Skip to content
HackIndex logo

HackIndex

Nmap Service Enumeration (NSE)

2 min read Mar 30, 2026

This page focuses on deep host and service enumeration using NMAP NSE scripts.
The goal is to extract detailed information by actively interacting with exposed services.

Nmap

Nmap script types

Category

Purpose

Risk

default

Basic enumeration

Safe

safe

Non-intrusive checks

Safest

discovery

Service, protocol & feature discovery

Low

version

Deep version & metadata extraction

Low - Medium

auth

Authentication mechanism discovery

Medium

intrusive

Aggressive/bruteforce

Dangerous

Baseline enumeration

Run default enumeration scripts

┌──(kali㉿kali)-[~]
└─$ nmap --script default -T3 $TARGET_IP
Explain command
--script default Runs the default set of NSE scripts for common enumeration tasks.
-T3 Sets timing template to 'Normal' for balanced speed and reliability.
$TARGET_IP Placeholder for the target host IP address to scan.

Provides:

  • basic service metadata

  • protocol capabilities

  • banner-level information

Authentication enumeration

Identify authentication mechanisms and weaknesses

┌──(kali㉿kali)-[~]
└─$ nmap --script auth -T3 $TARGET_IP
Explain command
--script auth Runs all scripts in the 'auth' category to test authentication methods.
-T3 Sets timing template to 3 (normal), balancing speed and reliability.
$TARGET_IP Placeholder for the target host IP address to scan.

Finds:

  • anonymous access

  • supported auth methods

  • misconfigured authentication

Service discovery enumeration

Enumerate protocol features and exposed functionality

┌──(kali㉿kali)-[~]
└─$ nmap --script discovery -T3 $TARGET_IP
Explain command
--script discovery Run all scripts in the 'discovery' category to gather target info.
-T3 Set timing template to 3 (normal speed, default balance).
$TARGET_IP Placeholder for the target host IP address to scan.

Version-based enumeration

Extract extended service and protocol details

┌──(kali㉿kali)-[~]
└─$ nmap --script version -T3 $TARGET_IP
Explain command
--script version Runs NSE scripts in the 'version' category for enhanced version detection.
-T3 Sets timing template to 'Normal' (default speed, balanced aggressiveness).
$TARGET_IP Placeholder for the target host IP address to scan.

Useful when -sV output is incomplete.

Intrusive enumeration (high risk)

┌──(kali㉿kali)-[~]
└─$ nmap --script intrusive -T3 $TARGET_IP
Explain command
--script intrusive Run all scripts in the 'intrusive' category, which may affect the target.
-T3 Sets timing template to 'Normal' (default speed, balanced aggressiveness).
$TARGET_IP Placeholder for the target host IP address to scan.

Examples:

  • aggressive feature probing

  • partial brute-force behavior

  • protocol fuzzing

Output handling

Save enumeration results

┌──(kali㉿kali)-[~]
└─$ nmap --script auth,discovery -oN ${TARGET_NAME}_enum.txt $TARGET_IP
Explain command
--script auth,discovery Runs NSE scripts in the 'auth' and 'discovery' categories.
-oN ${TARGET_NAME}_enum.txt Saves output in normal format to a file named after the target.
$TARGET_IP Placeholder for the target host's IP address.

References