Users may select specific scripts when scanning using the Nmap option --script <filename or path/folder/category/expression>:
$nmap --script <filename or path/folder/category/expression> <target>
For example, the command to run the NSE script dns-brute is as follows:
$nmap --script dns-brute <target>
The Nmap Scripting Engine also supports the execution of multiple scripts simultaneously:
$ nmap --script http-headers,http-title scanme.nmap.org
Nmap scan report for scanme.nmap.org (74.207.244.221)
Host is up (0.096s latency).
Not shown: 995 closed ports
PORT STATE SERVICE
22/tcp open ssh
25/tcp filtered smtp
80/tcp open http
| http-headers:
| Date: Mon, 24 Oct 2011 07:12:09 GMT
| Server: Apache/2.2.14 (Ubuntu)
| Accept-Ranges: bytes
| Vary: Accept-Encoding
| Connection: close
| Content-Type: text/html
|
|_ (Request type: HEAD)
|_http-title: Go ahead and ScanMe!
646/tcp filtered ldp
9929/tcp open nping-echo
In addition, NSE scripts can be selected by category, expression, or folder:
- Run all the scripts in the vuln category:
$ nmap -sV --script vuln <target>
- Run the scripts in the version or discovery categories:
$ nmap -sV --script="version,discovery" <target>
- Run all the scripts except for the ones in the exploit category:
$ nmap -sV --script "not exploit" <target>
- Run all HTTP scripts except http-brute and http-slowloris:
$ nmap -sV --script "(http-*) and not(http-slowloris or http-brute)" <target>
Expressions are very handy as they allow fine-grained script selection, as shown in the preceding example.
