Nmap Script Categories and Updating

Introduction

In the heart of the mystical Enchanted Forest, under a sky illuminated by an ethereal glow, there existed a realm uncharted by ordinary maps—a domain where digital and natural worlds converged. This realm was safeguarded by an ancient and wise entity known as the Spirit Mentor of the Enchanted Forest. The Spirit Mentor, a guardian of both the forest and the cyber realm, faced a new challenge as dark forces threatened the delicate balance of this unique ecosystem.

To protect the realm, the Spirit Mentor sought out brave souls who could master the art of Nmap, a powerful tool in the cyber domain. Nmap, or Network Mapper, was a key that could unlock the secrets of the forest's digital landscape, revealing unseen threats and vulnerabilities. The goal set by the Spirit Mentor was clear: to empower these individuals with the proficiency to navigate through the complexities of Nmap Scripting Engine (NSE), categorizing scripts and ensuring their configurations remained updated against the ever-evolving cyber threats.

Skills Graph

Exploring Nmap Script Categories

In this step, you will begin your journey under the guidance of the Spirit Mentor to uncover the secrets of Nmap's scripting capabilities. Nmap scripts are categorized based on their functionality and purpose, such as discovery, vulnerability assessment, and exploitation.

First, open a terminal and make sure you are in the correct directory:

cd /home/labex/project

Now, let's list the default Nmap script categories by executing the following command in your zsh terminal:

ls /usr/share/nmap/scripts/ | cut -d'.' -f1 | sort | uniq

This command lists all the scripts available in Nmap's default script directory, cuts off the file extension, sorts them, and filters out duplicates, giving you an insight into the various categories.

For your practice, let's create a simple directory structure to organize scripts that you find interesting. For instance, to focus on vulnerability scripts:

mkdir -p /home/labex/project/NmapScripts/vulnerability

Move any script you find interesting into this directory. Here's an example of how to move a script related to SMB vulnerability:

cp /usr/share/nmap/scripts/smb-vuln* /home/labex/project/NmapScripts/vulnerability/

Remember, the understanding of these categories is crucial for your journey.

Updating Nmap and Script Database

Staying updated is paramount in the realm of cyber security. In this step, you will learn how to keep Nmap and its script database current, an essential skill to combat new vulnerabilities.

If Nmap is already installed, you can update it directly. However, this lab assumes that Nmap is already installed and focuses on updating the script database. Assuming you have created a new nse script yourself, follow the steps to add this script to the database of scripts available to nmap:

Create a new nse script in the /usr/share/nmap/scripts/ directory. For example, create a file named myscript.nse with the following content:

sudo nano /usr/share/nmap/scripts/myscript.nse

description = [[a demo nse file]]
author = "labex"
license = "labex"
categories = {"default"}

portrule = function( host, port )
   return true
end

action = function(host, port)
    return "Hello, Nmap!"
end

Save the file and exit the editor.

Now, update the Nmap script database with the following command:

sudo nmap --script-updatedb

This command updates Nmap's script database, ensuring you have the latest script versions to detect and exploit vulnerabilities accurately.

To verify the update, you can list some recently updated scripts using the ls command along with head to view the top entries:

ls -lt /usr/share/nmap/scripts/ | head

This lists the scripts based on modification time, showing you the most recently updated scripts at the top.

Or, you can run the following command to check the new script you added:

nmap --script myscript 127.0.0.1

Output:

Starting Nmap 7.80 ( https://nmap.org ) at 2024-03-15 22:39 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000092s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
|_myscript: Hello, Nmap!
3001/tcp open  nessus
|_myscript: Hello, Nmap!

Nmap done: 1 IP address (1 host up) scanned in 0.21 seconds

Summary

In this lab, we embarked on a mystical journey into the Enchanted Forest, under the guidance of the Spirit Mentor, to master the art of Nmap Script Categories and Updating. Beginning from understanding the vast landscape of Nmap's scripting capabilities to ensuring our tools and defenses were up to the latest standards, we've traversed across crucial aspects that every cyber security enthusiast should know. This hands-on approach not only allowed us to familiarize ourselves with the practical applications of Nmap but also instilled the importance of continuous learning and adaptability in the cybersecurity realm. Through mastering these skills, we're now better equipped to protect the digital ecosystem of the Enchanted Forest against looming threats, embodying the wisdom and foresight of the Spirit Mentor.