Nmap NSE deep dive: script your own lab
Most people stop at nmap -sV. The real power is the Nmap Scripting Engine (NSE): 600-odd small scripts that go past "which ports are open" and ask "what is running, how is it configured, and is any of it weak". This mission is a hands-on tour of NSE against a target built to be broken, OWASP Juice Shop, running on your own machine. You learn what the script categories mean, run default, discovery and vuln scripts against the lab box, read the output (including a textbook false positive the vuln category reports), customise a script with its own arguments, and learn which categories are safe to run and which can take a server down. Everything here points at 127.0.0.1, a practice target you start yourself. It sits alongside Build a hacking lab and Harden a Linux server: those stand up and lock down a box, this one teaches the scanner's deep end.
- You run everything from a Linux-style terminal. On Windows that means WSL2 (the slim Linux built into Windows), where nmap and the target both live. On Linux or a Mac, your normal terminal is that place. If terminals are new to you, the Level 0: the basics track covers finding your way around one
- nmap, the scanner, installed in that terminal (step 3 installs it in one line). It is free and open source, and it ships with the whole NSE script library
- A way to run the target: either Docker (if you did Build a hacking lab you already have it), or Node, used here to run OWASP Juice Shop's official package without Docker. Step 2 shows both
- About 1GB of free disk space for the target and its dependencies. Seeing what your own machine already talks to in See which servers and countries your PC talks to is useful background, but not required
What NSE is, and the one rule that never bends
Understand what the Nmap Scripting Engine adds on top of a port scan, and fix in your mind that it only ever points at targets you own or are authorised to test.
A plain nmap scan answers one question: which ports on this machine are open. A scan with service and version detection (the
-sVoption) goes one step further and names the software behind each open port. The Nmap Scripting Engine, NSE, is the step after that. It is a library of small programs, written in a language called Lua, that connect to an open port and do real work: read a web server's headers, list the files it exposes, ask an SSH server which logins it accepts, check a service against a list of known weaknesses. Each script is a.nsefile, and this one install ships over 600 of them.You run them with the
--scriptoption.nmap --script http-titleruns one;nmap --script vulnruns a whole category at once. The scripts turn nmap from a tool that tells you a door is open into one that tells you what is behind the door and whether it looks weak. That is why NSE is the part security professionals lean on, and it is the whole subject of this mission.Every script carries a label saying how aggressive it is, its category. Some only read (
safe). Some actively try to exploit a weakness or flood a service (exploit,dos). Running the wrong category against the wrong machine can crash it or trip every alarm it has. Learning the categories is learning which scripts are a quiet look and which are a loud shove, and that is most of using NSE responsibly.CarefulNSE is a probing tool, and probing a machine you do not own or have written permission to test is a criminal offence in the UK (the Computer Misuse Act 1990) and almost everywhere else, even if you cause no damage and were only looking. Thevuln,exploit,bruteanddoscategories are more serious still: they can take a service down or lock accounts. Everything in this mission points at 127.0.0.1, a target you start on your own machine. Keep it there. The only public machine you may practise against isscanme.nmap.org, which the Nmap project runs expressly so people can test the scanner, and even that only gently.TipOWASP Juice Shop, the target you use here, calls itself the most modern insecure web application on purpose. It is built by a security-education project to be attacked and broken as a training ground. That is what makes it lawful and useful to scan: it exists to be your practice dummy, and it runs entirely on your own machine.