Introduction
In this lab, you will transition Nmap from a simple port scanner into a versatile auditing tool. You will explore the Nmap Scripting Engine (NSE), one of Nmap's most powerful and flexible features.
NSE allows users to write and share simple scripts to automate a wide variety of networking tasks. These scripts are executed in parallel with the speed and efficiency you expect from Nmap. By the end of this lab, you will know how to locate these scripts on your Linux system, run default non-intrusive scripts, and execute specific scripts to automatically extract information such as HTTP webpage titles.
NSE is important because it changes Nmap from a mapper into a small auditing platform. Once a port is found, scripts can ask richer application questions without requiring a separate tool immediately.
Locate NSE Scripts
In this step, you will explore where Nmap stores its scripts and how to search for specific ones.
The Nmap Scripting Engine (NSE) uses scripts written in the Lua programming language. When you install Nmap on a Linux system, it comes pre-packaged with hundreds of these scripts, covering everything from basic network discovery to complex vulnerability exploitation.
Learning where the scripts live is useful because defenders and testers both need to understand what logic they are actually running against a target.
By default, Nmap stores all of its NSE scripts in the /usr/share/nmap/scripts/ directory. You can list the contents of this directory to see what is available.
Run the following command to list the first few scripts in the directory:
ls /usr/share/nmap/scripts/ | head -n 10
You will see an output similar to this:
acarsd-info.nse
address-info.nse
afp-brute.nse
afp-ls.nse
afp-path-vuln.nse
afp-serverinfo.nse
afp-showmount.nse
ajp-auth.nse
ajp-brute.nse
ajp-headers.nse
Notice that all the files end with the .nse extension, which stands for Nmap Scripting Engine.
Because there are over 600 scripts, it is often helpful to search for scripts related to a specific service. For example, if you want to find scripts related to HTTP (web servers), you can use the grep command to filter the results.
Run the following command to find HTTP-related scripts:
ls /usr/share/nmap/scripts/ | grep http | head -n 10
This will display a list of scripts designed to interact with web servers, such as http-title.nse which grabs the title of a webpage, or http-auth.nse which checks for authentication mechanisms.
Run Default Scripts (-sC)
In this step, you will learn how to run Nmap's default set of scripts.
Nmap categorizes its scripts into different groups based on their purpose and how intrusive they are. The default category contains scripts that are considered safe, fast, and reliable. They gather useful information without aggressively attacking the target or causing service disruptions.
Categories are really a risk and intent classification. They help you choose scripts that fit the context instead of blindly running everything available.
To run the default set of scripts, you can use the -sC flag. This is equivalent to typing --script=default.
For this lab, a lightweight web server has been started in the background on port 8080, and the standard SSH service is running on port 22. Let's scan the local machine (localhost) on these specific ports using the default scripts.
Run the following command:
nmap -sC -p 22,8080 localhost
You will see an output similar to this:
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-09 14:56 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00013s latency).
Other addresses for localhost (not scanned): ::1
PORT STATE SERVICE
22/tcp open ssh
8080/tcp open http-proxy
|_http-title: LabEx Nmap NSE Target
Nmap done: 1 IP address (1 host up) scanned in 0.49 seconds
Look closely at the output. Under port 8080, Nmap automatically ran the http-title script and successfully extracted the webpage title: "LabEx Nmap NSE Target". Nmap uses these default scripts to gather more information about the open ports seamlessly.
This demonstrates how the -sC flag instantly upgrades Nmap from a simple port scanner to an information-gathering tool.
Run Specific Category Scripts
In this step, you will learn how to execute specific scripts or entire categories of scripts using the --script argument.
While the default scripts (-sC) are great for general reconnaissance, sometimes you need to run a specific script for a targeted task. You can do this by passing the script's name to the --script argument.
For example, if you only want to grab the HTTP title of the web server running on port 8080 without running any other default scripts, you can specify the http-title script directly.
Run the following command:
nmap --script=http-title -p 8080 localhost
The output will be highly focused, showing only the port status and the result of the http-title script:
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-09 14:56 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000057s latency).
Other addresses for localhost (not scanned): ::1
PORT STATE SERVICE
8080/tcp open http-proxy
|_http-title: LabEx Nmap NSE Target
Nmap done: 1 IP address (1 host up) scanned in 0.28 seconds
In addition to individual script names, you can also specify script categories. Nmap groups scripts into categories such as safe, intrusive, vuln (vulnerability detection), discovery, and exploit.
Run the following command to execute all safe scripts against port 8080:
nmap --script=safe -p 8080 localhost
Note: Running an entire category of scripts can take a significant amount of time (sometimes over 9 minutes!), depending on the network environment and the number of scripts in that category. Some scripts may also wait for timeouts. If you don't want to wait, you can press
Ctrl+Cto cancel the scan and skip this step.
The output will include the HTTP title, but may also include other safe checks depending on the exact Nmap version and environment:
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-09 14:56 CST
Pre-scan script results:
| targets-asn:
|_ targets-asn.asn is a mandatory parameter
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000057s latency).
Other addresses for localhost (not scanned): ::1
PORT STATE SERVICE
8080/tcp open http-proxy
|_http-date: Mon, 09 Mar 2026 06:57:04 GMT; 0s from local time.
|_http-fetch: Please enter the complete path of the directory to save data in.
| http-headers:
| Server: SimpleHTTP/0.6 Python/3.10.12
| Date: Mon, 09 Mar 2026 06:57:03 GMT
| Content-type: text/html
| Content-Length: 103
| Last-Modified: Mon, 09 Mar 2026 06:55:32 GMT
|
|_ (Request type: HEAD)
|_http-title: LabEx Nmap NSE Target
Host script results:
| dns-blacklist:
| SPAM
| list.quorum.to - SPAM
| l2.apews.org - FAIL
|_ bl.nszones.com - SPAM
|_fcrdns: FAIL (No PTR record)
| resolveall:
| Host 'localhost' also resolves to:
| Use the 'newtargets' script-arg to add the results as targets
|_ Use the --resolve-all option to scan all resolved addresses without using this script.
| unusual-port:
|_ WARNING: this script depends on Nmap's service/version detection (-sV)
Post-scan script results:
| reverse-index:
|_ 8080/tcp: 127.0.0.1
Nmap done: 1 IP address (1 host up) scanned in 551.51 seconds
Using the --script argument gives you granular control over your auditing process, allowing you to tailor your scans to your specific security testing needs.
Summary
Congratulations! You have successfully completed the Nmap Scripting Engine (NSE) Basics lab.
In this lab, you learned how to:
- Locate the default directory for NSE scripts (
/usr/share/nmap/scripts/) and search for specific scripts using standard Linux commands. - Use the
-sCflag to run a collection of default, safe scripts to automatically gather information like SSH host keys and HTTP webpage titles. - Use the
--scriptargument to execute individual scripts by name or run entire categories of scripts, giving you precise control over your network auditing tasks.
These foundational skills will allow you to leverage Nmap as a powerful, automated security auditing tool in your future network exploration and penetration testing endeavors.
