Nmap Scripting Engine (NSE) for Enumeration on Kali Linux

Tested on Kali GNU/Linux Rolling 2026.2 (kali-rolling)
Package nmap 7.99+dfsg-1kali1
Lab environment Pentest lab
Cert prep CompTIA PenTest+ PT0-003 — Domain 2 (Reconnaissance and Enumeration)
Privilege Normal user for most NSE runs; sudo when you combine scripts with raw SYN or OS detection
Scope NSE categories, script discovery, category and port selection, --script-args, and enumeration scripts for SSH, HTTP, TLS, FTP, and SMB on authorized lab targets. DNS NSE scripts are summarized with a pointer to the dedicated DNS enumeration lesson. Does not cover exploit or vuln script categories, brute-force scripts, or post-enumeration exploitation.
Short on time?Beta Get the gist of this 18-minute read in seconds, then ask follow-up questions

After you find open ports with network reconnaissance using Nmap, the Nmap Scripting Engine (NSE) automates the next layer of service questions:

  • SSH algorithm lists and host keys
  • HTTP page titles and response headers
  • TLS certificate subjects and SANs
  • Anonymous FTP policy
  • SMB dialect and protocol support

You pick scripts by category, pass custom arguments when a script supports them, and save output for reporting.

Lab runs use Metasploitable 2 as $TARGET from the pentest lab setup. Internet demos use scanme.nmap.org for SSH and HTTP, and nmap.org for TLS certificate samples when scanme.nmap.org port 443 does not complete a handshake.

IMPORTANT
Run NSE only on hosts and networks covered by your engagement authorization. Scripts in the safe and discovery categories still send active traffic. Confirm scope and logging rules in your penetration testing rules of engagement before you aim scripts at client or third-party addresses.

NSE enumeration quick start on Kali

This quick start walks through three steps on an authorized public host before you touch your lab VM:

  • Confirm Nmap and NSE are installed on Kali
  • Set SCAN_HOST to scanme.nmap.org (Nmap's official practice target)
  • Run one script (banner) on port 22 and read the |_banner: line in the output

For Metasploitable-only scripts later in this guide, export the lab target once per shell (re-run in a new terminal):

bash
export TARGET=192.168.56.127
export SCAN_HOST=scanme.nmap.org
# Proxmox Group 2 lab: export TARGET=10.10.10.30

Check the Nmap build first:

bash
nmap --version
output
Nmap version 7.99 ( https://nmap.org )
Platform: x86_64-pc-linux-gnu
Compiled with: liblua-5.4.8 openssl-3.6.3 libssh2-1.11.1 libz-1.3.1 libpcre2-10.46 libpcap-1.10.6 nmap-libdnet-1.18.0 ipv6

The version line confirms NSE is bundled with this Nmap package. Export the practice hostname once per shell so later commands stay short:

bash
export SCAN_HOST=scanme.nmap.org

scanme.nmap.org is maintained for light scanning practice. Keep volume low and skip exploit scripts there.

Run the banner script against SSH on that host:

bash
nmap -Pn --script=banner -p 22 "$SCAN_HOST"
output
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.24s latency).

PORT   STATE SERVICE
22/tcp open  ssh
|_banner: SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.13

Nmap done: 1 IP address (1 host up) scanned in 1.30 seconds

The |_banner: line is the script result Nmap attaches under the port. That string matches what you would see from manual banner grabbing on the same service.

What is the Nmap Scripting Engine (NSE)?

NSE ships hundreds of Lua scripts under /usr/share/nmap/scripts/. Nmap loads them when you pass --script or -sC (shorthand for --script=default). Each script declares categories in script.db so you can select groups instead of naming every file.

Enumeration workflows usually follow this order:

  • Port scan with Nmap to learn which services listen
  • Version detection with -sV when you need product names before picking scripts
  • Targeted --script runs on the ports and categories your scope allows
  • Export with -oA or -oN when you need evidence for a report

This lesson stays on enumeration categories. Exploit, intrusive, and brute categories can change or crash services and belong only in scopes that explicitly permit them.

NSE categories for enumeration

Nmap groups scripts into categories. For PenTest+ style reconnaissance, these matter most:

Category Enumeration use Caution
default Curated scripts run by -sC Usually low-impact, but some may be intrusive
safe Designed not to crash services; still active Confirm scope; not passive OSINT
discovery Host and service enumeration helpers Can be slow; some scripts broadcast on local subnets
version Internal extensions to -sV Runs automatically with version detection; not selected directly
auth Authentication checks Often out of scope on client tests
brute Credential guessing Requires explicit authorization
intrusive May affect service state Avoid unless scope allows
vuln / exploit Vulnerability checks or exploit attempts Out of scope for this lesson

Boolean expressions narrow which scripts Nmap loads. These are category-selection examples, not safety filters — scripts can belong to multiple categories, and NSE scripts are not sandboxed:

  • --script "default and safe" intersects two categories
  • --script "discovery and safe" limits discovery scripts to the safe subset
  • --script "http-* and not intrusive" matches HTTP scripts that are not tagged intrusive; other tags such as vuln or external may still apply

Do not run the bare discovery category against wide port lists on busy networks without narrowing ports first. Some discovery scripts perform broadcast discovery on the local subnet and can run for a long time.

Lab variables for NSE scans

Set these once per session:

Variable Purpose
TARGET Metasploitable 2 IP on your host-only lab network (exported in the quick-start block)
SCAN_HOST=scanme.nmap.org Authorized public target for SSH and HTTP script demos (needs outbound internet on Kali)
nmap.org Nmap project site for ssl-cert demos when scanme.nmap.org port 443 does not negotiate TLS
DNS_SERVER Metasploitable BIND on port 53 for DNS NSE scripts covered in the DNS enumeration lesson

Export the lab target before Metasploitable-only scripts if you skipped the quick-start block:

bash
export TARGET=192.168.56.127
# Proxmox Group 2 lab: export TARGET=10.10.10.30

Kali and Metasploitable must share the same host-only segment. Confirm with curl -I http://$TARGET/ or nc -w 3 $TARGET 22 before you run NSE — open ports with empty script output usually mean the scan is coming from the wrong network path.

Add -n when you scan the isolated lab by IP so Nmap skips reverse DNS lookups that can hang without a resolver on the host-only segment.

Count how many scripts your package ships when you need a sense of scale:

bash
ls /usr/share/nmap/scripts/*.nse | wc -l
output
612

Kali 7.99 in this lab bundles 612 scripts. Use categories and --script-help to shortlist instead of reading every filename.

Find and preview NSE scripts

--script-help prints the description and categories for one script or a pattern. Preview http-title before you aim it at a web server:

bash
nmap --script-help=http-title
output
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-29 09:31 -0700

http-title
Categories: default discovery safe
https://nmap.org/nsedoc/scripts/http-title.html
  Shows the title of the default page of a web server.

The Categories line tells you the script runs with default and is tagged safe and discovery. The NSedoc URL is the authoritative reference for arguments and behavior.

List scripts that match both discovery and safe when you want a shorter candidate set:

bash
nmap --script-help='discovery and safe' 2>&1 | head -20
output
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-29 09:31 -0700

acarsd-info
Categories: safe discovery
https://nmap.org/nsedoc/scripts/acarsd-info.html

afp-ls
Categories: discovery safe
https://nmap.org/nsedoc/scripts/afp-ls.html
  Attempts to get useful information about files from AFP volumes.

Pipe the full list to less or grep when you need every match. The head output is enough to confirm the boolean filter works.

Run the default script set with version detection

-sC is equivalent to --script=default. Pair it with -sV on known open ports so Nmap fingerprints the service and runs matching default scripts:

bash
nmap -Pn -sV --script=default -p 22,80 "$SCAN_HOST"
output
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.032s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   1024 ac:00:a0:1a:82:ff:cc:55:99:dc:67:2b:34:97:6b:75 (DSA)
|   2048 20:3d:2d:44:62:2a:b0:5a:9d:b5:b3:05:14:c2:a6:b2 (RSA)
|   256 96:02:bb:5e:57:54:1c:4e:45:2f:56:4c:4a:24:b2:57 (ECDSA)
|_  256 33:fa:91:0f:e0:e1:7b:1f:6d:05:a2:b0:f1:54:41:56 (ED25519)
80/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))
|_http-favicon: Nmap Project
|_http-title: Go ahead and ScanMe!
|_http-server-header: Apache/2.4.7 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Nmap done: 1 IP address (1 host up) scanned in 15.24 seconds

Default scripts added SSH host keys, the HTTP title, favicon hint, and server header without naming each script on the command line. Record host keys and titles in your notes; they help confirm you reached the intended host during multi-hop lab setups.

SSH enumeration with NSE

SSH scripts read banners, host keys, and algorithm lists without completing a login. On scanme.nmap.org, pull host keys when you already know port 22 is open:

bash
nmap -Pn --script=ssh-hostkey -p 22 "$SCAN_HOST"
output
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.23s latency).

PORT   STATE SERVICE
22/tcp open  ssh
| ssh-hostkey:
|   1024 ac:00:a0:1a:82:ff:cc:55:99:dc:67:2b:34:97:6b:75 (DSA)
|   2048 20:3d:2d:44:62:2a:b0:5a:9d:b5:b3:05:14:c2:a6:b2 (RSA)
|   256 96:02:bb:5e:57:54:1c:4e:45:2f:56:4c:4a:24:b2:57 (ECDSA)
|_  256 33:fa:91:0f:e0:e1:7b:1f:6d:05:a2:b0:f1:54:41:56 (ED25519)

Nmap done: 1 IP address (1 host up) scanned in 7.04 seconds

Host keys help confirm you reached the intended SSH service. On Metasploitable, ssh2-enum-algos is the richer enumeration script — it lists key exchange, host-key, cipher, MAC, and compression options:

bash
nmap -n -Pn --script=ssh2-enum-algos -p 22 "$TARGET"
output
Nmap scan report for 192.168.56.127
Host is up (0.00090s latency).

PORT   STATE SERVICE
22/tcp open  ssh
| ssh2-enum-algos: 
|   kex_algorithms: (4)
|       diffie-hellman-group-exchange-sha256
|       diffie-hellman-group-exchange-sha1
|       diffie-hellman-group14-sha1
|       diffie-hellman-group1-sha1
|   server_host_key_algorithms: (2)
|       ssh-rsa
|       ssh-dss
|   encryption_algorithms: (13)
|       aes128-cbc
|       3des-cbc
|       blowfish-cbc
|       cast128-cbc
|       arcfour128
|       arcfour256
|       arcfour
|       aes192-cbc
|       aes256-cbc
|       rijndael-cbc@lysator.liu.se
|       aes128-ctr
|       aes192-ctr
|       aes256-ctr
|   mac_algorithms: (7)
|       hmac-md5
|       hmac-sha1
|       umac-64@openssh.com
|       hmac-ripemd160
|       hmac-ripemd160@openssh.com
|       hmac-sha1-96
|       hmac-md5-96
|   compression_algorithms: (2)
|       none
|_      zlib@openssh.com
MAC Address: 08:00:27:33:AF:98 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 0.21 seconds

ssh2-enum-algos is tagged safe and discovery. Legacy entries such as diffie-hellman-group1-sha1, ssh-dss, and arcfour are common hardening findings on lab VMs — record them for reports, not as immediate exploitation steps.

HTTP enumeration with NSE

Web scripts answer page title and header questions before you open a browser. Read the HTML title on port 80:

bash
nmap -Pn --script=http-title -p 80 "$SCAN_HOST"
output
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.0066s latency).

PORT   STATE SERVICE
80/tcp open  http
|_http-title: Go ahead and ScanMe!

Nmap done: 1 IP address (1 host up) scanned in 1.75 seconds

Request response headers with a separate script when titles are generic or missing:

bash
nmap -Pn --script=http-headers -p 80 "$SCAN_HOST"
output
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.0037s latency).

PORT   STATE SERVICE
80/tcp open  http
| http-headers:
|   Date: Sun, 30 Aug 2026 06:33:11 GMT
|   Server: Apache/2.4.7 (Ubuntu)
|   Accept-Ranges: bytes
|   Vary: Accept-Encoding
|   Connection: close
|   Content-Type: text/html
|_
|_  (Request type: HEAD)

Nmap done: 1 IP address (1 host up) scanned in 2.20 seconds

The Server header confirms the Apache build family. http-enum is tagged intrusive, while http-methods is currently default/safe. Always check --script-help because categories differ by script.

On Metasploitable, the same scripts against $TARGET return the lab web root title and Apache build:

bash
nmap -n -Pn --script=http-title,http-headers -p 80 "$TARGET"
output
Nmap scan report for 192.168.56.127
Host is up (0.00070s latency).

PORT   STATE SERVICE
80/tcp open  http
|_http-title: Metasploitable2 - Linux
| http-headers: 
|   Date: Sun, 30 Aug 2026 07:59:44 GMT
|   Server: Apache/2.2.8 (Ubuntu) DAV/2
|   X-Powered-By: PHP/5.2.4-2ubuntu5.10
|   Connection: close
|   Content-Type: text/html
|   
|_  (Request type: HEAD)
MAC Address: 08:00:27:33:AF:98 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 0.26 seconds

TLS certificate enumeration with NSE

HTTPS services expose certificate metadata before you open a browser. The ssl-cert script is tagged default, safe, and discovery. It returns the subject, Subject Alternative Names (SANs), and validity dates.

This demo uses nmap.org because scanme.nmap.org accepts TCP on 443 but did not complete a TLS handshake in the August 2026 retest. Kali needs outbound DNS and HTTPS for this step — keep the NAT adapter enabled as described in the pentest lab setup.

Read the certificate on port 443:

bash
nmap -Pn -p 443 --script=ssl-cert nmap.org
output
Nmap scan report for nmap.org (50.116.1.184)
Host is up (0.0024s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-cert: Subject: commonName=insecure.com
| Subject Alternative Name: DNS:insecure.com, DNS:nmap.org, DNS:www.nmap.org, ...
| Issuer: commonName=YR1/organizationName=Let's Encrypt/countryName=US
| Not valid before: 2026-07-20T09:07:57
|_Not valid after:  2026-10-18T09:07:56

Nmap done: 1 IP address (1 host up) scanned in 1.00 seconds

The subject and SAN lines list hostnames tied to the certificate. Compare the validity window to your engagement date and feed any new names into DNS follow-up. On Metasploitable, port 443 is closed in the default image, so use an in-scope HTTPS service when you practice this script on lab VMs.

ssl-enum-ciphers is a more intrusive follow-up that negotiates cipher suites. Read --script-help and your scope before you run it; it is not part of the default enumeration workflow in this lesson.

FTP enumeration with NSE

Metasploitable runs vsftpd on port 21. The ftp-anon script is tagged default, auth, and safe — it reports whether anonymous login is allowed without uploading files:

bash
nmap -n -Pn --script=ftp-anon -p 21 "$TARGET"
output
Nmap scan report for 192.168.56.127
Host is up (0.0011s latency).

PORT   STATE SERVICE
21/tcp open  ftp
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
MAC Address: 08:00:27:33:AF:98 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 0.20 seconds

Anonymous FTP login allowed is a direct misconfiguration finding. Record it in your notes and verify with manual ftp or smbclient-style browsing only when your scope includes file-share testing.

SMB enumeration on Metasploitable

Metasploitable exposes Samba on TCP 445. Start with smb-protocols, which is tagged safe and discovery and usually returns dialect information even when OS discovery scripts stay quiet:

bash
nmap -n -Pn --script=smb-protocols -p 445 "$TARGET"
output
Nmap scan report for 192.168.56.127
Host is up (0.0010s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds
MAC Address: 08:00:27:33:AF:98 (Oracle VirtualBox virtual NIC)

Host script results:
| smb-protocols: 
|   dialects: 
|_    NT LM 0.12 (SMBv1) [dangerous, but default]

Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds

SMBv1 on a lab VM is expected and worth recording for hardening reports. Nmap flags it as dangerous because production networks should disable the dialect.

smb-os-discovery can add workgroup and OS strings on other targets, but it may return no extra lines on Metasploitable when anonymous metadata is limited. Do not default to smb-enum-users for introductory enumeration — it is tagged auth and intrusive and can perform noisy RID or LSA queries. Use SMTP and SMB enumeration with enum4linux or smbclient when you need share and user lists on this image.

Pass custom arguments with --script-args

Some scripts accept arguments documented in --script-help. Set a custom HTTP user agent when a WAF blocks the default Nmap string:

bash
nmap -Pn --script-args=http.useragent=NmapLabScan --script=http-title -p 80 "$SCAN_HOST"
output
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.0027s latency).

PORT   STATE SERVICE
80/tcp open  http
|_http-title: Go ahead and ScanMe!

Nmap done: 1 IP address (1 host up) scanned in 1.66 seconds

DNS scripts use the same mechanism. For dns-zone-transfer, dns-brute, and dns-nsid, pass domain and server arguments as documented in --script-help and your DNS enumeration notes rather than repeating full AXFR examples here.

General syntax:

Pattern Example
Single argument --script-args http.useragent=MyScanner
Multiple arguments --script-args http.useragent=MyScanner,http.max-cache-size=500000
Script-specific prefix --script-args dns-brute.domain=example.com

Argument names are script- or library-specific. user and pass are not universal keys — read --script-help for the script you run.

Save NSE output for reporting

Combine scripts with -oA when you need normal, XML, and grepable files in one pass:

bash
nmap -Pn -oA scanme-nse --script=banner,http-title -p 22,80 "$SCAN_HOST"

The terminal transcript matches the individual banner and http-title runs earlier in this lesson. Nmap also writes scanme-nse.nmap, scanme-nse.xml, and scanme-nse.gnmap in the current directory. Paste script blocks from the .nmap file into reports, or parse .xml with your team's tooling.

Name scripts explicitly in automation instead of running entire categories against large subnets:

bash
nmap -Pn -sV --script=banner,http-title,ssh-hostkey -p 22,80,443 -iL targets.txt -oA client-enum-pass1

Replace targets.txt with an in-scope host list. Split large jobs by service (-p 22,2222 for SSH scripts, -p 80,443,8080 for HTTP) so a single runaway script does not block the whole engagement.

DNS NSE scripts (scope note)

DNS enumeration belongs in its own phase. Nmap ships dns-brute, dns-zone-transfer, dns-nsid, and related scripts under /usr/share/nmap/scripts/. Run those against authorized zones and nameservers with the procedures in DNS enumeration, including dns-brute.domain and dns-zone-transfer.domain arguments for AXFR and subdomain brute force.

Service-level NSE on open ports and DNS NSE on port 53 complement each other. Finish DNS host discovery first, then port-scan the names you confirm.

NSE enumeration lab exercise

Use Metasploitable as $TARGET and answer these questions before you scroll to the command hints:

  1. Which ports expose FTP, SSH, HTTP, and SMB?
  2. Does FTP permit anonymous access?
  3. Which SSH algorithms does the server offer?
  4. Which web page title and Server header appear on port 80?
  5. Which SMB protocol versions are supported on port 445?
  6. Save all script output with -oA for your notes.

Work through the list in order. A port scan confirms which services are listening before you run service-specific scripts.

Command hints

Confirm the four service ports first:

bash
nmap -n -Pn -p 21,22,80,445 --open "$TARGET"
output
Nmap scan report for 192.168.56.127
Host is up (0.00074s latency).

PORT    STATE SERVICE
21/tcp  open  ftp
22/tcp  open  ssh
80/tcp  open  http
445/tcp open  microsoft-ds
MAC Address: 08:00:27:33:AF:98 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 0.16 seconds

All four ports should report open before you run service scripts. Use the scripts from this lesson on the matching port:

Service Script Port
FTP ftp-anon 21
SSH ssh2-enum-algos 22
HTTP http-title, http-headers 80
SMB smb-protocols 445

Example for FTP (repeat the pattern for the other rows):

bash
nmap -n -Pn --script=ftp-anon -p 21 "$TARGET"

Save a combined transcript when every script has run:

bash
nmap -n -Pn -oA ms2-nse-lab --script=ftp-anon,ssh2-enum-algos,http-title,http-headers,smb-protocols -p 21,22,80,445 "$TARGET"

Nmap writes ms2-nse-lab.nmap, .xml, and .gnmap in the current directory.

Expected findings on Metasploitable 2

Question What you should see
Open ports 21, 22, 80, 445
FTP anonymous access Anonymous FTP login allowed from ftp-anon
SSH algorithms Legacy KEX, ssh-rsa / ssh-dss, CBC and arcfour ciphers in ssh2-enum-algos
HTTP Title Metasploitable2 - Linux; Server: Apache/2.2.8 (Ubuntu) DAV/2
SMB dialects SMBv1 (NT LM 0.12) flagged by smb-protocols
Saved files ms2-nse-lab.nmap, .xml, and .gnmap in the working directory

Troubleshooting

Symptom Likely cause Fix
No script output under an open port Script does not apply to that service, authentication failed, or Kali is not on the same host-only segment as the target Confirm port and service with -sV; verify curl -I http://$TARGET/ or an SSH banner from Kali; read --script-help; try a script-specific argument
smb-protocols reports no dialects accepted SMB handshake blocked or asymmetric routing Confirm Kali and Metasploitable share one host-only adapter; retry with -sT and --script-timeout 60s
Scan hangs after No profinet devices Broad discovery category with broadcast scripts Cancel and rerun with explicit script names or discovery and safe on selected -p ports
smb-os-discovery empty on Samba Anonymous session limits or script timing Try smb-protocols first; retry with --script-timeout 60s if needed
Script category not found Typo in boolean expression Quote the expression: --script "http-* and safe"
Different results than -sV alone Scripts use separate probes Treat both outputs as hints; verify manually on critical services
scanme.nmap.org stops responding Rate or policy limit Wait and retry later; keep demos to a dozen light scans per day
ssl-cert empty on port 443 Target accepts TCP but TLS negotiation fails Retry on a host with working HTTPS such as nmap.org, or an in-scope lab HTTPS service

Summary

You used the Nmap Scripting Engine to automate service enumeration on authorized targets: preview scripts with --script-help, run the default set alongside -sV on scanme.nmap.org, and call individual scripts for SSH (ssh-hostkey, ssh2-enum-algos), HTTP (http-title, http-headers), TLS (ssl-cert on nmap.org), FTP (ftp-anon), and SMB (smb-protocols).

On Metasploitable you confirmed anonymous FTP, legacy SSH algorithms, the Apache web title and header, and SMBv1 support — the service-specific results beginners search for when they look up NSE examples. The lab exercise ties those scripts into one ordered workflow with -oA export.

Category selection is the main guardrail. Review --script-help for each script you run, and stay within categories your scope allows. Pass --script-args when a script documents custom domains, user agents, or other supported options, and export with -oA when you need structured evidence.

After service NSE, feed confirmed hostnames and versions into vulnerability research only on systems you are allowed to test. For flag reminders during live scans, keep the Nmap command cheat sheet open beside this walkthrough.

References

Frequently Asked Questions

What is the Nmap Scripting Engine (NSE)?

NSE extends Nmap with Lua scripts that run after port scanning or host discovery. Each script belongs to one or more categories such as safe, discovery, or default. Scripts query services for banners, titles, certificates, SMB details, and other facts you would otherwise collect manually.

Which NSE categories are safe for enumeration?

Start with individually reviewed default, safe, or discovery scripts on authorized targets. Category membership is not a substitute for reading the script documentation. Avoid brute, exploit, intrusive, and vuln categories unless your written scope explicitly allows them and you understand the traffic each script generates.

How do I pass arguments to an NSE script?

Use --script-args with scriptname.argument=value syntax. Separate multiple arguments with commas. Run nmap --script-help scriptname to list supported arguments before you scan production or client systems.

What is the difference between --script default and --script discovery?

default runs the curated script set Nmap ships for routine service fingerprinting on open ports when you use -sC. discovery is a broader category that includes host and service enumeration helpers. discovery can take longer and may run broadcast helpers on local subnets, so limit ports and hosts when you use it.

Where do DNS NSE scripts belong in a pentest workflow?

DNS-focused scripts such as dns-brute, dns-zone-transfer, and dns-nsid belong in the DNS enumeration phase. This guide covers service-level NSE on open ports. Use your DNS enumeration workflow for zone transfers and subdomain brute force before you widen port scans.

Can I run NSE against scanme.nmap.org?

scanme.nmap.org is an authorized public practice target. The Nmap project asks you to keep scan volume low, avoid denial-of-service traffic, and skip exploit scripts there. Use it for a handful of safe enumeration demos per day, not full-category sweeps.

Finished reading?Beta Get the key takeaways in seconds, then ask follow-up questions
Deepak Prasad

R&D Engineer

Founder of GoLinuxCloud with 15+ years of expertise in Linux, Python, Go, Laravel, DevOps, Kubernetes, Git, Shell scripting, OpenShift, AWS, Networking, and Security. With extensive experience, he excels across development, DevOps, networking, and security, delivering robust and efficient solutions for diverse projects.

Expertise
  • Go (programming language)
  • Python (programming language)
  • DevOps
  • Computer Security
  • Cloud Computing
  • Kubernetes
  • Linux
  • Ansible (software)

Related Articles

security

SMTP and SMB Enumeration on Kali Linux

Enumerate SMTP users and SMB shares on Metasploitable 2 with smtp-user-enum, NetExec, enum4linux, and …

14 min readsecurity

Network Sniffing with Wireshark and tcpdump on Kali Linux

Capture and analyze Metasploitable 2 HTTP traffic with tcpdump and tshark on Kali Linux, then open the pcap in …

14 min readsecurity

Banner Grabbing and Service Enumeration on Kali Linux

Learn banner grabbing on Kali Linux with Nmap, Netcat, curl, and HTTP examples. Identify SSH, FTP, SMTP, and …

16 min read