Windows, based networks are still the most common type of network found in organizations, mainly because of the Active Directory (AD) technology that helps system administrators simplify many of their daily tasks. While Windows systems have come a long way regarding security, there are still a few default configurations that we can deem as insecure. And not only default configurations, some undesirable functionality is there by design, like being able to obtain system information through SMBv1 without authentication.
For this reason, scanning Windows machines is a common task for penetration testers and system administrators, and thankfully, Nmap is full of resources to help us.There are NSE scripts available to perform from information gathering to vulnerability detection in workstations and servers. As advanced Nmap users, we need to understand what is available and most importantly on what platforms and configurations these scripts work.
This chapter covers the NSE scripts...