In this lesson, we're going to dive
into using the Nmap Scripting Engine,
or NSE, to enhance your penetration testing efforts.
Now, NSE is probably hands down
the best feature of Nmap,
allowing you to automate a lot of different things
from information gathering
to vulnerability discovery using different scripts.
But first, I want to show you a text file
which lists all of the scripts that we can run.
This file is located at the
/usr/share/nmap/scripts
within the file script.db.
Let me show you that really quick.
I'm going to use the head command here
to display just the first 10 lines of this file.
This gives us a quick glimpse of its contents
without overwhelming us with too much information.
All right, so here we see the first 10
NMAP scripts available.
As I mentioned earlier,
there are many different scripts in this directory.
Each script serves a specific purpose
and falls into various categories,
such as brute, discovery, and volume.
For example, the brute category contains scripts
that focus on brute-forcing login credentials,
while discovery scripts help you find hidden services
or gather more information about your target.
This directory holds all the NMAP scripts
that come with the tool,
allowing you to perform a wide range
of tasks depending
on what you need to do.
For example.
Okay, here we see so many different types.
We have SMTP, POP3, Telnet, MPing.
There's so many different types of brute force
in the text
that we can carry out using NMAP.
Let's check out another one.
Okay, so here we see a lot of different ones
for authentication type of scripts.
I just want you to see the vast variety of scripts
that NMAP NSE offers.
All right, so the first things first,
let's talk about running a basic NMAP scan,
and then we'll move on to NSE.
All right, so now this command performs
a TCP send scan on the targetscanme.mmac.org.
That's the dash SS option.
Now, this often is referred to as a half-open scan.
It's faster and stealthier than the full TCP connects.
The MMAP scan shows a few important things
about the target here.
See, we have port 22, which is open,
meaning SSH is being used.
Port 80 is also open,
indicating that web services are running,
which should be a website or a web application.
Now, there's another interesting find, which is 31337,
which is open and often referred to as elite,
a service that's sometimes used by hackers,
possibly suggesting a backdoor
or something suspicious like that.
Some other ports, like 25 for email,
111, 135, 139, or filtered.
This means that they might be there,
but the firewall or security setting
is blocking direct access to them.
This filter ports could be important
if there's a way around the security that's in place.
Now that we have identified the open ports,
let's take it a little further
by using the NMAP scripting engine
to detect vulnerabilities.
So, for this, we can use the SV flag
to detect service versions,
which can be paired with NSE scripts
to check for no vulnerabilities.
Okay, so we see we're using the SV option,
and we have to use the script option.
That's how we determine which script we want to use
or what category of scripts we're going to use.
So, it's going to run everything related to vulnerabilities
against scanme.nmap.org.
All right, here are the results.
As we can see, there's a lot of different vulnerabilities
slash CVEs associated with this endpoint.
So, as I scroll up, we can see all the different CVEs
associated with these different ports.
So, let me scroll all the way up to the top.
All right.
Now, if we start off by looking at port 22,
we will notice the version of OpenSSH that's being used,
which is the 6.6.1p1 Ubuntu to Ubuntu 2.13.
Now, we see that this particular version is associated with
so many different CVEs and critical vulnerabilities,
as indicated by the 10 score, 9.8 here,
and so many different exploits
that are also available for us to use.
Now, if we scroll down,
we can see a similar pattern with port 80,
which is our HTTP web server.
This is going to be Apache HTTPD 2.4.7
and Ubuntu Linux distribution.
And again, there are so many different vulnerabilities
associated with this particular version,
as we can see here.
Now, if we scroll down,
we'll see anything that is pretty much filtered.
We won't get anything back with that because
we can't actually make contact
with those particular services.
Here, you can see that the vulnerability script
that we've run displays
all the different vulnerabilities associated
with that target.
So, this script allows us to execute all
of the related subscripts
within that particular category,
showing us the CVEs or common vulnerabilities and exposures
linked to the ports that we identified earlier.
So, in summary, NMAP Scripting Engine provides you
with an arsenal of different tools
to automate and enhance your penetration testing efforts.
Whether you're checking for specific vulnerabilities
or conducting a broad reconnaissance,
the NSE scripts allow you to go beyond
the basic port scanning
and gather detailed,
actionable information about your target,
like the CVE scores that we saw earlier.
Now we only went over the vulnerability one here
because that's going to be the most common one
that you will see in the field.
And feel free to play with all the other different types
that we identified earlier in the scripts.db file.
By mastering these commands
and understanding how to use NSE scripts effectively,
you can significantly improve your ability to identify
and exploit vulnerabilities
during your penetration testing engagements.