Introduction to Nmap Scripting Engine (NSE)
Before we dive into HTTP-specific scripts, let’s briefly touch on Nmap’s
scripting engine. The Nmap Scripting Engine is a powerful tool that
allows you to write and execute scripts in Lua (the scripting language
used by Nmap). These scripts extend Nmap’s capabilities, making it
more than just a basic network scanner. With NSE, you can perform
complex network tasks like vulnerability scanning, brute-forcing, and
information gathering.
The scripts in Nmap are categorized into different groups, such as
discovery, vuln, auth, safe, and http. The http category is specifically
designed to deal with tasks related to HTTP services running on target
machines.
Understanding HTTP Scripts in Nmap
The HTTP category in Nmap contains scripts specifically designed for
interacting with web services. These scripts can be used for discovering
sensitive information, identifying vulnerabilities, and even exploiting
weaknesses in web servers and web applications. HTTP scripts work by
interacting with the HTTP protocol, which is the foundation of
communication between web clients (browsers) and web servers.
Some important HTTP-related Nmap scripts include those for detecting
security misconfigurations, identifying server software, performing
brute-force attacks, and even testing for vulnerabilities like SQL
injection or cross-site scripting (XSS).
Key HTTP Scripts in Nmap
Let’s now explore some of the most important HTTP scripts in Nmap,
organized by their functionality.
1. HTTP Methods ([Link])
What it does: This script checks which HTTP methods (like GET, POST,
PUT, DELETE, etc.) are supported by a web server. Some HTTP methods,
such as PUT and DELETE, can allow attackers to upload or delete files
on the server, posing serious security risks.
How and when to use it: This script is useful when you need to check
for risky methods enabled on a web server. For example, PUT and
DELETE methods can allow unauthorized file uploads or deletions. It’s
crucial to run this script during initial reconnaissance to identify
potential attack vectors.
bash
CopyEdit
nmap --script http-methods -p 80,443 <target>
This command will scan ports 80 and 443 (default HTTP and HTTPS
ports) to see which methods are supported by the web server.
2. HTTP Server Detection ([Link])
What it does: This script attempts to retrieve the Server HTTP header
from a web server. The Server header reveals information about the web
server software, such as Apache, Nginx, or IIS. This information can help
an attacker target known vulnerabilities in specific server versions.
How and when to use it: It’s important to run this script during the
reconnaissance phase to gather information about the target system.
Knowing the server software can help you identify specific
vulnerabilities and attack strategies.
bash
CopyEdit
nmap --script http-server-header -p 80,443 <target>
This script is especially useful when you're performing a vulnerability
assessment on a web application.
3. HTTP Enumeration ([Link])
What it does: This script attempts to identify various directories and
files on a web server. It uses a database of common directory and
filename patterns to identify possible resources like admin pages, login
forms, and configuration files.
How and when to use it: Use this script when performing a web
application audit. It’s a great tool for enumerating hidden directories or
files that could contain sensitive information, like backups or
administrative interfaces.
bash
CopyEdit
nmap --script http-enum -p 80 <target>
This script can help uncover paths that would otherwise be difficult to
discover manually.
4. HTTP Vulnerability Scanning ([Link])
What it does: This script checks for a known vulnerability in Drupal
(CVE-2014-3704), which allows an attacker to execute arbitrary PHP
code via crafted requests. It’s a specialized script to target a particular
vulnerability in specific web applications.
How and when to use it: Use this script when scanning a known version
of a web application that is vulnerable to a specific CVE. For example, if
you know the target uses an outdated version of Drupal, this script can
be used to exploit it.
bash
CopyEdit
nmap --script http-vuln-cve2014-3704 -p 80 <target>
While it targets a specific CVE, this script can be a useful tool for testing
web application security and identifying known vulnerabilities.
5. HTTP Title Grab ([Link])
What it does: This script retrieves the title of a web page (the <title> tag
in HTML) from a web server. The title can provide valuable information
about the web application, such as its name, version, or purpose.
How and when to use it: This script is commonly used during the initial
reconnaissance phase. Knowing the title can give clues about the web
application and may help with further enumeration or targeted attacks.
bash
CopyEdit
nmap --script http-title -p 80 <target>
The title could also provide hints about an outdated or poorly secured
web application.
6. HTTP Authentication Brute Force ([Link])
What it does: This script attempts to brute-force HTTP authentication
mechanisms, such as basic HTTP authentication or digest
authentication, using a list of usernames and passwords.
How and when to use it: This script is useful when you suspect that a
web service uses weak authentication or default credentials. It can be
used to perform a brute-force attack against login pages or
administrative portals.
bash
CopyEdit
nmap --script http-brute -p 80 <target>
Only use this script with permission, as brute-forcing can lock out
legitimate users and cause disruptions.
7. HTTP SSL/TLS Certificate Check ([Link])
What it does: This script checks the SSL/TLS certificate used by an
HTTPS web server. It reports the certificate’s validity, expiration date,
and other related information. It can also identify weak ciphers or
protocols that are insecure.
How and when to use it: It’s essential to use this script when auditing
HTTPS services, especially for ensuring the validity of certificates and
checking for misconfigurations like weak ciphers.
bash
CopyEdit
nmap --script http-ssl-cert -p 443 <target>
This script helps identify security flaws in SSL/TLS setups and can help
you avoid attacks like man-in-the-middle (MITM).
8. HTTP Content-Type Detection ([Link])
What it does: This script detects the content type of web responses. It
analyzes HTTP headers and responses to identify the content type (like
text/html, application/json, etc.).
How and when to use it: This script can be helpful when trying to
identify how a server handles different types of content. It’s also useful
for discovering potential misconfigurations that could be exploited by
an attacker.
bash
CopyEdit
nmap --script http-content-type -p 80 <target>
Content-type misconfigurations could lead to vulnerabilities like cross-
site scripting (XSS) or information leakage.
Conclusion
The HTTP category of Nmap scripts provides powerful tools for
assessing the security of web applications and servers. Understanding
how to apply these scripts effectively can help you discover
vulnerabilities, misconfigurations, and weaknesses in web services that
could be exploited by attackers.
By using these scripts, you can perform detailed reconnaissance,
identify potential attack vectors, and secure your web applications
more effectively. Whether you're performing an initial security audit or
testing for specific vulnerabilities, Nmap's HTTP scripts are
indispensable in the arsenal of any cybersecurity professional.
As with all powerful tools, these scripts should only be used in
environments where you have permission to test, as unauthorized use
can have legal and ethical consequences. Always obtain explicit consent
before performing penetration testing or vulnerability scanning on a
network or web application.