Tips Nmap Script Engine | Faraday

Tips Nmap Script Engine

June 28, 2023

Nmap

Network Mapper is a popular network scanner that allows discovering ports and services, providing relevant information about a network. In addition to basic port scanning, Nmap offers a wide range of options and advanced functionalities. It can perform TCP, UDP, and SCTP scans, operating system detection scans, service version detection, script scans, and much more. It also allows customization of scans and generation of detailed reports.

Installation

Nmap is usually pre-installed in most Linux distributions. In case you don’t have it, you can easily install it with the following command:

apt-get install nmap

Scan Port Oneliner

If you want to quickly and simply test this tool, here is an example that you could use as a starting point:

nmap -sS -Pn -p 1-65535 -T4 -A <target>

This command uses the following options:

-sS: Performs a SYN scan to determine which ports are open on the target.

-Pn: Skips host discovery and assumes the target is online.

-p 1-65535: Scans all possible ports on the target.

-T4: Sets the timeout value to 4, indicating a moderate scanning speed.

-A: Performs a detailed scan that includes operating system detection, software version detection, and script detection.

Nmap as Vulnerability Scanner

NSE (Nmap Scripting Engine) is a powerful scripting engine that allows for automation and extensibility of Nmap’s capabilities. NSE enables users to write and execute custom scripts to perform specific tasks during network scanning.

NSE is designed to interact with Nmap scan results and perform additional actions such as obtaining extra information about discovered services and systems, conducting security tests, detecting known vulnerabilities, and executing various scripting actions.

Some key features of NSE include:

– Predefined scripts: Nmap comes with an extensive collection of predefined scripts that can be used to perform common tasks such as service detection, system enumeration, searching for known vulnerabilities, etc.

– Custom script development: Users can write their own scripts using the Lua programming language. This allows for tailoring Nmap to specific needs and expanding its capabilities.

– Specialized scans: NSE can perform specialized scans that go beyond simple detection of open ports. For example, HTTP scans can be performed to search for insecure configurations, or SSL/TLS scans can be conducted to verify encryption settings.

– Integration with other systems: NSE scripts can also be integrated with other tools and systems, such as vulnerability databases or Security Information and Event Management (SIEM) systems, to facilitate data correlation and improve incident response.

Nmap – vuln

NSE scripts are categorized based on a set of predefined categories to which each script belongs, such as Authentication, Discovery, Brute Force, Malware, Version, and Vuln, just to name a few. You can find more detailed information about the different script categories in the following link.

The scripts categorized under vuln are intended to search for known vulnerabilities and report if they are identified on the target destination.

nmap -sV --script vuln <target>

Nmap – vulners

Nmap-vulners is one of the most popular NSE scripts that utilizes the Vulners vulnerability database to search for and detect potential vulnerabilities in services and systems found during a network scan with Nmap.

The main difference between nmap-vuln and nmap-vulners lies in the vulnerability database used. Nmap-vuln uses its own internal database that is periodically updated with new vulnerability rules and signatures. On the other hand, nmap-vulners uses the Vulners database, which is regularly updated and is known for its extensive coverage of vulnerabilities. Vulners collects information from various sources, including vulnerability databases, security bulletins, public reports, etc.

To install it, you simply need to clone the repository into the scripts directory used by Nmap:

cd /usr/share/nmap/scripts/

git clone https://github.com/vulnersCom/nmap-vulners.git

To execute it is very simple, you just need to pass the –-script argument to our Nmap command to indicate which NSE script to use:

nmap -sV --script vulners [--script-args mincvss=<arg_val>] <target>

In case you want to scan a specific port, simply add the -p option at the end of the command, indicating the port number to scan:

nmap -sV --script nmap-vulners/ <target> -p80,443

TOP 10 NSE

Nmap has a large number of scripts, currently over 600. These scripts are designed to automate specific port scanning tasks and security analysis on systems and networks. Most of these scripts are pre-installed in Nmap and can be executed using the –script or -sC option. As mentioned in this post, additional scripts can also be downloaded from the official Nmap website or the Nmap Scripting Engine (NSE) community.

To let you test it out, we share a list of the top 10 Nmap scripts, in my opinion, that can be useful in a variety of situations:

Centralize and manage your vulnerabilities with Faraday.

If you want to centralize and integrate your security scans with Faraday, take a look at this documentation that shows you how to easily execute Nmap commands and import them into our platform.

Please note that to integrate Nmap with Faraday, you’ll need to follow these steps:

Your first scans integrated with Faraday.

Here are some snippets of different workflows you can generate using faraday-cli:

One-line Continuous Scan: Scan assets from a workspace.

$ faraday-cli host list -ip -w other_ws | nmap -iL - -oX /tmp/nmap.xml && faraday-cli tool report -w other_ws /tmp/nmap.xml

One-Line to nmap all the hosts in the workspace and import the results back to Faraday: To scan all the host lists inside a workspace with nmap and import the results back to Faraday.

for ip in $(faraday-cli host list -ip); faraday-cli tool run "nmap -Pn -p443,80 -sV --script=+http-enum -vvv $ip"

!!! info In this case, you should have a workspace named “other_ws” with hostnames in it.

Faraday will process the command or XML file and display the Nmap scan results in its interface. You will be able to see information about the services and ports found, as well as any detected vulnerabilities.

This integration allows you to centrally manage the results of Nmap scans and keep a record of the vulnerabilities found in Faraday. Additionally, Faraday provides additional vulnerability management and reporting features that can further facilitate security analysis.

Remember to read the Faraday documentation for more detailed information on how to integrate Nmap with Faraday and make the most of their combined capabilities.