How To Use Nmap for Vulnerability Scanning

Being a hacker isn't just about navigating complex systems; it's about finding the weak spots before anyone else does. And what better way to do that than with the trusty Nmap vulnerability scan?

Originally a straightforward network scanning command line tool, Nmap has evolved into a superhero of sorts, thanks to its Nmap Scripting Engine (NSE). Now, it's not just about scanning networks; it's about pinpointing vulnerabilities and staying one step ahead.

Vulnerability scanning is like the superhero cape in the world of penetration testing, and Nmap is the tool many of us swear by. It's like the Swiss Army knife of hacking – lightweight, versatile, and, best of all, completely free. So, grab your virtual toolkit because in this article, we're diving into the world of Nmap and discovering how it can uncover those sneaky weaknesses on target machines.

Ready to unleash the power of Nmap? Let's jump in and explore its full potential!

Scanning Fundamentals

Nmap, the superhero of network scanning tools, is your go-to for uncovering open ports and services on devices hooked up to a network. It's not just powerful; it's free, open-source, and a favorite among penetration testers, conveniently pre-installed on Kali Linux.

Executing an Nmap scan is as easy as typing nmap <target> into the command line. This default scan queries the top 1000 ports to figure out which ones are open. The results? A treasure trove of information:

• Witness the Nmap command unfold: nmap 10.0.10.5.
• Chronological imprints of your scan's timeline.
• A snapshot of network latency in the pursuit of connecting to the target.
• A detailed dossier enumerating the exposed ports.
• A chronicle of the time elapsed in completing the scan.

While our illustrative scenario involves a solitary host, Nmap's versatility shines through when confronting singular entities, conglomerates of hosts, or expansive subnets. Flexibility is indeed Nmap's hallmark.

Elevating the scanning experience involves donning the hat of a maestro, manipulating the symphony of options—aptly named flags:

nmap <flags> <target>

This seemingly simple syntax conceals a spectrum of possibilities. For instance, introducing the -sV flag metamorphoses the scan into a service discovery expedition, unveiling the specifics of network services tethered to each open port—a crucial orchestration in the symphony of enumeration.

Beyond the surface, the connoisseur of Nmap delves into nuanced options:

• Crafting a dance of speed and aggression with timing templates -T1 to -T4.
• Executing a covert operation by eluding ICMP echo pings through the -Pn option.
• Extricating oneself from the labyrinth of DNS name resolution with the -n option.
• Embracing the audacious by scanning the entire port spectrum via the -p- option.

Nmap, a virtuoso in its own right, transcends the confines of a single act. It unfolds as a multifaceted spectacle, offering an array of scans and options. For those seeking mastery, an expedition awaits in our comprehensive guide: A Complete Guide to Nmap – Nmap Tutorial. It's not just a guide; it's a roadmap to ascendancy in the realm of Nmap wizardry. Step into the world where scans become symphonies and options, the notes of a digital sonata.

Nmap Vulnerability Scanning

While Nmap has long been hailed as a stalwart in the realm of network scans, its prowess extends far beyond mere exploration. With the Nmap Scripting Engine (NSE) at its core, Nmap transforms into a dynamic vulnerability scanner, ready to unveil the weaknesses lurking within network-connected systems.

The NSE is the secret sauce that elevates Nmap's capabilities. It empowers users to craft and execute custom scripts, effectively expanding the utility of Nmap beyond conventional boundaries. This metamorphosis from a basic network scanner to a comprehensive vulnerability assessment tool is made possible through three commanding Nmap scripting options:

Using vulners

The --script vuln option emerges as a catalyst, executing NSE scripts tailored to pinpoint vulnerabilities in the target system. This option serves as a straightforward pathway to uncovering well-known vulnerabilities with ease.

Installation

To install the Nmap-vulners script, navigate to the Nmap scripts directory using the following command.

cd /usr/share/nmap/scripts/

Next, unfurl the magic by cloning the git repository:

git clone https://github.com/vulnersCom/nmap-vulners.git

A symphony of scripts will gracefully install themselves – no further configuration required. To peek behind the scenes, wield the power of the ls command, revealing the NSE scripts within the Nmap-vulners database.

Usage Symphony

Executing Nmap-vulners is an art, choreographed with simplicity. Embed the NSE script into your Nmap command with the -script argument:

nmap -sV --script vulners [--script-args mincvss=<arg_val>] <target>

The "-sV" parameter is non-negotiable. It opens the gateway for Nmap-vulners to tap into the Vulners exploit database. Without version information, the magic remains dormant.

Command Examples

Witness the syntax unfold in a command ballet. Invoke the script with the --script option, introducing the vulners engine to the stage:

nmap -sV --script nmap-vulners/ <target>

For a more nuanced performance, if specific ports beckon exploration, append the -p option and specify the ports of interest:

nmap -sV --script nmap-vulners/ <target> -p80,223

Using Vuln

Nmap's vuln scan performs a comprehensive assessment by deploying the tool's default vulnerability scanning scripts against a target. These scripts serve as an invaluable resource for uncovering common vulnerabilities that might present opportunities for exploitation.To run a vuln scan, use the following syntax:

sudo nmap --script vuln <target domain or IP Address> -v

Note the regality of "sudo" in Linux, granting the command the throne of superuser privileges. The -v flag, a virtuoso in verbosity, unravels a tapestry of information about the tests conducted and their consequential revelations.

The Dance of Wildcards

For a dance of simultaneous scripts, introduce wildcards (*) into the choreography. For instance, appending a wildcard after the http command (http*) swirls all vulnerability scans beginning with "http" towards the targeted domain.

The Balancing Act: CVSS Scores

Navigating the balance between information overload and precision, exclude vulnerabilities below a certain CVSS score. Employ the --script-args flag, setting the CVSS threshold (e.g., 6.5):

nmap --script vuln --script-args mincvss=6.5 <target>

The command ensures that only vulnerabilities with a CVSS score of 6.5 or higher take center stage in the results.

The Exported Sonata

Capture the symphony's essence by exporting results in various file formats. Two common crescendos are:

• XML File: nmap --script vuln -oX file.xml <target>
• Browser-Friendly XML File: nmap --script vuln --webxml -oX file.xml <target>

These exported files not only facilitate sharing but also seamlessly integrate vulnerabilities into other software compositions.

The Quest for Mastery: Custom Scripts

For those traversing the realm of advanced vulnerability scans, the basic repertoire might seem limiting. Fear not, for advanced users can augment their arsenal with custom scripts such as Vulscan or Vulners. These scripts open gates to a larger database of vulnerabilities, enhancing the depth and breadth of the scanning odyssey.

As you conduct this symphony of vulnerability exploration, remember the dual nature of these scans—informative yet potentially disruptive. Nmap's prowess unveils vulnerabilities, but wield with caution, for some scans delve beyond information, attempting to verify vulnerabilities through exploitation. In the quest for network fortification, may your scans be thorough, your findings insightful, and your systems resilient.

Using Vulscan 

Select an Image

Enter Vulscan – the virtuoso NSE script that metamorphoses Nmap into a full-fledged vulnerability scanner. Think of it as a transformative module, augmenting Nmap's capabilities by leveraging services and version detections to detect vulnerabilities on targeted systems.

The Nmap -sV Ballet

Nmap's -sV option, akin to a finely-tuned instrument, facilitates per-service version detection. This allows for the identification of potential exploits for detected vulnerabilities within the system.

Databases at Your Fingertips

Vulscan seamlessly integrates with pre-installed databases, including exploitdb, osvdb, securitytracker, openvas, scipvuldb, xforce, securityfocus, and cve. This wealth of information forms the backbone of comprehensive vulnerability assessments.

The Installation Prelude

To weave Vulscan into the tapestry of Nmap scripts, perform a ritual in the Nmap scripts directory:

cd /usr/share/nmap/scripts/

The next step involves cloning the git repository and ushering in the requirements:

git clone https://github.com/scipag/vulscan.git ln -s `pwd`/scipag_vulscan /usr/share/nmap/scripts/vulscan

To breathe life into the databases, navigate to the updater directory, tweak permissions, and orchestrate the update:

cd vulscan/utilities/updater/ chmod +x updateFiles.sh ./updateFiles.sh

The Symphony of Usage

Now, let the symphony commence. Utilize Vulscan in a Nmap vulnerability scan much like its counterpart, nmap-vulners:

nmap -sV --script vulscan <target>

By default, Vulscan eagerly explores all databases simultaneously. Yet, the quest for efficiency allows you to channel its energy by specifying a single CVE database using the --script-args vulscandb=database_name parameter.

The Command Crescendo

Witness the command unfold in an example of nuanced vulnerability exploration:

nmap -sV --script vulscan --script-args vulscandb=exploitdb.csv <target> -p 80,233

As Nmap, now adorned with the Vulscan script, dances across your targets, vulnerabilities unfold like notes in a symphony. The databases provide a rich backdrop, and the ability to tailor your queries adds finesse to your vulnerability scanning repertoire. May your scans be thorough, your insights profound, and your networks fortified in the wake of this harmonious exploration.

Targeted Vulnerability Scanning

In the realm of vulnerability scanning, precision is key. Nmap, armed with a vast array of NSE scripts, allows for meticulous individual vulnerability scans, each script a specialized instrument in the orchestration of network security.

Cross-Site Request Forgery (CSRF) Check

To uncover CSRF vulnerabilities, employ the http-csrf script:

nmap -sV --script http-csrf <target>

Shellshock Vulnerability Exploitation

Navigate the landscape of web application vulnerabilities with the http-sherlock script:

nmap -sV --script http-sherlock <target>

Slowloris DoS Attack Vulnerability Assessment

Check a web server's susceptibility to Slowloris DoS attacks with the http-slowloris-check script:

nmap -sV --script http-slowloris-check <target>

VMware Path Traversal Vulnerability Probe

Probe VMware servers for path-traversal vulnerabilities using the http-vmware-path-vuln script:

nmap -sV --script http-vmware-path-vuln <target>

Directory Traversal Vulnerability Test

Check for directory traversal vulnerabilities by attempting to retrieve sensitive files with the http-passwd script:

nmap -sV --script http-passwd <target>

Internal IP Address Disclosure Check

Determine if a web server leaks its internal IP address with the http-internal-ip-disclosure script:

nmap -sV --script http-internal-ip-disclosure <target>

Ruby on Rails Server Vulnerability Detection

Identify Ruby on Rails servers vulnerable to DOS attacks and command injection using the http-vuln-cve2013-0156 script:

nmap -sV --script http-vuln-cve2013-0156 <target-address>

In the realm of vulnerability scripts, each command is a targeted strike, revealing potential weaknesses in the digital fortress. These examples merely scratch the surface, showcasing the versatility of Nmap's NSE scripts in fortifying your network against potential threats. As you navigate the vast selection of scripts, may your scans be thorough, your defenses fortified, and your systems resilient against the ever-evolving landscape of cybersecurity challenges. 

Discover Now: Building a vulnerability scanner using python

Vuln vs Vulners vs Vulscan

Here's a comparison of vuln, vulners, and vulscan Nmap scripts in a table format:

Feature	vuln Script	vulners Script	vulscan Script
Vulnerability Detection	Detects vulnerabilities based on Nmap's version detection and service version information.	Utilizes data from the Vulners.com vulnerability database to identify vulnerabilities.	Provides a comprehensive vulnerability scanning using its own vulnerability database.
Database	Relies on Nmap's internal vulnerability database.	Utilizes Vulners.com vulnerability database.	Utilizes its own vulnerability database.
Coverage	Limited to the vulnerabilities in Nmap's database.	Extensive coverage as Vulners.com database is constantly updated.	Extensive coverage as it uses its own updated vulnerability database.
Customization	Limited customization options compared to Vulners and Vulscan.	Offers some customization options such as specifying CVE IDs, ports, etc.	Offers extensive customization options such as specifying CVE IDs, CVSS score ranges, port ranges, etc.
Ease of Use	Straightforward usage within Nmap.	Requires an API key from Vulners.com but integration with Nmap is straightforward.	Requires downloading and configuring the Vulscan script but provides comprehensive scanning capabilities.
Frequency of Updates	Updates depend on Nmap releases.	Updates are frequent as Vulners.com database is regularly updated.	Updates depend on the maintenance of the Vulscan script.
Extensibility	Limited extensibility as it relies on Nmap's internal database.	Moderate extensibility through Vulners.com API integration.	High extensibility as users can update the Vulscan database independently.

These scripts serve different purposes and offer varying levels of coverage and flexibility in vulnerability scanning within Nmap. Depending on your specific needs and constraints, you may choose one over the other.

How Do Attackers Use Nmap?

Attackers can leverage Nmap for a variety of purposes during the reconnaissance phase of a cyber attack. While Nmap itself is a legitimate and powerful network scanning tool used for security assessments, penetration testing, and system administration, malicious actors may exploit its capabilities for unauthorized and harmful activities. Here are some ways attackers might use Nmap:

1. Network Discovery: Attackers use Nmap to discover hosts and devices on a network. By scanning for live hosts and open ports, they can create a map of the network's topology.
2. Port Scanning: Nmap can be used to scan for open ports on target systems. Knowing which ports are open helps attackers identify potential entry points and services that may be vulnerable to exploitation.
3. Service Version Detection: Nmap can detect the version of services running on open ports. Attackers use this information to identify specific software and its version, allowing them to target known vulnerabilities associated with that software.
4. Operating System Fingerprinting: Nmap can attempt to identify the operating system running on a target host based on various characteristics. Attackers use this information to tailor their attacks for specific operating systems.
5. Vulnerability Scanning: By using Nmap scripts or additional tools in combination with Nmap, attackers can perform vulnerability scans to identify weaknesses in target systems. This information is valuable for planning targeted exploits.
6. Firewall Evasion: Attackers may use Nmap to identify open ports and services that might be accessible through firewalls. They can then craft their attacks to exploit these open entry points.
7. Stealth Scanning: Malicious actors can configure Nmap to conduct stealthy or low-profile scans to avoid detection by intrusion detection/prevention systems and firewall logs.
8. Scripting Engine Exploitation: Nmap's NSE (Nmap Scripting Engine) allows the execution of custom scripts. Attackers may use NSE scripts to perform more sophisticated and targeted attacks against specific vulnerabilities.
9. Information Gathering: Beyond technical details, attackers use Nmap to gather information about the network's structure, naming conventions, and potential targets for further attacks.

It's important to note that while Nmap can be misused for malicious activities, it is also a valuable tool for defenders to assess and strengthen the security of their networks. Organizations should implement robust security measures, monitor network traffic, and regularly conduct vulnerability assessments to mitigate the risks associated with Nmap and similar tools.

Is your system capable of detecting Nmap scans?

I don't have real-time capabilities, and I don't have access to external systems, networks, or data. My purpose is to provide information and answer questions to the best of my knowledge and abilities. I don't have the ability to actively detect or monitor activities, including Nmap scans, in real-time.

Detection of Nmap scans typically involves using intrusion detection systems (IDS), firewalls, or log analysis tools on the network being scanned. These systems can raise alerts or log entries based on patterns of network traffic that match known characteristics of Nmap scans. Additionally, network administrators may configure security measures to detect and respond to scanning activities.

If you are concerned about Nmap scans or any other security-related issues on your network, it is recommended to consult with your IT security team, use appropriate security tools, and follow best practices for securing your systems and infrastructure.

Summary

Nmap, or Network Mapper, is a powerful open-source network scanning tool widely used for network exploration and security assessments. It helps users discover hosts, open ports, and services on a network.

Nmap's Role in Security:Nmap is often employed for legitimate security purposes, such as network mapping, vulnerability assessments, and penetration testing. Its versatility and extensive feature set make it a valuable tool for both defenders and security professionals.

Capabilities:

1. Scanning Fundamentals: Nmap can perform basic network scans to discover open ports and services.
2. Nmap Scripting Engine (NSE): The NSE allows the creation and execution of custom scripts, extending Nmap's functionality for advanced tasks like vulnerability scanning.
3. Vulnerability Scanning Options: Nmap offers various options for vulnerability scanning, including its default "vuln" scripts, the use of online databases like Vulners, and integration with scripts like Vulscan.

Vulnerability Scanning Tools:

1. Vuln: Executes NSE scripts to identify vulnerabilities locally.
2. Vulners: Utilizes the vulners.com online database for up-to-date vulnerability information.
3. Vulscan: Transforms Nmap into a comprehensive vulnerability scanner, using various offline databases.

Individual Vulnerability Scanning: Nmap provides the ability to perform targeted scans for specific vulnerabilities using individual scripts. Examples include CSRF detection, Shellshock exploitation, and checks for Slowloris DoS vulnerabilities.

Security Concerns: While Nmap is a legitimate tool, it can be misused by attackers for unauthorized activities such as network reconnaissance, port scanning, and vulnerability assessments. Security measures, including intrusion detection systems, firewalls, and log analysis, are essential to mitigate risks associated with malicious use of Nmap.

Best Practices:

1. Use Nmap responsibly for legitimate security purposes.
2. Employ security measures to detect and respond to unauthorized Nmap scans.
3. Keep software and systems up-to-date to address vulnerabilities that may be identified during scanning.

Nmap is a valuable tool for network administrators and security professionals when used ethically. It plays a crucial role in network security by identifying potential vulnerabilities and weaknesses, aiding in proactive defense strategies.