Nmap Scripting Engine (NSE)
The Nmap Scripting Engine (NSE) is one of Nmap's most powerful features. It allows users to write and execute Lua scripts that interact with target services for vulnerability detection, service enumeration, brute forcing, and custom reconnaissance tasks. Hundreds of scripts ship with Nmap by default.
What is NSE
NSE transforms Nmap from a port scanner into a full reconnaissance and vulnerability assessment platform. Scripts are written in Lua — a lightweight, embeddable scripting language — and can perform virtually any network interaction you can imagine.
Info
prerule
Run before any host is scanned. Used for setup, validating arguments, or making external queries.
Pre-scan: whois lookup, wordlist loading
hostrule
Run after host discovery but before port scanning. Evaluates whether to scan the host at all.
Skip hosts that do not match a pattern
portrule
Run after port scanning against matching ports. The most common phase — most scripts use this.
Run http-title against all open HTTP ports
postrule
Run after all hosts and ports are scanned. Used for aggregation, reporting, and correlation.
Compare results across all scanned hosts
Script Categories
NSE scripts are organized into 14 categories. Understanding these categories helps you choose the right scripts for your engagement and avoid accidentally running dangerous scripts on production systems.
Tests authentication credentials and bypasses. Attempts to find weak or default credentials on services.
Discovers hosts not directly targetable by broadcasting on the local network segment.
Performs brute-force password guessing against services using wordlists.
Run with -sC. Safe, non-intrusive scripts that provide useful information without risk.
Enumerates network resources: users, shares, services, routes, and more.
Tests for denial of service vulnerabilities. May crash services — use with caution.
Attempts to actively exploit vulnerabilities. High risk — only on authorized targets.
May send data to third-party databases or services (e.g., whois, geolocation).
Sends unexpected or malformed data to services to find parsing vulnerabilities.
Cannot be classified as safe. May crash services, consume resources, or modify data.
Checks if the target is infected with malware or backdoors.
Designed not to crash services, consume excessive resources, or exploit security holes.
Extension to version detection. Active probing for version info beyond nmap-service-probes.
Checks for specific known vulnerabilities and reports CVE identifiers.
Essential NSE Scripts
These twelve scripts are the ones you will use most often in real-world engagements. Each includes a full description, category, and usage example.
Queries the Vulners.com vulnerability database using detected service versions to find matching CVEs. One of the most valuable scripts for quick vulnerability assessment.
nmap --script vuln 10.0.0.1Enumerates all SSL/TLS cipher suites supported by a target and grades them A through F. Essential for assessing SSL/TLS configuration strength.
nmap --script ssl-enum-ciphers -p 443 10.0.0.1Fetches the HTML title element from web servers. Simple but surprisingly useful for quick service identification and finding exposed admin panels.
nmap --script http-title -p 80,8080 10.0.0.1Discovers OS version, computer name, domain, and workgroup from SMB services. Works even when -O fails.
nmap --script smb-os-discovery -p 445 10.0.0.1Brute-forces DNS hostnames using a wordlist. Excellent for subdomain enumeration during reconnaissance.
nmap --script dns-brute --script-args dns-brute.domain=example.comChecks whether an FTP server allows anonymous login without credentials. Still surprisingly common on misconfigured servers.
nmap --script ftp-anon -p 21 10.0.0.1Retrieves the SSH host key and shows its fingerprint, bit length, and type. Useful for tracking hosts and detecting man-in-the-middle risks.
nmap --script ssh-hostkey -p 22 10.0.0.1Brute-forces SNMP community strings. Many organizations still use "public" or "private" — this script finds them fast.
nmap --script snmp-brute -p 161 10.0.0.1Gathers MySQL server version, protocol info, thread count, and capability flags without authentication.
nmap --script mysql-info -p 3306 10.0.0.1Enumerates directories and applications on web servers by testing common URLs. A lightweight alternative to Gobuster for quick checks.
nmap --script http-enum -p 80 10.0.0.1Detects the EternalBlue vulnerability (MS17-010) in SMBv1. This was the exploit behind WannaCry and NotPetya ransomware outbreaks.
nmap --script smb-vuln-ms17-010 -p 445 10.0.0.1Tests for the Heartbleed vulnerability (CVE-2014-0160) in OpenSSL. One of the most infamous bugs in TLS history.
nmap --script ssl-heartbleed -p 443 10.0.0.1Running NSE Scripts
Run default scripts
1nmap -sC 10.0.0.1
Equivalent to --script=default. Runs safe, non-intrusive scripts that provide useful information.
Run a specific script
1nmap --script http-title 10.0.0.1
Run all scripts in a category
1nmap --script "vuln" 10.0.0.1
Run multiple scripts
1nmap --script http-title,ssl-enum-ciphers,ftp-anon 10.0.0.1
Run scripts with arguments
1nmap --script dns-brute --script-args dns-brute.domain=example.com,dns-brute.threads=5
Update the script database
1nmap --script-updatedb
Writing Custom NSE Scripts
NSE scripts are written in Lua. They follow a standard structure with descriptive fields, rule functions that determine when to run, and action functions that perform the actual work. Custom scripts are stored in /usr/share/nmap/scripts/ or ~/.nmap/scripts/.
1description = [[2 Custom script example that checks for a specific banner3]]45author = "Your Name"6license = "Same as Nmap"7categories = {"safe", "discovery"}89portrule = function(host, port)10 return port.number == 80 and port.protocol == "tcp"11end1213action = function(host, port)14 local socket = nmap.new_socket()15 socket:connect(host, port)16 socket:send("HEAD / HTTP/1.0\r\n\r\n")17 local response = socket:receive_lines(1)18 socket:close()19 return response20end
Warning