Hello everyone. In this video. I'm going to be taking you through how
to perform service and numeration with nmap scripts or
the nmap scripting engine for that matter. So
let's get started. The first thing I want to take you
through is of course, performing a default and map scripts can.
So again. What I can do is I can just open
up the nmap Man pages. And the reason I'm doing this
is because I want to explain a few things. So I
will I can just actually just open it up directly because I
know the actual location of
What I am going to be taking you through. So if
we take a look at, we've
already taken, look at Host Discovery to a
certain extent and we're going to be taking a look at these scripts can.
So there. We are you can see that we have the SC option.
So that is minus lower case, s and uppercase C.
This will use the default nmap scripts
within the default and map script directory. Now,
when we talk about nmap scripts, let
me explain what they are. If we go on to the
Nmap website. That is a 10. Mapple, dog, under the book.
And we have the manual page. You can see that the
nmap scripting engine is one of n Maps. Most powerful
and flexible features. It allows users to write and share
simple scripts using the Lua programming language
to automate a wide variety of networking tasks.
These scripts are executed in
parallel with the speed and efficiency, you would expect from nmap.
And again, these scripts are used to perform a wide variety
of networking tasks as I as they've.
Mentioned here. So the type of functionality that you can
do are defined or the type of functions that
you that a script can do are defined in terms of categories.
And the categories are off broadcasts.
Default Discovery, dose exploit
external fossa, intrusive malware safe
version and Vaughn. All right, so
you can open up the script categories, to actually take a
look at the the various categories of scripts that
you have. Now. We need it. When we take a look at the default.
Vault script category, you can see that these scripts are the default set
and are run when the SC option or
the a option, which is the aggressive scan is invoked. And
again, that allows you to run the default category.
Now, this is typically what you would run
by default and I'll be taking you through scripts manually and
explaining how they work and what they can do.
Now, when we talk about nmap, your scripts are typically going
to be going to be stored under your user share
nmap directory. On the
Script, so if I hit enter, it will display all the
scripts that are currently available to us that we can use. Now.
These are not going to be sorted into functionality, rather.
They protocol that year the protocol or
the service version they are associated to. So
for example, if we say, we have various
SMB scripts here, you can see that this SMB script
will check for smb2 capabilities and
it has the extension NSE. Now these
scripts are again a programmed in the
Lua scripting language, so that means you can actually take a
look at the scripts you can interact with them. You can develop your own
so on and so forth. And mainly scripts are just used
to automate things that you typically do manually. And
again, with the various categories. These
scripts can do a lot of things from from performing authentication,
to performing brute-forcing performing,
exploitation testing for certain vulnerabilities. So
on and so forth. So, for example, we can
scroll all the way to the top. Here, you can see we have various
HTTP, scripts, that scan, for particular vulnerabilities,
and the various cve codes are
listed here. So on and so forth. So again,
using these scripts is very simple. If we talk about the basic
usage, first, we can invoke the default category
of scripts to be run by typing in nmap.
And then using the SC option, right? We
can do that or we can use the a option. Now the
a option refers to an aggressive scan. Now, an
aggressive scan combines three types of
Hands together, the aggressive scan combines the
service version detection. It combines the aggressive
scan and then combines the default nmap
scripts can. So. This is an extremely comprehensive scan
to use. And all you need to do is specify the
a option. So we can actually do that and that will combine
service version detection with operating
system detection. Sorry, that is operating system detection and
the default script scan, right away
are. So, again, we can just use the nmap a option.
And we will combine it with the sin or the stealth scan
and then we can provide the port.
So we'll just run it again on the hundred, most common ports so
that we don't have to waste any time because when we include
additional type of options in
our scan, like the scripts can it's going to
take more time. We'll talk about timing in a later
video so we can then provide out the IP of
the target here. So I can say 10.0.0.0 x
and we hit enter. It's going to say we require
It privileges, we're going to provide it with root privileges. And
again, we're just going to wait for this. Can to complete. All
right, as you can see the scan completes and we now have a
plethora of new information, that's been given to
us just by including the default script or
the default nmap script option. So
you can see that in addition to
the results that we typically get in regards to
the port, the state of the port, what service and
the service version at the bottom.
Of that particular service, which is again is going
to be indented, you can see that. We now have new information. So
for example, we have FTP cyst here.
Now FTP cyst. This is in
reference to the FTP cyst script. So
it's actually listing out. What script was used to
scan. And what, what the FTP cyst script does is
it actually just displays the actual system that is
being used or the actual operating
system on which this FTP.
Oh is being run in this case? It tells us that Windows 8 and
D is being is so you can see that this n that this FTP script
is giving us valuable information regarding what
operating system is running. You then have
the SSH host key script, which is running on the SSH
and that essentially just gives us the SSH host
key. Not really that information in important information.
And then you have the port 80, which is
a web server. And then for the port 80, or
for the web server, you can see that it runs through.
Scripts by default. It runs the HTTP method script.
It runs the HTTP server header, which
tells us the actual server header or the server-side technology
being used in this case. It's Microsoft is
7.5. And then the HTTP titled
that's being used. In this case. It tells us that the
site doesn't have a title. So immediately we are getting tons
of more important information regarding our
targets. And if again, we take a look at the proxy, you
can see that. Just the uses the http.
TTP title script here and that tells us that we
have glassfish server and the server is running. So
that is how to use the the how to use nmap scripts.
And I've talked about invoking, the default nmap scripts can.
Now we can also use scripts individually, which
is really where I want to demonstrate the
power of n map because that's where things get really,
really interesting. So again, if
we take a look at our Target here, right over here.
You can see that we have multiple. We have
multiple ports and services, and we
have multiple types of scripts that we can
run. So again, if I list out the scripts within the
nmap scripts directory again, this
will list out all the scripts that we can use. And again, we can start
using these scripts to enumerate more information from
our Target. So if we are talking about the web server, for
example, I can use the HTTP genome
script and the way I can list out all
Scripts is, I can, I can graph this. I can pipe
+ grip and say, I want to use an expression will say HTTP,
and I can then list out all the HTTP
scripts that we can use. Now, the script, the
script that I want to use in regards to http is
going to be the HTTP enum script, and I'm going to
be taking you through, only the most important one, which is
the one right over here. So we want to use HTTP enum to
use a single script. It is important that, you
know what, service you're targeting. And what,
Is this script is designed to be run on. So
in our case, if I say and
map and I can run as stealth scan to
run a single script. I say script, and that is done using
two - or two dashes, and we say script and
then we specify the script name. So HTTP, HTTP
e now, right.
And then I specify the target. So 10.10 sorry.
10.0.0.0 six and
I hit enter, it's going to ask me for root privileges. I'm going to provide it
with root privileges so you can see it will will
start the scan and we're just going to let that's can run.
And you can see that this is now going to scan all the
default ports, which is exactly wanted what I
wanted to point out. So, if we are only scanning the web server,
it only makes sense that we provide only
the web server Port that we want to Target.
We can say, I won't you only to Target Port
80 and port 8080 because we have a proxy running
on port 8080, solid. And now
you see the scan is much more efficient because we are only
scanning the ports that are relevant and we're using the script that
is relevant to those ports. And there we are. So you can
see that for Port 80. We don't get any important
information, HTTP. Enum simply lists
out the directory of that web server, so
you can see for the proxy, it gives us a bit of
of of shellcode here and it tells us that
it. But this particular, this
particular proxy is vulnerable to
directory traversal, which is very
interesting. So again, it's already revealing potential vulnerabilities
within the system and that is just by invoking one.
Simple HTTP script. Now as I said,
there's tons of HTTP scripts that
you can use. One of my favorite is the ability to test and
see if we have a web application firewall.
Nothing. And you can run this against websites to
detect. If there's a web application, firewall running. You can
also use the HTTP wife fingerprint script, which
will actually tell you what web application firewall
is running, which is fantastic. Now, as
I said, we can take a look at tons of scripts that
we can run as Z by default. You want to run the default nmap
scripts. Can however, let's talk about a few
Windows type scans. Now, given that met exploitable 3
doesn't have or again.
It it it has a SMB ports running, but we
can actually take a look at that shortly. Let's take a look at some of the,
some of the cves or
Windows exploits that nmap scripts that we
can actually scan for with with nmap script. So
if I just clear this out right over here, we
can actually scan for a popular vulnerability
that again is we
again we can use. So again if I just open up google.com and
I searched for a vulnerability called MS.
08, so 2008. So that's 08
and we say oh 67, right? So all 67 and
we just opened that up. We'll just open up one of these ones,
right? A via the Microsoft bulletin security bulletins and
we can open up rapid7 year. So again, you can
see, we can take a look at the affected and
unaffected software. You can see for Windows. It
does, it affects Windows Server, 2008. There
we are. So again, this vulnerability of fix Windows server.
A 2008. So we can actually run this particular script. So
this script is an SMB script. And
so what we can do is we can run the same script here. We
can say in map SS. We're
honest. It's a stealth scan and we'll say we want to.
We can also fragment the packets
because we're dealing with the firewall if I disable the firewall for
a second here. So I'll just say open up this and I just disable
the firewall because I do not want to cover that
right now. I'm simply explaining how to perform.
These types of scans. So we can say nmap SS. We
specify the port 445 for SMB and
then we say script we're looking for
SMB. The script name is SMB Vaughn and
again, you can list out all of the
SMB scripts by listing out the directory of the
nmap scripts here. So list user,
share nmap scripts
and we can then pipe + grip
grip. This,
And we're looking for SMB, scripts only so
we can hit enter and now you can see we have all
the assembly scripts here. So the one we are targeting is Ms. 0
8, 0 67. So we can actually just
copy that directly if you don't want to type it
in or you don't need to remember them directly. So we just
specify the script here and then the IP 10.0.0.0 X.
Now, this is a vulnerability scanning script, which
is very important. It is going to scan for a particular vulnerability.
So immediately you can see that it tells us it
does not give us any options here. So what we
can do now is we can actually just
get rid of the, I'll get rid of the
stealth's. Can we hit enter again? So again, it tells us that
it is not. It does not give us any results. It
means that it's not particularly vulnerable to that with
this particular exploit. So again,
we can run this against our all our Windows
machines. That would be working with but I just wanted to
take
Take you through the basics of nmap scripts and
how to run the default script scan. And that's
pretty much all that. I wanted to cover in this video and I'll be seeing
you in the next video.