Mastering the Nmap Scripting Engine: Master the Nmap Scripting Engine and the art of developing NSE scripts

Script categories

$svn --version

#apt-get install subversion

$svn co https://svn.nmap.org/nmap

#apt-get install make g++ libssl-dev autoconf

$./configure

$make
#make install

#nmap -v
Nmap version 6.47SVN ( http://nmap.org )
Platform: x86_64-apple-darwin14.0.0
Compiled with: nmap-liblua-5.2.3 openssl-0.9.8za nmap-libpcre-7.6 libpcap-1.5.3 nmap-libdnet-1.12 ipv6
Compiled without:
Available nsock engines: kqueue poll select

$svn up

$make

#make install

#nmap –sV –sC -O scanme.nmap.org

nmap --script http-title <target>
nmap -p80 --script http-huawei-hg5xx-vuln <target>
nmap --script http-title,http-methods <target>

PORT   STATE SERVICE VERSION
80/tcp open  http    Huawei aDSL modem EchoLife HG530 (V100R001B122gTelmex) 4.07 -- UPnP/1.0 (ZyXEL ZyWALL 2)
| http-huawei-hg5xx-vuln:
|   VULNERABLE:
|   Remote credential and information disclosure in modems Huawei HG5XX
|     State: VULNERABLE (Exploitable)
|     Description:
|       Modems Huawei 530x, 520x and possibly others are vulnerable to remote credential and information disclosure.
|       Attackers can query the URIs "/Listadeparametros.html" and "/wanfun.js" to extract sensitive information
|       including PPPoE credentials, firmware version, model, gateway, dns servers and active connections among other values
|     Disclosure date: 2011-01-1
|     Extra information:
|
|   Model:EchoLife HG530
|   Firmware version:V100R001B122gTelmex
|   External IP:xxx.xxx.xx.xxx
|   Gateway IP:xxx.xx.xxx.xxx
|   DNS 1:200.33.146.249
|   DNS 2:200.33.146.241
|   Network segment:192.168.1.0
|   Active ethernet connections:0
|   Active wireless connections:3
|   BSSID:0xdeadbeefcafe
|   Wireless Encryption (Boolean):1
|   PPPoE username:xxx
|   PPPoE password:xxx
|     References:
|       http://routerpwn.com/#huawei
|_      http://websec.ca/advisories/view/Huawei-HG520c-3.10.18.x-information-disclosure
nmap --script exploit <target>

nmap --script discovery,intrusive <target>

nmap --script /path/to/script.nse <target>

nmap --script /path/to/script.nse,/another/path/script2.nse <target>

nmap --script /path/to/folder/ <target>
nmap --script /custom-nse-scripts/ scanme.nmap.org

#nmap -sV --script "not exploit" <target>

#nmap --script "not(intrusive or dos or exploit)" -sV <target>

#nmap --script "broadcast and discovery" <<target>

#nmap --script "snmp-*" <target>

#nmap --script "http-* and not(http-slowloris or http-brute or http-enum or http-form-fuzzer)" <target>

#nmap --script "http-* and not(exploit)" <target>

$nmap -sV --script http-title --script-args http.useragent="Mozilla 1337" <target>

$nmap -p80 --script http-trace --script-args path <target>

$nmap -p80 --script http-trace --script-args http-trace.path <target>

$nmap --script http-majordomo2-dir-traversal,http-axis2-dir-traversal --script-args http-axis2-dir-traversal.uri=/axis2/,uri=/majordomo/ <target> 
$nmap --script http-majordomo2-dir-traversal,http-axis2-dir-traversal --script-args uri=/axis2/,http-majordomo2-dir-traversal.uri=/majordomo/ <target> 
$nmap --script http-majordomo2-dir-traversal,http-axis2-dir-traversal --script-args http-axis2-dir-traversal.uri=/axis2/,http-majordomo2-dir-traversal.uri=/majordomo/ <target>

nmap --script "discovery,broadcast" --script-args-file nmap-args.txt <target>

http.useragent=Not Nmap
http.max-connections=50
userdb=/path/to/usernames.lst
passdb=/path/to/dictionary.lst
$nmap --script +<script selection> <<arg1, arg2, …>

$nmap --script +http-title -p1212 192.168.1.210

Nmap scan report for 192.168.1.210
Host is up (0.00026s latency).
PORT     STATE SERVICE
1212/tcp open  lupa
|_http-title: W00t!

#nmap --script exploit --script-trace <target>

#nmap -sV –-script exploit -d3 <target> 

#nmap -O --script myscript.nse --packet-trace <target>

prerule = function()
  return nmap.is_privileged() and 
    (stdnse.get_script_args("targets-sniffer.iface") or nmap.get_interface())
postrule = function() return (nmap.registry.sshhostkey ~= nil) end
portrule = function(host, port)
        -- JDWP will close the port if there is no valid handshake within 2
        -- seconds, Service detection's NULL probe detects it as tcpwrapped.
        return port.service == "tcpwrapped"
               and port.protocol == "tcp" and port.state == "open"
               and not(shortport.port_is_excluded(port.number,port.protocol))
end
hostrule = function(host)
        if nmap.address_family() ~= 'inet' then
                stdnse.print_debug("%s is IPv4 compatible only.", SCRIPT_NAME)
                return false
        end
        if host.directly_connected == true and
          host.mac_addr ~= nil and
          host.mac_addr_src ~= nil and
          host.interface ~= nil then
                local iface = nmap.get_interface_info(host.interface)
                if iface and iface.link == 'ethernet' then
                      return true
                end
        end
        return false
end
#nmap -sU -p1900 --script upnp-info <target>

Nmap scan report for 192.168.1.1
Host is up (0.067s latency).
PORT     STATE SERVICE
1900/udp open  upnp
| upnp-info: 
| 192.168.1.1
|     Server: Custom/1.0 UPnP/1.0 Proc/Ver
|     Location: http://192.168.1.1:5431/dyndev/uuid:3872c05b-c117-17c1-5bc0-12345
|       Webserver: LINUX/2.4 UPnP/1.0 BRCM400/1.0
|       Name: Broadcom ADSL Router
|       Manufacturer: Comtrend
|       Model Descr: (null)
|       Model Name: AR-5381u
|       Model Version: 1.0
|       Name: WANDevice.1
|       Manufacturer: Comtrend
|       Model Descr: (null)
|       Model Name: AR-5381u
|       Model Version: 1.0
|       Name: WanConnectionDevice.1
|       Manufacturer: Comtrend
|       Model Descr: (null)
|       Model Name: AR-5381u
|_      Model Version: 1.0

$nmap -sn --script "hostmap*" <target>

Nmap scan report for packtpub.com (83.166.169.228)
Host is up (0.13s latency).

Host script results:
| hostmap-bfk: 
|   hosts: 
|     packtpub.com
|_    83.166.169.228
| hostmap-robtex: 
|   hosts: 
|_    packtpub.com
| hostmap-ip2hosts: 
|   hosts: 
|     www.packtpub.com
|     packtpub.com
|_    83.166.169.228

# nmap --script broadcast-ping 
Pre-scan script results: 
| broadcast-ping: 
|   IP: 192.168.1.202  MAC: 08:00:27:16:4f:71 
|   IP: 192.168.1.206  MAC: 40:25:c2:3f:c7:24 
|_  Use --script-args=newtargets to add the results as targets 
WARNING: No targets were specified, so 0 hosts scanned. 
Nmap done: 0 IP addresses (0 hosts up) scanned in 3.25 seconds 

# nmap --script broadcast-ping --script-args newtargets
Starting Nmap 6.47SVN ( http://nmap.org ) at 2014-11-30 22:05 CST
Pre-scan script results:
| broadcast-ping: 
|_  IP: 192.168.0.8  MAC: 6c:ad:f8:7b:83:ab
Nmap scan report for 192.168.0.8
Host is up (0.0083s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE
8008/tcp open  http
8009/tcp open  ajp13
MAC Address: 6C:AD:F8:7B:83:AB (Azurewave Technologies)

#nmap -sL --script=targets-sniffer -e <interface>
Starting Nmap 6.47SVN ( http://nmap.org ) at 2014-11-30 22:11 CST
Pre-scan script results:
| targets-sniffer: Sniffed 4 address(es). 
| 17.172.239.128
| 192.168.0.2
| 239.255.255.250
|_192.168.0.8
WARNING: No targets were specified, so 0 hosts scanned.
Nmap done: 0 IP addresses (0 hosts up) scanned in 10.20 seconds 

#nmap -sL --script=targets-sniffer --script-args=newtargets -e <interface>
Starting Nmap 6.47SVN ( http://nmap.org ) at 2014-11-30 22:15 CST
Pre-scan script results:
| targets-sniffer: Sniffed 5 address(es). 
| 224.0.0.251
| fe80::7a31:c1ff:fec1:9c0a
| 192.168.0.8
| 192.168.0.2
|_239.255.255.250
Nmap scan report for 192.168.0.8
Host is up (0.0066s latency).
Not shown: 98 closed ports
PORT     STATE SERVICE
8008/tcp open  http
8009/tcp open  ajp13
MAC Address: 6C:AD:F8:7B:83:AB (Azurewave Technologies)

Nmap scan report for 192.168.0.2
Host is up (0.0033s latency).
Not shown: 99 closed ports
PORT      STATE SERVICE
49152/tcp open  unknown
MAC Address: 00:18:F5:0F:AD:01 (Shenzhen Streaming Video Technology Company Limited)

Nmap done: 4 IP addresses (2 hosts up) scanned in 16.01 seconds

$nmap -p3306 --script mysql-brute <target>

3306/tcp open mysql
| mysql-brute: 
| root:<empty> => Valid credentials
|_ test:test => Valid credentials

$nmap -p25 --script smtp-brute <target>

PORT STATE SERVICE REASON
25/tcp open stmp syn-ack
| smtp-brute: 
| Accounts
| acc0:test - Valid credentials
| acc1:test - Valid credentials
| acc3:password - Valid credentials
| acc4:12345 - Valid credentials
| Statistics
|_ Performed 3190 guesses in 81 seconds, average tps: 39

$nmap -p3306 --script mysql-audit --script-args 'mysql-audit.username="<username>",mysql-audit.password="<password>",mysql-audit.filename=/usr/local/share/nmap/nselib/data/mysql-cis.audit' <target>

PORT STATE SERVICE 
3306/tcp open mysql 
| mysql-audit: 
| CIS MySQL Benchmarks v1.0.2 
| 3.1: Skip symbolic links => PASS 
| 3.2: Logs not on system partition => PASS 
| 3.2: Logs not on database partition => PASS 
| 4.1: Supported version of MySQL => REVIEW 
| Version: 5.1.41-3ubuntu12.10 
| 4.4: Remove test database => PASS 
| 4.5: Change admin account name => FAIL 
| 4.7: Verify Secure Password Hashes => PASS 
| 4.9: Wildcards in user hostname => PASS 
| 4.10: No blank passwords => PASS 
| 4.11: Anonymous account => PASS 
| 5.1: Access to mysql database => REVIEW 
| Verify the following users that have access to the MySQL database 
| user host 
| root localhost 
| root builder64 
| root 127.0.0.1 
| debian-sys-maint localhost 
| 5.2: Do not grant FILE privileges to non Admin users => PASS 
| 5.3: Do not grant PROCESS privileges to non Admin users => PASS 
| 5.4: Do not grant SUPER privileges to non Admin users => PASS 
| 5.5: Do not grant SHUTDOWN privileges to non Admin users => PASS 
| 5.6: Do not grant CREATE USER privileges to non Admin users => PASS 
| 5.7: Do not grant RELOAD privileges to non Admin users => PASS 
| 5.8: Do not grant GRANT privileges to non Admin users => PASS 
| 6.2: Disable Load data local => FAIL 
| 6.3: Disable old password hashing => PASS 
| 6.4: Safe show database => FAIL 
| 6.5: Secure auth => FAIL 
| 6.6: Grant tables => FAIL 
| 6.7: Skip merge => FAIL 
| 6.8: Skip networking => FAIL 
| 6.9: Safe user create => FAIL 
| 6.10: Skip symbolic links => FAIL 
| 
|_ The audit was performed using the db-account: root 

#nmap -p80 --script http-slowloris --max-parallelism 300 <target>

PORT STATE SERVICE REASON 
80/tcp open http syn-ack
| http-slowloris:
| Vulnerable:
| the DoS attack took +5m35s
| with 400 concurrent connections
|_ and 1900 sent queries

nmap -sV --version-all --script ssl-poodle -p- <target>

syntax enable
au BufRead,BufNewFile *.nse set filetype=lua
set nocindent
set expandtab
set softtabstop=2
set shiftwidth=2
set copyindent
#nmap --script-updatedb

Script category	Description
`auth`	NSE scripts related to user authentication.
`broadcast`	A very interesting category of scripts that use broadcast petitions to gather network information.
`brute`	A category for scripts that help conduct brute-force password auditing.
`default`	Scripts executed when a script scan is executed (`-sC`).
`discovery`	Scripts related to host and service discovery.
`dos`	Scripts related to denial-of-service attacks.
`exploit`	Scripts used to exploit security vulnerabilities.
`external`	This category is for scripts depending on a third-party service.
`fuzzer`	NSE scripts focused on fuzzing.
`intrusive`	A category for scripts that might crash something or generate a lot of network noise. Scripts that system administrators may consider intrusive go here.
`malware`	A category for scripts related to malware detection.
`safe`	Scripts that are considered safe in all situations.
`version`	Scripts for advanced version detection.
`vuln`	Scripts related to detecting and exploiting security vulnerabilities.

Mastering the Nmap Scripting Engine: Master the Nmap Scripting Engine and the art of developing NSE scripts

What do you get with Print?

Contact Details

Shipping Address

Billing Address

Description

Who is this book for?

What you will learn

Product Details

What do you get with Print?

Contact Details

Shipping Address

Billing Address

Product Details

Packt Subscriptions

Frequently bought together

Table of Contents

Recommendations for you

Customer reviews

People who bought this also bought

About the author

FAQs

Create a Free Account To Continue Reading

Sign in to activate your 7-day free access