Introduction
Welcome to the Vulnerability Scanning with NSE lab.
Nmap (Network Mapper) is a powerful open-source tool used for network discovery and security auditing. One of its most flexible and powerful features is the Nmap Scripting Engine (NSE). NSE allows users to write and share simple scripts to automate a wide variety of networking tasks.
Using NSE for vulnerability scanning is powerful, but it also changes the meaning of the scan. You are no longer just observing exposure. You are actively probing for known weaknesses. That makes scope control and careful interpretation more important.
In this lab, you will learn how to transform Nmap from a simple port scanner into an active vulnerability scanner. You will utilize specific script categories, such as vuln, to actively probe target services. This process helps identify known Common Vulnerabilities and Exposures (CVEs) and dangerous server misconfigurations. By the end of this lab, you will be able to update the script database, run category-based scans, audit specific services like HTTP and SMB, and analyze the scan results.
Update NSE Script Database
In this step, you will learn how to update the Nmap Scripting Engine (NSE) database.
Nmap comes pre-packaged with hundreds of scripts located in the /usr/share/nmap/scripts/ directory. These scripts are categorized by their purpose, such as default, discovery, safe, intrusive, vuln, and exploit.
Before running any vulnerability scans, it is a best practice to ensure that Nmap's internal script database is up to date. This database acts as an index, allowing Nmap to quickly find and categorize scripts. When new scripts are added to the system or existing ones are modified, the database must be updated so Nmap knows how to use them.
This mirrors a broader security principle: detection and assessment content ages quickly. Tools are only as current as the rules, signatures, or templates they rely on.
To update the NSE script database, you need to use the --script-updatedb argument. Since this command modifies system files in the Nmap installation directory, it requires administrative privileges.
Run the following command in your terminal:
sudo nmap --script-updatedb
You should see an output similar to this, indicating that the database was successfully updated:
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-09 15:25 CST
NSE: Updating rule database.
NSE: Script Database updated successfully.
Nmap done: 0 IP addresses (0 hosts up) scanned in 1.09 seconds
This confirms that Nmap has successfully refreshed its index of available scripts and categories. You are now ready to start scanning.
Run Vulnerability Scans (vuln category)
In this step, you will use the vuln category of NSE scripts to scan for known vulnerabilities on your local machine.
The vuln category contains scripts specifically designed to check for known vulnerabilities and report them. When you specify a category instead of a single script name, Nmap will automatically run all scripts that belong to that category against the open ports it discovers.
Findings from these scripts are leads, not final proof of compromise. A positive result often means "this service appears consistent with a known issue" and still needs analyst review.
To get the most accurate results, it is highly recommended to combine NSE scripts with version detection. Version detection (-sV) attempts to determine the exact software and version running on an open port. Many vulnerability scripts rely on this version information to decide whether a target might be vulnerable before sending intrusive probes.
You will scan your local machine (localhost) using version detection and the vuln script category.
Execute the following command:
nmap -sV --script vuln -p 80,139,445 localhost
The scan might take a minute or two to complete because vulnerability scripts perform complex checks. Your output will look similar to the following:
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-09 15:25 CST
Pre-scan script results:
| broadcast-avahi-dos:
| Discovered hosts:
| 224.0.0.251
| After NULL UDP avahi packet DoS (CVE-2011-1002).
|_ Hosts are all up (not vulnerable).
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0014s latency).
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.52 ((Ubuntu))
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-enum:
|_ /server-status/: Potentially interesting folder
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| vulners:
| cpe:/a:apache:http_server:2.4.52:
| PACKETSTORM:176334 9.8 https://vulners.com/packetstorm/PACKETSTORM:176334 *EXPLOIT*
| HTTPD:C072933AA965A86DA3E2C9172FFC1569 9.8 https://vulners.com/httpd/HTTPD:C072933AA965A86DA3E2C9172FFC1569
| ... (truncated for brevity)
139/tcp open netbios-ssn Samba smbd 4.6.2
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
| vulners:
| cpe:/a:samba:samba:4.6.2:
| SSV:93139 10.0 https://vulners.com/seebug/SSV:93139 *EXPLOIT*
| SAMBA_IS_KNOWN_PIPENAME 10.0 https://vulners.com/canvas/SAMBA_IS_KNOWN_PIPENAME *EXPLOIT*
| ... (truncated for brevity)
445/tcp open netbios-ssn Samba smbd 4.6.2
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
| vulners:
| cpe:/a:samba:samba:4.6.2:
| SSV:93139 10.0 https://vulners.com/seebug/SSV:93139 *EXPLOIT*
| ... (truncated for brevity)
Host script results:
|_samba-vuln-cve-2012-1182: Could not negotiate a connection:SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [9]
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: Could not negotiate a connection:SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [9]
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 66.86 seconds
In this output, Nmap discovered the Apache web server on port 80 and the Samba service on ports 139 and 445. The scripts under the vuln category automatically ran against these services, checking for common issues like interesting HTTP directories and known SMB vulnerabilities.
Audit Specific Services (e.g., SMB/HTTP)
In this step, you will learn how to target specific services using individual NSE scripts rather than running an entire category.
Running an entire category like vuln can be noisy and time-consuming. Often, during a security assessment, you will identify a specific service (like a web server or a file share) and want to run targeted scripts against it.
For example, the http-enum script enumerates directories used by popular web applications and servers. It is a great way to find hidden administrative panels or backup folders. To make the scan faster, you can use the -p flag to tell Nmap to only scan the specific port where the service is running (e.g., port 80 for HTTP).
Run the following command to audit the local Apache web server:
nmap -p 80 --script http-enum localhost
You will see output focusing only on port 80:
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-09 15:27 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000096s latency).
PORT STATE SERVICE
80/tcp open http
| http-enum:
|_ /server-status/: Potentially interesting folder
Nmap done: 1 IP address (1 host up) scanned in 0.62 seconds
Similarly, you can target the Samba (SMB) service. SMB is a network file sharing protocol that has historically been a frequent target for exploits. You can use the smb-os-discovery script to gather detailed information about the operating system and the SMB configuration. SMB typically runs on ports 139 and 445.
Run the following command to audit the local SMB service:
nmap -p 139,445 --script smb-os-discovery localhost
The output will provide detailed information about the SMB service:
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-09 15:27 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000087s latency).
PORT STATE SERVICE
139/tcp open netbios-ssn
445/tcp open microsoft-ds
Nmap done: 1 IP address (1 host up) scanned in 0.21 seconds
By targeting specific ports and scripts, you significantly reduce scan time and generate highly focused, actionable results.
Analyze NSE Output
In this final step, you will learn how to save your Nmap scan results to a file and analyze the output for specific keywords.
When conducting vulnerability scans, the output can be extensive. It is crucial to save the results to a file so you can review them later, share them with your team, or parse them using other command-line tools. Nmap provides several output formats. The -oN flag saves the output in a normal, human-readable text format.
You will run a vulnerability scan against the local machine and save the results to a file named vuln_scan.txt in your project directory.
Execute the following command:
nmap -sV --script vuln -p 80,139,445 localhost -oN ~/project/vuln_scan.txt
Wait for the scan to complete. Once it finishes, the results are safely stored in ~/project/vuln_scan.txt.
Now, you can analyze this file. In a real-world scenario, you might be looking for specific indicators of compromise or critical vulnerabilities. You can use the grep command to search through the text file. For example, you can search for the word "VULNERABLE" (case-insensitive using the -i flag) to quickly spot any confirmed issues.
Run the following command to search the output file:
grep -i "VULNERABLE" ~/project/vuln_scan.txt
|_ Hosts are all up (not vulnerable).
To verify that the file was created and contains the scan data, you can view the first few lines of the file using the head command:
head -n 10 ~/project/vuln_scan.txt
You should see the standard Nmap header and the beginning of the scan report:
## Nmap 7.80 scan initiated Mon Mar 9 15:27:21 2026 as: nmap -sV --script vuln -p 80,139,445 -oN /home/labex/project/vuln_scan.txt localhost
Pre-scan script results:
| broadcast-avahi-dos:
| Discovered hosts:
| 224.0.0.251
| After NULL UDP avahi packet DoS (CVE-2011-1002).
|_ Hosts are all up (not vulnerable).
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000085s latency).
Saving and parsing output is a fundamental skill for any security professional, allowing you to manage large amounts of data efficiently.
Summary
Congratulations! You have successfully completed the Vulnerability Scanning with NSE lab.
In this lab, you learned how to elevate Nmap from a standard port scanner to an active vulnerability assessment tool. You started by updating the Nmap Scripting Engine database to ensure you had the latest scripts available. You then utilized the vuln category to automatically probe discovered services for known vulnerabilities. Furthermore, you practiced targeting specific services like HTTP and SMB with individual scripts to conduct focused audits. Finally, you learned how to save your scan results to a file and parse them using command-line tools for efficient analysis.
These skills form a strong foundation for network security auditing and vulnerability management.
