.

Nmap Scripts?

<<

KrisTeason

User avatar

Hero Member
Hero Member

Posts: 515

Joined: Sat Sep 08, 2007 7:48 pm

Location: /dev/null

Post Thu Mar 11, 2010 2:32 am

Nmap Scripts?

Hey everyone,

I was going through some of my collection of pen-testing videos and noticed that nmap scripts aren't typically being used - is there a particular reason for this? I hear a couple of them are unsafe and a little noisy.

I was just wondering - is there a favorite or a couple favorite scripts that you guys use with nmap scripts ("--script option") when doing pen-tests? Which seem to be musts in your nmap scans, if any?

-Kris
Last edited by KrisTeason on Thu Mar 11, 2010 2:34 am, edited 1 time in total.
eCPPT (Silver/Gold), eWPT, GSEC, GISP, GCIH, OSCP, OSWP
<<

LT72884

User avatar

Jr. Member
Jr. Member

Posts: 99

Joined: Thu Oct 15, 2009 3:11 pm

Location: Utah

Post Thu Mar 11, 2010 5:46 pm

Re: Nmap Scripts?

xXxKrisxXx wrote:Hey everyone,

I was going through some of my collection of pen-testing videos and noticed that nmap scripts aren't typically being used - is there a particular reason for this? I hear a couple of them are unsafe and a little noisy.

I was just wondering - is there a favorite or a couple favorite scripts that you guys use with nmap scripts ("--script option") when doing pen-tests? Which seem to be musts in your nmap scans, if any?

-Kris


i was wondering this very thing. i watched a video at purehates blog, and it shows him using netdiscovery tool on BT3, well BT4 does not have that same tool. i was hoping that i could write my own script that uses nmap commands to basically find just alive hosts. Im assuming this netdiscovery tool was a auto script for nmap..
<<

KrisTeason

User avatar

Hero Member
Hero Member

Posts: 515

Joined: Sat Sep 08, 2007 7:48 pm

Location: /dev/null

Post Thu Mar 11, 2010 6:04 pm

Re: Nmap Scripts?

I want to say Autoscan does the same thing. It's in Backtrack -> Network Mapping ->All -> Autoscan

I remember seeing a blog over on Skull-Security it looked interesting running scripts with nmap, looks like it could further information gathering on a target more.

Thanks for the response, I was going to bump this thread since it wasn't getting any attention.  :P
Last edited by KrisTeason on Thu Mar 11, 2010 6:08 pm, edited 1 time in total.
eCPPT (Silver/Gold), eWPT, GSEC, GISP, GCIH, OSCP, OSWP
<<

LT72884

User avatar

Jr. Member
Jr. Member

Posts: 99

Joined: Thu Oct 15, 2009 3:11 pm

Location: Utah

Post Thu Mar 11, 2010 6:13 pm

Re: Nmap Scripts?

xXxKrisxXx wrote:Are you talking about the GUI tool he uses to auto-detect hosts in his videos? If so -  I think the tool he's using is Autoscan. It's in Backtrack -> Network Mapping ->All -> Autoscan

I remember seeing a blog over on Skull-Security it looked interesting running scripts with nmap, looks like it could further information gathering on a target more.

Thanks for the response, I was going to bump this thread since it wasn't getting any attention.  :P


lol, nope not the GUI. it runs it in a shell. He uses it in his de-ice 1.100 part one video. its in the same folder as autoscan but its called netdiscovery..

as per your other post, im not at all familur with nmap except nmap -sV. hahaha. i just barely started learning bout this stuff. However i do like some of the options that nmap can supposedly do. I wanna test it against my IDS and see if it flags it.
Last edited by LT72884 on Thu Mar 11, 2010 6:51 pm, edited 1 time in total.
<<

LT72884

User avatar

Jr. Member
Jr. Member

Posts: 99

Joined: Thu Oct 15, 2009 3:11 pm

Location: Utah

Post Fri Mar 12, 2010 1:11 am

Re: Nmap Scripts?

I googled around for a bit and the only info i could find at this point in time was the NSE or nmap scripting engine. Nesus apparently uses this as well. I tried googleing "when not to use nmap" not to many hits on that.
<<

j0rDy

User avatar

Hero Member
Hero Member

Posts: 591

Joined: Tue Feb 23, 2010 4:55 am

Location: Netherlands

Post Fri Mar 12, 2010 4:56 am

Re: Nmap Scripts?

at first i missed netdiscovery also in the new BT4, but good alternatives are available like autscan. remember that nmap can search subnets just as easy with the ip.address/<subnet number) tag! this provides a list with all computers that are responding/up.
CISSP, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1662

Joined: Mon Jan 29, 2007 2:59 pm

Post Fri Mar 12, 2010 8:33 am

Re: Nmap Scripts?

LT72884 wrote:I googled around for a bit and the only info i could find at this point in time was the NSE or nmap scripting engine. Nesus apparently uses this as well. I tried googleing "when not to use nmap" not to many hits on that.


There really aren't tons of reasons NOT to use nmap.  The nice thing is that it's small, easy to use, and those who maintain it continue to add great functionality, with each new release.  It's a well documented tool, with a HUGE following, and thus, it's sort of a 'defacto' standard.  While I use other tools (like autoscan, etc,) nmap is a MUST have in my arsenal.
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
<<

j0rDy

User avatar

Hero Member
Hero Member

Posts: 591

Joined: Tue Feb 23, 2010 4:55 am

Location: Netherlands

Post Fri Mar 12, 2010 8:48 am

Re: Nmap Scripts?

nmap is GREAT! no reason not to use it, ever! just remember to always double check your findings, so using another tool is always recommended!
CISSP, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net
<<

MosGuy

Newbie
Newbie

Posts: 10

Joined: Thu Oct 11, 2007 6:37 pm

Location: Niagara Falls, Canada

Post Sun Mar 14, 2010 4:09 am

Re: Nmap Scripts?

LT72884 wrote:i was wondering this very thing. i watched a video at purehates blog, and it shows him using netdiscovery tool on BT3, well BT4 does not have that same tool.


With Bt4 in a shell using: netdiscover (or netdiscover -h) works fine for me. AutoScan is good too, for speed I typically use netdiscover
A+, Network+
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Sun Mar 14, 2010 11:44 pm

Re: Nmap Scripts?

I can think of one to not use NMAP. If you have to go through a 2-wire system, and not in a position to control it.

I've ran nmap from home a couple of times, while at work, against the external ip addresses for work. Usually, to make sure I didn't mess up the firewall configuration for inbound traffic on the IP. (I limit ports both in and out of the company).

The times, I've done it, the system at home has shut down the Network and TV. It claims to have found a router behind the 2-wire router, and puts the computer I do remote work with into a DMZ.

Usually stays broken, and leaves my computer accessible to the world, until I get home. The other systems on the network don't work either.

It would be an interesting DOS attack to try in a pen-test, if the test called for it.
OSWP, Sec+

Return to Network Pen Testing

Who is online

Users browsing this forum: No registered users and 2 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software