <mark style="color:orange;"></mark><mark style="color:orange;">directory.</mark>

{% hint style="info" %}
You can also make your own scripts in Lua
{% endhint %}

### Script Categories:

| Nmap Script Name                             | Description                                                                                                                                 |
| -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| <mark style="color:orange;">auth</mark>      | All sorts of authentication and user privilege scripts                                                                                      |
| <mark style="color:orange;">broadcast</mark> | Network discovery scripts that use broadcast petitions for intel gathering                                                                  |
| <mark style="color:orange;">brute</mark>     | Set of scripts for performing brute force attacks to guess access credentials                                                               |
| <mark style="color:orange;">default</mark>   | The most popular Nmap scripts, using -sC by default                                                                                         |
| <mark style="color:orange;">discovery</mark> | Scripts related to network, service and host discovery                                                                                      |
| <mark style="color:orange;">dos</mark>       | Denial of service attack scripts used to test and perform DOS and floods                                                                    |
| <mark style="color:orange;">exploit</mark>   | Used to perform service exploitation on different CVEs                                                                                      |
| <mark style="color:orange;">external</mark>  | Scripts that rely on 3rd party services or data                                                                                             |
| <mark style="color:orange;">fuzzer</mark>    | Used to perform fussing attacks against apps, services or networks                                                                          |
| <mark style="color:orange;">intrusive</mark> | All the ‘aggressive’ scripts that cause a lot of network noise                                                                              |
| <mark style="color:orange;">malware</mark>   | Malware detections and exploration scripts                                                                                                  |
| <mark style="color:orange;">safe</mark>      | Safe and non-intrusive/noisy scripts                                                                                                        |
| <mark style="color:orange;">version</mark>   | OS, service and software detection scripts                                                                                                  |
| <mark style="color:orange;">vuln</mark>      | The [Nmap vuln](https://securitytrails.com/blog/nmap-vulnerability-scan) category includes vulnerability detection and exploitation scripts |

## Search example:

Various ways to list/find NSE scripts without manually searching.

`#`<mark style="color:green;">`ls -l /user/share/nmap/scripts/ |grep smb`</mark>

`#`` `<mark style="color:green;">`ls -l /usr/share/nmap/scripts/smb*`</mark>&#x20;

`#`<mark style="color:green;">`ls -l *vuln*`</mark>&#x20;

`#`<mark style="color:green;">`locate -r '\.nse$' | grep smb`</mark>&#x20;

The NMAP NSE dir also has a file named script.db that serves as an index of all of the scripts. This could also be grep'ed to look for scripts of certain categories for example.

### Get Script Help:&#xD;

`#`<mark style="color:green;">`nmap --script-help dns-zone-transfer`</mark>

<mark style="color:yellow;">-sC</mark> or <mark style="color:yellow;">--script</mark> (custom scripts) sC starts the scripting engine
\ <mark style="color:yellow;">-A</mark> aggressive script checking using defaults rather than safe scripts. And implies <mark style="color:yellow;">-sC</mark>

## Scan Examples

#### Aggressive NSE w/ ports:&#xD;

`#`<mark style="color:green;">`nmap -A -p22,11,139 -T4 10.10.10.10`</mark>

**Run all scripts of a category:**
\\

`#`<mark style="color:green;">`nmap --script vuln 10.10.10.79`</mark>

L**oads all scripts in the default and safe categories.**
\
`#`<mark style="color:green;">`nmap --script default,safe 10.10.10.10`</mark>

L**oads every script except for those in the intrusive category.**
\
`#`<mark style="color:green;">`nmap --script "not intrusive" 10.10.10.10`</mark>

**Loads single script. Note that the .nse extension is optional.**
\
`#`<mark style="color:green;">`nmap --script smb-os-discovery 10.10.10.10`</mark>`
`&#x9;

**Loads the script in the default category, the banner script, and all .nse files in the directory /home/user/custom scripts. Can also use '\*' wildcards here.**
\
`#`<mark style="color:green;">`nmap --script default,banner,/home/user/customscripts 10.10.10.10`</mark>

**Loads all scripts whose name starts with http-, such as http-auth and http-open-proxy. The argument to --script had to be in quotes to protect the wildcard from the shell.**
\
`#`<mark style="color:green;">`nmap --script "http-*" 10.10.10.10`</mark>

More complicated script selection can be done using the and, or, and not operators to build Boolean expressions. The operators have the same precedence as in Lua: not is the highest, followed by and and then or. You can alter precedence by using parentheses. Because expressions contain space characters it is necessary to quote them.
\
`#`<mark style="color:green;">`nmap --script "(default or safe or intrusive) and not http-*" 10.10.10.10`</mark>
\
Loads scripts in the default, safe, or intrusive categories, except for those whose names start with http-.

{% hint style="success" %}
Now hop over to [Services](https://www.hackbook.io/initial-access/services) to start exploiting broken configs if NSE auto-pwns are not working.&#x20;
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.hackbook.io/reconnaissance/active-scanning/nmap/nse.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.