Hack Like a Pro: Using the Nmap Scripting Engine (NSE) for Reconnaissance « Null Byte :: WonderHowTo

Welcome back, my tenderfoot hackers!Those of you who have been reading my posts here for awhile know how much I emphasizegood reconnaissance. Novice hackers often jump into a hack/exploit without doing proper recon and either fail or get caught. Experienced and expert hackers know that 70-80 percent of a good and successful hack is dependent upon successful and accurate reconnaissance.I know I have said it before, but bear with me as I say it again for the newcomers. There is NO SILVER BULLET that succeeds under all circumstances. Long before we ever begin the hack, we have spent hours, days, and maybe months doing reconnaissance. If you aren't willing to do that, you will never be successful in this field of endeavor.Nmap is one of the few tools that every hacker should be conversant in. Although it is not perfect, it is excellent foractive reconnaissance. AlthoughI discourage the use of Windows for hacking, Nmap does have a version for Windows with a nice GUI calledZenmap. You can download ithere.Nmap Scripting Engine (NSE)I have donea coupleof tutorialson using Nmap, but one thing I have not covered is the scripting engine built into it.The Nmap scripting engine is one of Nmap's most powerful and, at the same time, most flexible features. It allows users to write their own scripts and share these scripts with other users for the purposes of networking, reconnaissance, etc. These scripts can be used for:Network discoveryMore sophisticated and accurate OS version detectionVulnerability detectionBackdoor detectionVulnerability exploitationIn this tutorial, we will look at the scripts that have been shared and are built intoKali(we will write scripts in a future tutorial), and will examine how to use them to do thorough recon on our target, to increase the possibility of success, and reduce the possibilities of frustration... or worse.Step 1: Fire Up Kali & Open a TerminalAs usual, let's start by firing up Kali and opening a terminal. If you aren't using Kali, but instead one of the many hacking/security distributions suchBuqtraq's Black Window,Security Onion,BackTrack, or another, no problem—Nmap is built into ALL of them. You can't really have a security/hacking platform without Nmap.Step 2: Find the Nmap ScriptsFrom the terminal, let's look for the Nmap scripts. All of the scripts should end in.nse(nmap scripting engine), so we can find the scripts by using the Linux locate command with the wildcard*.nse. That should find all files ending in.nse.kali > locate *.nseAs you can see in the screenshot above, our terminal displays hundreds of Nmap scripts.Step 3: Finding Vulnerability Scanning ScriptsAmong the most useful to us are the vulnerability scanning scripts. These scripts are usually designed to find a specific vulnerability or type of vulnerability that we can then come back later and exploit. To locate those scripts that we can use for vulnerability scanning, we can type:kali> locate *vuln*.nseAs you can see, it returned a few vulnerability scanning scripts. I have highlighted one I want to use next, namelysmb-check-vulns.nse. This script will check the system to see whether it has any of the well-known SMB vulnerabilities such asMS08-067.Step 4: Running the ScriptThe basic syntax for running these scripts is this:nmap --script <scriptname> <host ip>Let's try running the SMB vulnerability checking script against an internal LAN host.kali> nmap --script smb-check-vulns-nse 192.168.1.121When we do so, we can see that it returns some errors and suggests that we add--script-args=unsafe=1to our command. I did so below and, in this case, added-p445so that the script focuses upon just the SMB port 445.kali> nmap --script-args=unsafe=1 --script smb-check-vulns.nse -p445 192.168.1.121Now, when I run the command, I get much more useful results.As you can see, it tells me that MS08-067 is vulnerable, so now I know I can use that module inMetasploitto exploit that system!Step 5: Getting Help with a ScriptWith these hundreds of scripts, we may need some help in determining what they do and how they work. For instance, if we scroll down to the "http" section of the scripts, we will see a script named:http-vuln-cve2013-0156.nseTo determine what this script does, we can retrieve its help file by typing:nmap -script-help http-vuln-cve2013-0156.nseWhen we do so, we will retrieve its help file like that below.Note that this script is designed to find the CVE2013-0156 vulnerability, which is a vulnerability in Ruby on Rails. Ruby on Rails is very popular open-source web design framework that is behind millions of database driven web apps, so this vulnerability is likely to still be out there in thousands of websites. Happy hunting!The Nmap scripting engine is a powerful item in our arsenal of hacking tools that can be tailored to a multitude of tasks. In future posts, I will explore more of its capabilities and show you how to write your own Nmap scripts. So keep coming back, my tenderfoot hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Easily Detect CVEs with Nmap ScriptsHow To:Get Started Writing Your Own NSE Scripts for NmapAdvanced Nmap:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowHow To:Enumerate NetBIOS Shares with NBTScan & Nmap Scripting EngineHack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Conduct Active Reconnaissance and DOS Attacks with NmapHack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesHow To:Perform Network-Based Attacks with an SBC ImplantHow To:Tactical Nmap for Beginner Network ReconnaissanceHack Like a Pro:Scripting for the Aspiring Hacker, Part 2 (Conditional Statements)How To:Use NMAP 7 to Discover Vulnerabilities, Launch DoS Attacks and More!Hack Like a Pro:Python Scripting for the Aspiring Hacker, Part 1Hack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)Don't Be a Script-Kiddie part2:Building an Auto-Exploiter Bash ScriptHack Like a Pro:Advanced Nmap for ReconnaissanceHack Like a Pro:How to Conduct OS Fingerprinting with Xprobe2How to Hack Databases:Hunting for Microsoft's SQL ServerHow To:Advanced Penetration Testing - Part 1 (Introduction)How To:Identify Web Application Firewalls with Wafw00f & NmapDissecting Nmap:Part 1Hack Like a Pro:Reconnaissance with Recon-Ng, Part 1 (Getting Started)Hack Like a Pro:Scripting for the Aspiring Hacker, Part 1 (BASH Basics)How To:Automate Brute-Force Attacks for Nmap ScansHack Like a Pro:How to Scan the Globe for Vulnerable Ports & ServicesVideo:How to Use Maltego to Research & Mine Data Like an AnalystNews:Banks Around the World Hit with Repeated DDoS Attacks!Hacking macOS:How to Spread Trojans & Pivot to Other Mac ComputersHack Like a Pro:Perl Scripting for the Aspiring Hacker, Part 2 (Building a Port Scanner)Hack Like a Pro:Getting Started with BackTrack, Your New Hacking SystemHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesHacking Reconnaissance:Finding Vulnerabilities in Your Target Using NmapHow To:Use the Nmap security toolHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItHow To:Cheat Engine for FarmVille - The Definitive GuideWATCH THIS INSTEAD:No Strings AttachedHow To:A Gamer's Guide to Video Game Software, Part 1: Unity 3D