Nmap scripting
● Nmap scripting used to create the scripts that automates network scanning,
enumeration and some vulnerability analysis.
● Vulnerability analysis like heart bleed vulnerability→ [Link] scripts that
detect heart bleed vulnerability on web servers.
● Nmap help
● ls -l /usr/share/nmap/scripts → script location
● Now we are going to scan the router using nmap script.
● Now we are going to search the specific script.
● ls -l /usr/share/nmap/scripts |grep ssh
● From the displayed iam going to use ssh-keyhost
● nmap --script=[Link] [Link]
● It will show some keys but they are not really important.
● It will also show some of the open ports.
● For searching with specific port for opened telnet port
● ls -l usr/share/nmap/scripts |grep telnet
● now we are going to run all the scripts for specific target
● nmap -sC [Link] or
● nmap –script=default [Link]
● to run the safe scripts that are categorized
● nmap –script “default or safe” [Link]
● if we found http title it will shows an what web page is running.
● To view the script of nmap scripts, use thes command.
● It will show the scripts in scripting language.
● Nano /usr/share/nmap/scripts/[Link]
● now we are going to run the specific script against the target
● nmap –script=[Link] [Link]
●
● Iwriting an nmap script
● · Description=[[ will connect to a UDP server and determine if there is
anything there. If so, it will indicate that something is there. ]]
●
● Category = {“exploit”, “vulns”}
●
● Local stdnse = require “stdnse”
● Local io = require “io”
● Local shortport = require “shortport”
●
● Portrule = [Link](9876, “udp”, {“open” , “open|filtered”, “filtered”})
● Send_udp_payload = function(ip, timeout, payload)
●
● Local data
● Stdnse.print_debug(2, “%3:Sending UDP payload”, SCRIPT
Nmap for PT
nmap [Link]/24 -sn (Disable port scanning. Host discovery only.)
Portnumbers
🔹 FTP (File Transfer Protocol)
● Port 21 — FTP control/command channel (TCP)
● Port 20 — FTP data channel (TCP, active mode)
🔹 SSH (Secure Shell)
● Port 22 — Default SSH port (TCP)
RDP (Remote Desktop Protocol) port number is 3389 (TCP).
✅ 1. Simple scan for RDP (port 3389)
nmap -p 3389 [Link]/24
Scans your entire subnet for hosts with RDP open.
✅ 2. Scan + service detection
nmap -sV -p 3389 [Link]/24
Shows service version (useful for OS/Windows edition detection).
✅ 3. Aggressive scan (OS detection + scripts)
nmap -A -p 3389 [Link]/24
Runs OS detection, traceroute, and common scripts.
✅ 4. Nmap script scan for RDP enumeration
nmap --script rdp* -p 3389 [Link]/24
Uses all RDP-related NSE scripts.
✅ 5. Fast scan for large networks
nmap -T4 -p3389 [Link]/16
Commonly Targeted Ports by Attackers
(for Scanning & Abuse)
🔹 1. RDP – Remote Desktop Protocol
● Port: 3389/TCP
● Why targeted:
○ Weak passwords
○ Exposed Windows login
○ High ransomware entry point
🔹 2. SSH – Secure Shell
● Port: 22/TCP
● Why targeted:
○ Password brute force
○ Misconfigured keys
○ Default/root login enabled
🔹 3. FTP – File Transfer Protocol
● Ports: 21 (control), 20 (data)
● Why targeted:
○ Often plain-text credentials
○ Anonymous login enabled
○ Old service versions
🔹 4. SMB – Windows File Sharing
● Ports: 445, 139
● Why targeted:
○ EternalBlue-like vulnerabilities
○ Poorly secured file shares
○ Lateral movement in networks
🔹 5. Telnet
● Port: 23
● Why targeted:
○ Plain-text credentials
○ Legacy devices still run it
○ IoT bots exploit default creds
🔹 6. HTTP / HTTPS
● Ports: 80, 443
● Why targeted:
○ Web vulnerabilities (LFI/RFI/XSS/SQLi)
○ Outdated CMS / admin panels exposed
🔹 7. MySQL
● Port: 3306
● Why targeted:
○ Weak DB passwords
○ Default configuration exposed externally
🔹 8. MSSQL
● Port: 1433
● Why targeted:
○ Credential attacks
○ Misconfiguration
🔹 9. PostgreSQL
● Port: 5432
● Why targeted:
○ Credential brute forcing
○ Default configs
🔹 10. VNC
● Ports: 5900–5905
● Why targeted:
○ Weak authentication
○ Remote desktop access to servers
🔹 11. LDAP / Active Directory
● Ports:
○ 389 (LDAP)
○ 636 (LDAPS)
● Why targeted:
○ Credential spraying
○ AD enumeration
🔹 12. SNMP
● Ports: 161, 162
● Why targeted:
○ Default community strings (“public”, “private”)
○ Network device enumeration
nmap [Link] -p 21-100 Port range
-p-655 nmap [Link] Leaving off initial port in range makes the scan
35 -p-65535 start at port 1
nmap -p- [Link]
This is the most complete scan.