Nmap NSE Library

Nmap scripts list (interactive spreadsheet) logo

If you are looking to explore the world of NSE (Nmap Scripting Language) scripts, this page will hopefully help you find what you are looking for, quickly and effectively.

On this page you will find a comprehensive list of all available NSE scripts, organized in an interactive table (spreadsheet) with all the relevant information in one place.

Table Of Contents
show

Introduction

Whether you are looking for a specific NSE script to use in your scenario or you just want to see which scripts target a specific protocol or a port, the spreadsheet below will hopefully give you a quick answer and give you a good overview of what is available in the world of Nmap scripts.

Below spreadsheet contains a list of all 604 Nmap NSE scripts that are currently available in the latest Nmap release. The spreadsheet is interactive and it allows you to:

  • Use the search filtering to quickly find relevant scripts (see examples below)
  • Sort by any column (in ascending or descending order), e.g. sort by a port number
  • Click on the script name to see the official documentation with all the relevant details

Filtering examples

As mentioned above, you can use the search function to interactively filter out scripts based on a pattern of your interest. Here are couple of examples:

  • Search for: smb discovery
    Display only scripts related to the “smb” protocol from the “discovery” category.
  • Search for 1521
    Display only scripts targeting port 1521 (Oracle database).
  • Search for: http brute
    Display only scripts related to brute forcing of web services and web applications.
  • Search for: ftp
    Display only scripts related to FTP.

Let’s have a look.

Nmap script list (interactive spreadsheet)

NSE Script NameNetwork Port(s)Service / ProtocolCategories
acarsd-info2202acarsd, tcpsafe, discovery
address-info--default, safe
afp-brute548afpintrusive, brute
afp-ls548afpdiscovery, safe
afp-path-vuln548tcpexploit, intrusive, vuln
afp-serverinfo548afpdefault, discovery, safe
afp-showmount548tcpdiscovery, safe
ajp-auth8009ajp13, tcpdefault, auth, safe
ajp-brute8009ajp13, tcpintrusive, brute
ajp-headers8009ajp13, tcpdiscovery, safe
ajp-methods8009ajp13, tcpdefault, safe
ajp-request8009ajp13, tcpdiscovery, safe
allseeingeye-info1258, 2126, 3123, 12444, 13200, 23196, 26000, 27138, 27244, 27777, 28138allseeingeye, udpdiscovery, safe, version
amqp-info5672amqp, tcpdefault, discovery, safe, version
asn-query--discovery, external, safe
auth-owners113authdefault, safe
auth-spoof113authmalware, safe
backorifice-brute151-222, 1024-1512, 25252, 31337udpintrusive, brute
backorifice-info151-222, 1024-1512, 25252, 31337udpdefault, discovery, safe
bacnet-info47808bacnet, tcp, udpdiscovery, version
banneranyanydiscovery, safe
bitcoin-getaddr8333bitcoin, tcpdiscovery, safe
bitcoin-info8333bitcoin, tcpdiscovery, safe
bitcoinrpc-info8332-default, discovery, safe
bittorrent-discovery--discovery, safe
bjnp-discover8611, 8612udpsafe, discovery
broadcast-ataoe-discover--broadcast, safe
broadcast-avahi-dos--broadcast, dos, intrusive, vuln
broadcast-bjnp-discover--safe, broadcast
broadcast-db2-discover--broadcast, safe
broadcast-dhcp6-discover--broadcast, safe
broadcast-dhcp-discover--broadcast, safe
broadcast-dns-service-discovery--broadcast, safe
broadcast-dropbox-listener--broadcast, safe
broadcast-eigrp-discovery--discovery, broadcast, safe
broadcast-hid-discoveryd--discovery, broadcast, safe
broadcast-igmp-discovery--discovery, safe, broadcast
broadcast-jenkins-discover--discovery, broadcast, safe
broadcast-listener--broadcast, safe
broadcast-ms-sql-discover--broadcast, safe
broadcast-netbios-master-browser--broadcast, safe
broadcast-networker-discover--broadcast, safe
broadcast-novell-locate--broadcast, safe
broadcast-ospf2-discover--broadcast, discovery, safe
broadcast-pc-anywhere--broadcast, safe
broadcast-pc-duo--broadcast, safe
broadcast-pim-discovery--discovery, safe, broadcast
broadcast-ping--discovery, safe, broadcast
broadcast-pppoe-discover--broadcast, safe
broadcast-rip-discover--broadcast, safe
broadcast-ripng-discover--broadcast, safe
broadcast-sonicwall-discover--broadcast, safe
broadcast-sybase-asa-discover--broadcast, safe
broadcast-tellstick-discover--broadcast, safe
broadcast-upnp-info--broadcast, safe
broadcast-versant-locate--broadcast, safe
broadcast-wake-on-lan--broadcast, safe
broadcast-wpad-discover--broadcast, safe
broadcast-wsdd-discover--broadcast, safe
broadcast-xdmcp-discover--broadcast, safe
cassandra-brute9160cassandraintrusive, brute
cassandra-info9160cassandradefault, discovery, safe
cccam-version10000, 10001, 12000, 12001, 16000, 16001cccamversion
cics-enum23, 992tn3270intrusive, brute
cics-info23, 992tn3270discovery, safe
cics-user-brute23, 992tn3270intrusive, brute
cics-user-enum23, 992tn3270intrusive, brute
citrix-brute-xml8080, 80, 443http, https, tcpintrusive, brute
citrix-enum-apps1604udpdiscovery, safe
citrix-enum-apps-xml8080, 80, 443http, https, tcpdiscovery, safe
citrix-enum-servers1604udpdiscovery, safe
citrix-enum-servers-xml8080, 80, 443http, https, tcpdiscovery, safe
clamav-exec3310clamexploit, vuln
clock-skewvarious-default, safe
coap-resources5683coap, udpsafe, discovery
couchdb-databases5984-discovery, safe
couchdb-stats5984-discovery, safe
creds-summary--auth, default, safe
cups-info631ipp, tcpsafe, discovery
cups-queue-info631ipp, tcpsafe, discovery
cvs-brute2401cvspserverintrusive, brute
cvs-brute-repository2401cvspserverintrusive, brute
daap-get-library3689daapdiscovery, safe
daytime13daytime, tcp, udpdiscovery, safe
db2-das-info523tcp, udpsafe, discovery, version
deluge-rpc-brute58846deluge-rpcintrusive, brute
dhcp-discover67udpdiscovery, safe
dicom-brute104, 2345, 2761, 2762, 4242, 11112dicom, tcpauth, brute
dicom-ping104, 2345, 2761, 2762, 4242, 11112dicom, tcpdiscovery, default, safe, auth
dict-info2628dict, tcpdiscovery, safe
distcc-cve2004-26873632distccexploit, intrusive, vuln
dns-blacklist--external, safe
dns-brute--intrusive, discovery
dns-cache-snoop53dns, udpintrusive, discovery
dns-check-zone--discovery, safe, external
dns-client-subnet-scan53dns, udp, tcpdiscovery, safe
dns-fuzz53dns, udp, tcpfuzzer, intrusive
dns-ip6-arpa-scan--intrusive, discovery
dns-nsec3-enum53dns, udp, tcpdiscovery, intrusive
dns-nsec-enum53dns, udp, tcpdiscovery, intrusive
dns-nsid53dns, udp, tcpdiscovery, default, safe
dns-random-srcport53dns, udpexternal, intrusive
dns-random-txid53dns, udpexternal, intrusive
dns-recursion53dns, udpdefault, safe
dns-service-discovery5353dns, udpdefault, discovery, safe
dns-srv-enum--discovery, safe
dns-update53dns, udp, tcpvuln, intrusive
dns-zeustracker--safe, discovery, external, malware
dns-zone-transfer53dns, tcpintrusive, discovery
docker-version2375, 2376docker, docker-s, tcpversion
domcon-brute2050tcpintrusive, brute
domcon-cmd2050dominoconsole, tcpintrusive, auth
domino-enum-users1352lotusnotes, tcpintrusive, auth
dpap-brute8770apple-iphotointrusive, brute
drda-brute50000, 60000drda, ibm-db2, tcpintrusive, brute
drda-info50000, 60000, 9090, 1526, 1527-safe, discovery, version
duplicates--safe
eap-info--broadcast, safe
enip-info44818tcp, udpdiscovery, version
epmd-info4369epmddefault, discovery, safe
eppc-enum-processes3031eppc, tcpdiscovery, safe
fcrdns--discovery, safe
finger79fingerdefault, discovery, safe
fingerprint-strings79, anyfingerversion
firewalk--safe, discovery
firewall-bypass--vuln, intrusive
flume-master-info35871flume-masterdefault, discovery, safe
fox-info1911, 4911niagara-fox, tcpdiscovery, version
freelancer-info2302freelancer, udpdefault, discovery, safe, version
ftp-anon21, 990ftp, ftpsdefault, auth, safe
ftp-bounce21, 990ftp, ftpsdefault, safe
ftp-brute21ftpintrusive, brute
ftp-libopie21ftpvuln, intrusive
ftp-proftpd-backdoor21ftpexploit, intrusive, malware, vuln
ftp-syst21, 990ftp, ftpsdefault, discovery, safe
ftp-vsftpd-backdoor21ftpexploit, intrusive, malware, vuln
ftp-vuln-cve2010-422121ftpintrusive, vuln
ganglia-info8649, 8651ganglia, tcpdefault, discovery, safe
giop-info2809, 1050, 1049giop, tcpdefault, discovery, safe
gkrellm-info19150gkrellm, tcpdiscovery, safe
gopher-ls70gopher, tcpdefault, discovery, safe
gpsd-info2947gpsd-ng, tcpdiscovery, safe
hadoop-datanode-info50075hadoop-datanodedefault, discovery, safe
hadoop-jobtracker-info50030hadoop-jobtrackerdefault, discovery, safe
hadoop-namenode-info50070hadoop-namenodedefault, discovery, safe
hadoop-secondary-namenode-info50090hadoop-secondary-namenodedefault, discovery, safe
hadoop-tasktracker-info50060hadoop-tasktrackerdefault, discovery, safe
hbase-master-info60010hbase-masterdefault, discovery, safe
hbase-region-info60030hbase-regiondefault, discovery, safe
hddtemp-info7634hddtemp, tcpdefault, discovery, safe
hnap-info80, 8080httpsafe, discovery, default, version
hostmap-bfk--external, discovery
hostmap-crtsh--external, discovery
hostmap-robtex--discovery, safe, external
http-adobe-coldfusion-apsa130180, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsexploit, vuln
http-affiliate-id80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpssafe, discovery
http-apache-negotiation80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpssafe, discovery
http-apache-server-status80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, safe
http-aspnet-debug80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, discovery
http-auth-finder80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, safe
http-auth80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdefault, auth, safe
http-avaya-ipoffice-users80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsexploit, vuln
http-awstatstotals-exec80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, intrusive, exploit
http-axis2-dir-traversal80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, intrusive, exploit
http-backup-finder80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, safe
http-barracuda-dir-traversal8000barracuda, tcpintrusive, exploit, auth
http-bigip-cookie80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, safe
http-brute80, 443http, httpsintrusive, brute
http-cakephp-version80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, safe
http-chrono80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, intrusive
http-cisco-anyconnect261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883ssldefault, discovery, safe
http-coldfusion-subzero80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsexploit
http-comments-displayer80, 443http, httpsdiscovery, safe
http-config-backup80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsauth, intrusive
http-cookie-flags80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdefault, safe, vuln
http-cors80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdefault, discovery, safe
http-cross-domain-policy80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpssafe, external, vuln
http-csrf80, 443http, httpsintrusive, exploit, vuln
http-date80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, safe
http-default-accounts80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, auth, intrusive
http-devframework80, 443http, httpsdiscovery, intrusive
http-dlink-backdoor80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsexploit, vuln
http-dombased-xss80, 443http, httpsintrusive, exploit, vuln
http-domino-enum-passwords80, 443http, httpsintrusive, auth
http-drupal-enum80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, intrusive
http-drupal-enum-users80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, intrusive
http-enum80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, intrusive, vuln
http-errors80, 443http, httpsdiscovery, intrusive
http-exif-spider80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsintrusive
http-favicon80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdefault, discovery, safe
http-feed80, 443http, httpsdiscovery, intrusive
http-fetch80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpssafe
http-fileupload-exploiter80, 443http, httpsintrusive, exploit, vuln
http-form-brute80, 443http, httpsintrusive, brute
http-form-fuzzer80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsfuzzer, intrusive
http-frontpage-login80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, safe
http-generator80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdefault, discovery, safe
http-git80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdefault, safe, vuln
http-gitweb-projects-enum80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, safe
http-google-malware80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsmalware, discovery, safe, external
http-grep80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, safe
http-headers80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, safe
http-hp-ilo-info80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpssafe, discovery
http-huawei-hg5xx-vuln80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsexploit, vuln
http-icloud-findmyiphone--discovery, safe, external
http-icloud-sendmsg--discovery, safe, external
http-iis-short-name-brute80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsintrusive, brute
http-iis-webdav-vuln80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, intrusive
http-internal-ip-disclosure80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, discovery, safe
http-joomla-brute80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsintrusive, brute
http-jsonp-detection80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpssafe, vuln, discovery
http-litespeed-sourcecode-download80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, intrusive, exploit
http-ls80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdefault, discovery, safe
http-majordomo2-dir-traversal80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsintrusive, vuln, exploit
http-malware-host80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsmalware, safe
http-mcmp80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpssafe, discovery
http-methods80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdefault, safe
http-method-tamper80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsauth, vuln
http-mobileversion-checker80, 443http, httpsdiscovery, safe
http-ntlm-info80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdefault, discovery, safe
http-open-proxy8123, 3128, 8000, 8080polipo, squid-http, http-proxydefault, discovery, external, safe
http-open-redirect80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, intrusive
http-passwd80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsintrusive, vuln
http-phpmyadmin-dir-traversal80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, exploit
http-phpself-xss80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsfuzzer, intrusive, vuln
http-php-version80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, safe
http-proxy-brute8123, 3128, 8000, 8080polipo, squid-http, http-proxybrute, intrusive, external
http-put80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, intrusive
http-qnap-nas-info443, 8080https, tcpsafe, discovery
http-referer-checker80, 443http, httpsdiscovery, safe
http-rfi-spider80, 443http, httpsintrusive
http-robots.txt80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdefault, discovery, safe
http-robtex-reverse-ip--discovery, safe, external
http-robtex-shared-ns--discovery, safe, external
http-sap-netweaver-leak80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpssafe, discovery
http-security-headers80, 443http, tcpdiscovery, safe
http-server-header80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsversion
http-shellshock80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsexploit, vuln, intrusive
http-sitemap-generator80, 443http, httpsdiscovery, intrusive
http-slowloris-check80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, safe
http-slowloris80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdos, intrusive
http-sql-injection80, 443http, httpsintrusive, vuln
https-redirect80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsversion
http-stored-xss80, 443http, httpsintrusive, exploit, vuln
http-svn-enum80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdefault, discovery, safe
http-svn-info80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdefault, discovery, safe
http-title80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdefault, discovery, safe
http-tplink-dir-traversal80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, exploit
http-trace80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, discovery, safe
http-traceroute80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, safe
http-trane-info80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, version, safe
http-unsafe-output-escaping80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, intrusive
http-useragent-tester80, 443http, httpsdiscovery, safe
http-userdir-enum80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsauth, intrusive
http-vhosts80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, intrusive
http-virustotal--safe, malware, external
http-vlcstreamer-ls54340vlcstreamer, tcpdiscovery, safe
http-vmware-path-vuln80, 443, 8222, 8333http, httpsvuln, safe
http-vuln-cve2006-339210000-exploit, vuln, intrusive
http-vuln-cve2009-396080, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsexploit, intrusive, vuln
http-vuln-cve2010-073880, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpssafe, auth, vuln
http-vuln-cve2010-286180, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsintrusive, vuln
http-vuln-cve2011-319280, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, safe
http-vuln-cve2011-336880, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsintrusive, vuln
http-vuln-cve2012-182380, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsexploit, vuln, intrusive
http-vuln-cve2013-015680, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsexploit, vuln
http-vuln-cve2013-678680, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsexploit, vuln
http-vuln-cve2013-709180, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsexploit, vuln, intrusive
http-vuln-cve2014-2126261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883sslvuln, safe
http-vuln-cve2014-2127261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883sslvuln, safe
http-vuln-cve2014-2128261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883sslvuln, safe
http-vuln-cve2014-2129261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883sslvuln, safe
http-vuln-cve2014-370480, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, intrusive, exploit
http-vuln-cve2014-887780, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, intrusive, exploit
http-vuln-cve2015-14279200http, tcpvuln, intrusive
http-vuln-cve2015-163580, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, safe
http-vuln-cve2017-100100080, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, safe
http-vuln-cve2017-563880, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln
http-vuln-cve2017-5689623, 664, 16992, 16993amt-soap-httpvuln, auth, exploit
http-vuln-cve2017-891780, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsvuln, intrusive
http-vuln-misfortune-cookie7547httpvuln, intrusive
http-vuln-wnr1000-creds80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsexploit, vuln, intrusive
http-waf-detect80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, intrusive
http-waf-fingerprint80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, intrusive
http-webdav-scan80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpssafe, discovery, default
http-wordpress-brute80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsintrusive, brute
http-wordpress-enum80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, intrusive
http-wordpress-users80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsauth, intrusive, vuln
http-xssed80, 443http, httpssafe, external, discovery
iax2-brute4569iax2, udp, tcpintrusive, brute
iax2-version4569iax2, udp, tcpversion
icap-info1344icapsafe, discovery
iec-identify2404iec-104, tcpdiscovery, intrusive
ike-version500isakmp, udpdefault, discovery, safe, version
imap-brute143, 993imap, imapsbrute, intrusive
imap-capabilities143, 993imap, imapsdefault, safe
imap-ntlm-info143, 993imap, imapsdefault, discovery, safe
impress-remote-discover1599impress-remote, tcpintrusive, brute
informix-brute1526, 9088, 9090, 9092informix, tcpintrusive, brute
informix-query1526, 9088, 9090, 9092informix, tcpintrusive, auth
informix-tables1526, 9088, 9090, 9092informix, tcpintrusive, auth
ip-forwarding--safe, discovery
ip-geolocation-geoplugin--discovery, external, safe
ip-geolocation-ipinfodb--discovery, external, safe
ip-geolocation-map-bing--external, safe
ip-geolocation-map-google--external, safe
ip-geolocation-map-kml--safe
ip-geolocation-maxmind--discovery, external, safe
ip-https-discover261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883ssldiscovery, safe, default
ipidseq--safe, discovery
ipmi-brute623asf-rmcp, udpintrusive, brute
ipmi-cipher-zero623asf-rmcp, udpvuln, safe
ipmi-version623asf-rmcp, udpdiscovery, safe
ipv6-multicast-mld-list--broadcast, discovery
ipv6-node-info--default, discovery, safe
ipv6-ra-flood--dos, intrusive
irc-botnet-channels6664, 6665, 6666, 6667, 6668, 6669, 6679, 6697, 7000, 8067ircdiscovery, vuln, safe
irc-brute6664, 6665, 6666, 6667, 6668, 6669, 6679, 6697, 7000, 8067ircbrute, intrusive
irc-info6664, 6665, 6666, 6667, 6668, 6669, 6679, 6697, 7000, 8067ircdefault, discovery, safe
irc-sasl-brute6664, 6665, 6666, 6667, 6668, 6669, 6679, 6697, 7000, 8067ircbrute, intrusive
irc-unrealircd-backdoor6664, 6665, 6666, 6667, 6668, 6669, 6679, 6697, 7000, 8067ircexploit, intrusive, malware, vuln
iscsi-brute3260tcpintrusive, brute
iscsi-info3260tcpdefault, safe, discovery
isns-info3205isnssafe, discovery
jdwp-execanytcpexploit, intrusive
jdwp-infoanytcpdefault, safe, discovery
jdwp-injectanytcpexploit, intrusive
jdwp-versionanytcpversion
knx-gateway-discover--discovery, safe, broadcast
knx-gateway-info3671efcp, udpdefault, discovery, safe
krb5-enum-users88kerberos-sec, udp, tcpauth, intrusive
ldap-brute389, 636ldap, ldapsslintrusive, brute
ldap-novell-getpass389, 636ldap, ldapssldiscovery, safe
ldap-rootdse389, 636ldap, ldapssl, tcp, udpdiscovery, safe
ldap-search389, 636ldap, ldapssldiscovery, safe
lexmark-config5353, 9100udpdiscovery, safe
llmnr-resolve--discovery, safe, broadcast
lltd-discovery--broadcast, discovery, safe
lu-enum23, 992tn3270intrusive, brute
maxdb-info7210maxdb, tcpdefault, version, safe
mcafee-epo-agent8081tcpversion, safe
membase-brute11210, 11211couchbase-tap, tcpintrusive, brute
membase-http-info8091http, tcpdiscovery, safe
memcached-info11211memcached, tcp, udpdiscovery, safe
metasploit-info55553metasploit-msgrpcintrusive, safe
metasploit-msgrpc-brute55553metasploit-msgrpcintrusive, brute
metasploit-xmlrpc-brute55553metasploit-xmlrpc, tcpintrusive, brute
mikrotik-routeros-brute8728tcpintrusive, brute
mmouse-brute51010mmouse, tcpintrusive, brute
mmouse-exec51010mmouse, tcpintrusive
modbus-discover502modbusdiscovery, intrusive
mongodb-brute27017mongodb, mongodintrusive, brute
mongodb-databases27017mongodb, mongoddefault, discovery, safe
mongodb-info27017mongodb, mongoddefault, discovery, safe
mqtt-subscribe1883, 8883mqtt, secure-mqtt, tcpsafe, discovery, version
mrinfo--discovery, safe, broadcast
msrpc-enum--safe, discovery
ms-sql-brute1433ms-sql-sbrute, intrusive
ms-sql-config1433ms-sql-sdiscovery, safe
ms-sql-dac1434udpdiscovery, safe
ms-sql-dump-hashes1433ms-sql-sauth, discovery, safe
ms-sql-empty-password1433ms-sql-sauth, intrusive
ms-sql-hasdbaccess1433ms-sql-sauth, discovery, safe
ms-sql-info445, 1433, 1434ms-sql-s, smb, tcp, udpdefault, discovery, safe
ms-sql-ntlm-info1433ms-sql-sdefault, discovery, safe
ms-sql-query1433ms-sql-sdiscovery, safe
ms-sql-tables1433ms-sql-sdiscovery, safe
ms-sql-xp-cmdshell1433ms-sql-sintrusive
mtrace--discovery, safe, broadcast
murmur-version64738murmur, tcp, udpversion
mysql-audit3306mysqldiscovery, safe
mysql-brute3306mysqlintrusive, brute
mysql-databases3306mysqldiscovery, intrusive
mysql-dump-hashes3306mysqlauth, discovery, safe
mysql-empty-password3306mysqlintrusive, auth
mysql-enum3306mysqlintrusive, brute
mysql-info3306mysqldefault, discovery, safe
mysql-query3306mysqlauth, discovery, safe
mysql-users3306mysqlauth, intrusive
mysql-variables3306mysqldiscovery, intrusive
mysql-vuln-cve2012-21223306mysqldiscovery, intrusive, vuln
nat-pmp-info5351nat-pmp, udpdefault, discovery, safe
nat-pmp-mapport5351nat-pmp, udpdiscovery, safe
nbd-info10809netbios-ns, tcpdiscovery, intrusive
nbns-interfaces137netbios-ns, udpdefault, discovery, safe
nbstat135, 137, 139, 445netbios, smb, tcp, udpdefault, discovery, safe
ncp-enum-users524ncp, tcpauth, safe
ncp-serverinfo524ncp, tcpdefault, discovery, safe
ndmp-fs-info10000ndmp, tcpdiscovery, safe
ndmp-version10000ndmp, tcpversion
nessus-brute1241nessus, tcpintrusive, brute
nessus-xmlrpc-brute8834ssl/http, tcpintrusive, brute
netbus-auth-bypass12345netbus, tcpauth, safe, vuln
netbus-brute12345netbus, tcpbrute, intrusive
netbus-info12345netbus, tcpdefault, discovery, safe
netbus-version12345netbus, tcpversion
nexpose-brute3780nexpose, tcpintrusive, brute
nfs-ls111rpcbind, tcp, udpdiscovery, safe
nfs-showmount111rpcbind, mountd, tcp, udpdiscovery, safe
nfs-statfs111rpcbind, tcp, udpdiscovery, safe
nje-node-brute175, 2252njeintrusive, brute
nje-pass-brute175, 2252njeintrusive, brute
nntp-ntlm-info119, 433, 563nntp, snewsdefault, discovery, safe
nping-brute9929nping-echobrute, intrusive
nrpe-enum5666nrpediscovery, intrusive
ntp-info123ntp, udp, tcpdefault, discovery, safe
ntp-monlist123ntp, udpdiscovery, intrusive
omp2-brute9390openvasbrute, intrusive
omp2-enum-targets9390openvasdiscovery, safe
openflow-info6633, 6653openflow, tcpdefault, safe
omron-info9600fins, tcp, udpdiscovery, version
openlookup-info5850openlookupdefault, discovery, safe, version
openvas-otp-brute9390, 9391openvas, tcpintrusive, brute
openwebnet-discovery20000openwebnetdiscovery, safe
oracle-brute1521oracle-tnsintrusive, brute
oracle-brute-stealth1521oracle-tnsintrusive, brute
oracle-enum-users1521oracle-tnsintrusive, auth
oracle-sid-brute1521oracle-tnsintrusive, brute
oracle-tns-version1521, 1522, 1523oracle-tnsversion, safe
ovs-agent-version8899-version
p2p-conficker137, 139, 445smb, netbios, tcp, udpdefault, safe
path-mtu--safe, discovery
pcanywhere-brute5631pcanywheredataintrusive, brute
pcworx-info1962pcworx, tcpdiscovery
pgsql-brute5432postgresqlintrusive, brute
pjl-ready-message9100jetdirectintrusive
pop3-brute110, 995pop3, pop3sintrusive, brute
pop3-capabilities110, 995pop3, pop3sdefault, discovery, safe
pop3-ntlm-info110, 995pop3, pop3sdefault, discovery, safe
port-states--safe
pptp-version1723-version
puppet-naivesigning8140puppet, tcpintrusive, vuln
qconn-exec8000qconn, tcpintrusive, exploit, vuln
qscan--safe, discovery
quake1-info--default, discovery, safe, version
quake3-info27960-27970quake3, udpdefault, discovery, safe, version
quake3-master-getservers20110, 20510, 27950, 30710quake3-master, udpdefault, discovery, safe
rdp-enum-encryption3389ms-wbt-serversafe, discovery
rdp-ntlm-info3389ms-wbt-serverdefault, discovery, safe
rdp-vuln-ms12-0203389ms-wbt-serverintrusive, vuln
realvnc-auth-bypass5900, 5901, 5902vncauth, safe, vuln
redis-brute6379redisintrusive, brute
redis-info6379redisdiscovery, safe
resolveall--safe, discovery
reverse-index--safe
rexec-brute512exec, tcpbrute, intrusive
rfc868-time37time, tcp, udpdiscovery, safe, version
riak-http-info8098httpdiscovery, safe
rlogin-brute513login, tcpbrute, intrusive
rmi-dumpregistry1098, 1099, 1090, 8901, 8902, 8903java-rmi, rmiregistrydefault, discovery, safe
rmi-vuln-classloader1098, 1099, 1090, 8901, 8902, 8903java-rmi, rmiregistryintrusive, vuln
rpcap-brute2002rpcap, tcpintrusive, brute
rpcap-info2002rpcap, tcpdiscovery, safe
rpc-grindanyrpcbindversion
rpcinfo111rpcbind, tcp, udpdiscovery, default, safe, version
rsa-vuln-roca22, 261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883ssh, sslvuln, safe
rsync-brute873rsync, tcpbrute, intrusive
rsync-list-modules873rsync, tcpdiscovery, safe
rtsp-methods554rtsp, tcpdefault, safe
rtsp-url-brute554rtsp, tcpbrute, intrusive
rusersanyrusersd, tcp, udpdiscovery, safe
s7-info102iso-tsap, tcpdiscovery, version
samba-vuln-cve-2012-1182139netbios-ssnvuln, intrusive
servicetags6481udpdefault, discovery, safe
shodan-api--discovery, safe, external
sip-brute5060sip, tcp, udpintrusive, brute
sip-call-spoof5060sip, tcp, udpdiscovery, intrusive
sip-enum-users5060sip, tcp, udpauth, intrusive
sip-methods5060sip, tcp, udpdefault, safe, discovery
skypev2-versionanytcpversion
smb2-capabilities137, 139, 445smb, netbios, tcp, udpsafe, discovery
smb2-security-mode137, 139, 445smb, netbios, tcp, udpsafe, discovery, default
smb2-time137, 139, 445smb, netbios, tcp, udpdiscovery, safe, default
smb2-vuln-uptime137, 139, 445smb, netbios, tcp, udpvuln, safe
smb-brute137, 139, 445smb, netbios, tcp, udpintrusive, brute
smb-double-pulsar-backdoor137, 139, 445smb, netbios, tcp, udpvuln, safe, malware
smb-enum-domains137, 139, 445smb, netbios, tcp, udpdiscovery, intrusive
smb-enum-groups137, 139, 445smb, netbios, tcp, udpdiscovery, intrusive
smb-enum-processes137, 139, 445smb, netbios, tcp, udpdiscovery, intrusive
smb-enum-services139, 445smb, netbios, tcpdiscovery, intrusive, safe
smb-enum-sessions137, 139, 445smb, netbios, tcp, udpdiscovery, intrusive
smb-enum-shares137, 139, 445smb, netbios, tcp, udpdiscovery, intrusive
smb-enum-users137, 139, 445smb, netbios, tcp, udpauth, intrusive
smb-flood137, 139, 445smb, netbios, tcp, udpintrusive, dos
smb-ls137, 139, 445smb, netbios, tcp, udpdiscovery, safe
smb-mbenum137, 139, 445smb, netbios, tcp, udpdiscovery, safe
smb-os-discovery137, 139, 445smb, netbios, tcp, udpdefault, discovery, safe
smb-print-text137, 139, 445smb, netbios, tcp, udpintrusive
smb-protocols137, 139, 445smb, netbios, tcp, udpsafe, discovery
smb-psexec137, 139, 445smb, netbios, tcp, udpintrusive
smb-security-mode137, 139, 445smb, netbios, tcp, udpdefault, discovery, safe
smb-server-stats137, 139, 445smb, netbios, tcp, udpdiscovery, intrusive
smb-system-info137, 139, 445smb, netbios, tcp, udpdiscovery, intrusive
smb-vuln-conficker137, 139, 445smb, netbios, tcp, udpintrusive, exploit, dos, vuln
smb-vuln-cve2009-3103137, 139, 445smb, netbios, tcp, udpintrusive, exploit, dos, vuln
smb-vuln-cve-2017-7494137, 139, 445smb, netbios, tcp, udpvuln, intrusive
smb-vuln-ms06-025137, 139, 445smb, netbios, tcp, udpintrusive, exploit, dos, vuln
smb-vuln-ms07-029137, 139, 445smb, netbios, tcp, udpintrusive, exploit, dos, vuln
smb-vuln-ms08-067137, 139, 445smb, netbios, tcp, udpintrusive, exploit, dos, vuln
smb-vuln-ms10-054137, 139, 445smb, netbios, tcp, udpvuln, intrusive, dos
smb-vuln-ms10-061137, 139, 445smb, netbios, tcp, udpvuln, intrusive
smb-vuln-ms17-010137, 139, 445smb, netbios, tcp, udpvuln, safe
smb-vuln-regsvc-dos137, 139, 445smb, netbios, tcp, udpintrusive, exploit, dos, vuln
smb-vuln-webexec445, 139smb, netbios, tcpintrusive, vuln
smb-webexec-exploit445, 139smb, netbios, tcpintrusive, exploit
smtp-brute25, 465, 587smtp, smtps, submissionbrute, intrusive
smtp-commands25, 465, 587smtp, smtps, submissiondefault, discovery, safe
smtp-enum-users25, 465, 587smtp, smtps, submissionauth, external, intrusive
smtp-ntlm-info25, 465, 587smtp, smtps, submissiondefault, discovery, safe
smtp-open-relay25, 465, 587smtp, smtps, submissiondiscovery, intrusive, external
smtp-strangeport25, 465, 587smtp, smtps, submissionmalware, safe
smtp-vuln-cve2010-434425, 465, 587smtp, smtps, submissionexploit, intrusive, vuln
smtp-vuln-cve2011-172025, 465, 587smtp, smtps, submissionintrusive, vuln
smtp-vuln-cve2011-176425, 465, 587smtp, smtps, submissionintrusive, vuln
sniffer-detect--discovery, intrusive
snmp-brute161snmp, udpintrusive, brute
snmp-hh3c-logins161snmp, udpdefault, discovery, safe
snmp-info161snmp, udpdefault, version, safe
snmp-interfaces161snmp, udpdefault, discovery, safe
snmp-ios-config161snmp, udpintrusive
snmp-netstat161snmp, udpdefault, discovery, safe
snmp-processes161snmp, udpdefault, discovery, safe
snmp-sysdescr161snmp, udpdefault, discovery, safe
snmp-win32-services161snmp, udpdefault, discovery, safe
snmp-win32-shares161snmp, udpdefault, discovery, safe
snmp-win32-software161snmp, udpdefault, discovery, safe
snmp-win32-users161snmp, udpdefault, auth, safe
socks-auth-info1080, 9050socks, socks5, tor-socksdiscovery, safe, default
socks-brute1080, 9050socks, socks5, tor-socksbrute, intrusive
socks-open-proxy1080, 9050socks, socks5, tor-socksdefault, discovery, external, safe
ssh2-enum-algos22sshsafe, discovery
ssh-auth-methods22sshauth, intrusive
ssh-brute22sshbrute, intrusive
ssh-hostkey22sshsafe, default, discovery
ssh-publickey-acceptance22sshauth, intrusive
ssh-run22sshintrusive
sshv122sshdefault, safe
ssl-ccs-injection261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883sslvuln, safe
ssl-cert-intaddr261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883sslvuln, discovery, safe
ssl-cert261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883ssldefault, safe, discovery
ssl-date261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883ssldiscovery, safe, default
ssl-dh-params261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883sslvuln, safe
ssl-enum-ciphers261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883ssldiscovery, intrusive
ssl-heartbleed261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883sslvuln, safe
ssl-known-key261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883sslsafe, discovery, vuln, default
ssl-poodle261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883sslvuln, safe
sslv2-drown261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883sslintrusive, vuln
sslv2261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883ssldefault, safe
sstp-discover261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883ssldiscovery, default, safe
stun-info3478stun, udpdiscovery, safe
stun-version3478stun, udpversion
stuxnet-detect137, 139, 445smb, netbios, tcp, udpdiscovery, intrusive
supermicro-ipmi-conf49152tcpexploit, vuln
svn-brute3690svnserve, tcpintrusive, brute
targets-asn--discovery, external, safe
targets-ipv6-map4to6--discovery
targets-ipv6-multicast-echo--discovery, broadcast
targets-ipv6-multicast-invalid-dst--discovery, broadcast
targets-ipv6-multicast-mld--discovery, broadcast
targets-ipv6-multicast-slaac--discovery, broadcast
targets-ipv6-wordlist--discovery
targets-sniffer--broadcast, discovery, safe
targets-traceroute--safe, discovery
targets-xml--safe
teamspeak2-version8767teamspeak2, udpversion
telnet-brute23telnetbrute, intrusive
telnet-encryption23telnetsafe, discovery
telnet-ntlm-info23telnetdefault, discovery, safe
tftp-enum69udpdiscovery, intrusive
tls-alpn261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883ssldiscovery, safe, default
tls-nextprotoneg261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883ssldiscovery, safe, default
tls-ticketbleed261, 271, 324, 443, 465, 563, 585, 636, 853, 989, 990, 992, 993, 994, 995, 2221, 2252, 2376, 3269, 3389, 4911, 5061, 5986, 6679, 6697, 8443, 9001, 8883sslvuln, safe
tn3270-screen23, 992tn3270safe, discovery
tor-consensus-checker--external, safe
traceroute-geolocation--safe, external, discovery
tso-brute23, 992, 623tn3270intrusive
tso-enum23, 992, 623tn3270intrusive, brute
ubiquiti-discovery10001ubiquiti-discovery, udpdefault, discovery, version, safe
unittest--safe
unusual-portany-safe
upnp-info1900udpdefault, discovery, safe
uptime-agent-info9998uptime-agent, tcpsafe, default
url-snarf--safe
ventrilo-info3784ventrilo, tcp, udpdefault, discovery, safe, version
versant-info5019versant, tcpdiscovery, safe
vmauthd-brute902ssl/vmware-auth, vmware-auth, tcpbrute, intrusive
vmware-version80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdiscovery, safe, version
vnc-brute5901vnc, tcpintrusive, brute
vnc-info5900, 5901, 5902vnc, tcpdefault, discovery, safe
vnc-title5900, 5901, 5902vnc, tcpintrusive, discovery
voldemort-info6666vp3, tcpdiscovery, safe
vtam-enum23, 992tn3270intrusive, brute
vulners--vuln, safe, external
vuze-dht-info17555, 49160, 49161, 49162vuze-dht, udpdiscovery, safe
wdb-version17185wdbrpc, udpdefault, safe, version, discovery, vuln
weblogic-t3-info7001, 7002, 7003httpdefault, safe, discovery, version
whois-domain--discovery, external, safe
whois-ip--discovery, external, safe
wsdd-discover3702udpsafe, discovery, default
x11-access6000-6009-default, safe, auth
xdmcp-discover177xdmcp, udpsafe, discovery
xmlrpc-methods80, 443, 631, 7080, 8080, 8443, 8088, 5800, 3872, 8180, 8000http, httpsdefault, safe, discovery
xmpp-brute5222jabber, xmpp-clientbrute, intrusive
xmpp-info5222, 5269jabber, xmpp-client, xmpp-serverdefault, safe, discovery, version

NSE script categories

Currently there are 14 categories of NSE scripts in total. The categories include:

  • auth
  • broadcast
  • brute
  • default
  • discovery
  • dos
  • exploit
  • external
  • fuzzer
  • intrusive
  • malware
  • safe
  • version
  • vuln

More information about NSE script categories and their description can be found here.

How to use NSE scripts

Nmap is very flexible when it comes to running NSE scripts. For instance, it allows you to run a single script or multiple scripts in one shot using a single nmap command.

Here is a simplest example of running a single script to enumerate OS version of a target Windows system over the SMB protocol:

nmap -p 445 --script smb-os-discovery <target>

Here is an example of running multiple scripts in one shot, enumerating OS version, network shares and the NetBIOS information of a target Windows system:

nmap -p 139,445 --script smb-os-discovery,smb-enum-services,nbstat <target>

Below are a few examples of how you can run multiple scripts based on the category criteria alone:

nmap --script discovery <target>
nmap --script "default and safe" <target>
nmap --script "not intrusive" <target>

You can also use wildcards (*) to specify multiple scripts based on their name and combine it with a category criteria, e.g.:

nmap --script "http-* and (default or safe or intrusive)" <target>

Note that some scripts have arguments, which you can provide via the --script-args option. Here’s an example of SSH login brute forcing using a custom user list and password list:

nmap -p 22 --script ssh-brute --script-args userdb=users.txt,passdb=pwds.txt,brute.threads=4 <target>

To find out which arguments are applicable in which script is a bit tricky. Sometimes even reading the source code of the script will not help you, because the arguments could be processed in the NSE library that the script is dependent on.

The best way to find out all the script arguments is to use the official https://nmap.org/nsedoc/ documentation. The above Nmap script list / interactive spreadsheet provides links directly to each script manual page with all the details, including the script arguments.

NSE is very powerful and the information here is really only scratching the surface. For more details and examples of how to use NSE scripts, I encourage you to visit the official Usage and Examples page.

How to debug NSE script

Sometimes you may encounter a problem with a NSE script, for example you may be wondering if a particular script is running at all or if it is doing what it is supposed to be doing.

Here are couple of tips you can try to debug a NSE script:

  1. Increase verbosity level using the -v switch. NSE engine will start producing more output and showing you little more what is going on. Note you can also increase the verbosity using multiple -vv or set the level directly (max is -v3).
  2. Increase debug level using the -d switch. This will start producing debugging information with even more details. You can also use multiple -dd or set the debug level directly (up to -d9 which is max).
  3. Use the --script-trace switch, which will show all the network data that are being sent and received.
  4. Lastly you can review the source code of the script and even insert some debugging messages by yourself. The scripts are typically located in the /usr/share/nmap/scripts folder.

One of the typical problems why NSE scripts are not functioning properly or not running at all is that you are not running nmap as a root user, but only as a normal user. Although most NSE scripts do not require root privileges, some of them do. For more information, see why nmap needs root privileges.

Conclusion

Hopefully this article provided some value for you and gave you the ability to orientate yourself better in the world of NSE scripts.

Nmap scripts have been around for many years, they are well tested and it is always prudent to incorporate them into our penetration tests.

If you find this information useful, please consider subscribing and following InfosecMatter on Twitter, Facebook or Github to keep up with the latest developments.

SHARE THIS

TAGS | | | | | | | | | | | |

RECENT POSTS

MOST VIEWED POSTS

MOST VIEWED TOOLS

Leave a Comment

Your email address will not be published. Required fields are marked *