Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

nmap --script default not running all the default scripts #1724

Closed
TerminalFi opened this issue Sep 4, 2019 · 1 comment
Closed

nmap --script default not running all the default scripts #1724

TerminalFi opened this issue Sep 4, 2019 · 1 comment
Assignees

Comments

@TerminalFi
Copy link

nmap pulls default scripts from the scripts.db file located in the folder where all NSE files reside. Here is a sample from that file that shows http-methods is include as a default script to run when default scripts are called.

Why are some of these scripts not returning results when using the default option?

Entry { filename = "http-default-accounts.nse", categories = { "auth", "discovery", "intrusive", } }
Entry { filename = "http-favicon.nse", categories = { "default", "discovery", "safe", } }
Entry { filename = "http-generator.nse", categories = { "default", "discovery", "safe", } }
Entry { filename = "http-git.nse", categories = { "default", "safe", "vuln", } }
Entry { filename = "http-ls.nse", categories = { "default", "discovery", "safe", } }
Entry { filename = "http-methods.nse", categories = { "default", "safe", } }
Entry { filename = "http-ntlm-info.nse", categories = { "default", "discovery", "safe", } }
Entry { filename = "http-open-proxy.nse", categories = { "default", "discovery", "external", "safe", } }
Entry { filename = "http-robots.txt.nse", categories = { "default", "discovery", "safe", } }
Entry { filename = "http-svn-enum.nse", categories = { "default", "discovery", "safe", } }
Entry { filename = "http-svn-info.nse", categories = { "default", "discovery", "safe", } }
Entry { filename = "http-title.nse", categories = { "default", "discovery", "safe", } }

However when running the two commands from nmap directly, they produce two different results.

Command: nmap --script http-methods -p443 example.com
Results:

nmap example.com -p443 --script http-methods
Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-04 12:38 EDT
Nmap scan report for example.com (93.184.216.34)
Host is up (0.015s latency).
Other addresses for example.com (not scanned): 2606:2800:220:1:248:1893:25c8:1946

PORT    STATE SERVICE
443/tcp open  https
| http-methods:
|_  Supported Methods: OPTIONS GET HEAD POST

Nmap done: 1 IP address (1 host up) scanned in 0.47 seconds

Command: nmap --script default -p443 example.com
Results:

nmap example.com -p443 --script default
Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-04 12:38 EDT
Nmap scan report for example.com (93.184.216.34)
Host is up (0.014s latency).
Other addresses for example.com (not scanned): 2606:2800:220:1:248:1893:25c8:1946

PORT    STATE SERVICE
443/tcp open  https
|_http-title: Example Domain
| ssl-cert: Subject: commonName=www.example.org/organizationName=Internet Corporation for Assigned Names and Numbers/stateOrProvinceName=California/countryName=US
| Subject Alternative Name: DNS:www.example.org, DNS:example.com, DNS:example.edu, DNS:example.net, DNS:example.org, DNS:www.example.com, DNS:www.example.edu, DNS:www.example.net
| Not valid before: 2018-11-28T00:00:00
|_Not valid after:  2020-12-02T12:00:00
|_ssl-date: TLS randomness does not represent time
| tls-alpn:
|   h2
|_  http/1.1
| tls-nextprotoneg:
|   h2
|   http/1.1
|_  http/1.0

Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
@nnposter
Copy link

nnposter commented Sep 4, 2019

The scripts are in fact running. The issue appears to be that your target has some throttling in place so the scripts are failing due to communication errors. You might find having better success if you run fewer scripts than the full default group or if you decrease nmap intensity with option -T1.

This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants