Skip to content
HackIndex.io

Nmap Service Enumeration (NSE)

5 min read Created Dec 29, 2025 Last updated Mar 30, 2026

This page focuses on deep host and service enumeration using NMAP NSE scripts.
The goal is to extract detailed information by actively interacting with exposed services.

NSE scripts run after the port scan completes. They speak the target service protocol and parse real responses. Each category carries a different noise level and risk profile. Start conservative. Escalate only when the lower category does not give you enough detail to decide what to do next.

Nmap port version detection and NSE scripts

Nmap script types

Category

Purpose

Risk

default

Basic enumeration

Safe

safe

Non-intrusive checks

Safest

discovery

Service, protocol & feature discovery

Low

version

Deep version & metadata extraction

Low - Medium

auth

Authentication mechanism discovery

Medium

intrusive

Aggressive/bruteforce

Dangerous

Run default first on every host. It covers the most common scripts with minimal noise. Use auth when you need to identify what login mechanisms are exposed. Use discovery when you want a full picture of protocol features and supported options. Use version when -sV returns a generic or incomplete string. Reserve intrusive for isolated lab targets only.

Baseline enumeration

Run default enumeration scripts against each open port. This is your starting point for every host.

┌──(kali㉿kali)-[~]
└─$ nmap --script default -T3 $TARGET_IP
Explain command
--script default Runs the default set of NSE scripts for common enumeration tasks.
-T3 Sets timing template to 'Normal' for balanced speed and reliability.
$TARGET_IP Placeholder for the target host IP address to scan.

Default scripts return service banners, protocol state, and feature flags. Look for version strings in the banner output. These feed directly into searchsploit and CVE database lookups. Services that return no banner likely have banner suppression configured or are filtered upstream. SMB signing status, SSH host key algorithms, and HTTP server headers all appear in default output.

Provides:

  • basic service metadata

  • protocol capabilities

  • banner-level information

Cross-reference version strings against a CVE database before continuing. A single version string from a banner can surface a direct exploit path.

Authentication enumeration

Identify authentication mechanisms and weaknesses on each open service.

┌──(kali㉿kali)-[~]
└─$ nmap --script auth -T3 $TARGET_IP
Explain command
--script auth Runs all scripts in the 'auth' category to test authentication methods.
-T3 Sets timing template to 3 (normal), balancing speed and reliability.
$TARGET_IP Placeholder for the target host IP address to scan.

Auth scripts probe authentication endpoints and report what they accept. Anonymous FTP access and LDAP anonymous bind are the most common findings. If a service allows anonymous access, immediately enumerate what it exposes. Supported auth method lists matter for credential attacks: a service advertising only NTLM gives a different attack surface than one supporting Kerberos or basic auth.

Finds:

  • anonymous access

  • supported auth methods

  • misconfigured authentication

Misconfigured auth often means default credentials are still active or access is entirely unauthenticated. Verify manually before treating it as exploitable. Auth scripts do not attempt credentials by default.

Service discovery enumeration

Enumerate protocol features and exposed functionality across all open ports.

┌──(kali㉿kali)-[~]
└─$ nmap --script discovery -T3 $TARGET_IP
Explain command
--script discovery Run all scripts in the 'discovery' category to gather target info.
-T3 Set timing template to 3 (normal speed, default balance).
$TARGET_IP Placeholder for the target host IP address to scan.

Discovery scripts map what each service exposes beyond the port and banner. This includes DNS zone information, SNMP community strings, HTTP paths and titles, NFS exports, and RPC endpoints. The output builds an attack surface map for the full host. Pay attention to services that expose more than expected: an internal HTTP title, a filesystem path in an NFS export, or an SNMP community string can all pivot the engagement.

Version-based enumeration

Extract extended service and protocol details beyond what -sV alone returns.

┌──(kali㉿kali)-[~]
└─$ nmap --script version -T3 $TARGET_IP
Explain command
--script version Runs NSE scripts in the 'version' category for enhanced version detection.
-T3 Sets timing template to 'Normal' (default speed, balanced aggressiveness).
$TARGET_IP Placeholder for the target host IP address to scan.

Version scripts go deeper than -sV. They probe service internals and return build metadata, library versions, and protocol negotiation details. This is useful when -sV output is incomplete. A generic string like Apache httpd without a version number often resolves to an exact version after running these scripts. Target them at specific ports where you need version accuracy to confirm whether a known CVE applies.

Intrusive enumeration (high risk)

┌──(kali㉿kali)-[~]
└─$ nmap --script intrusive -T3 $TARGET_IP
Explain command
--script intrusive Run all scripts in the 'intrusive' category, which may affect the target.
-T3 Sets timing template to 'Normal' (default speed, balanced aggressiveness).
$TARGET_IP Placeholder for the target host IP address to scan.

Intrusive scripts make aggressive probes that can crash unstable services or trigger IDS and SIEM alerts. Some scripts run partial credential stuffing against authentication endpoints. Only run intrusive scripts on isolated lab targets or with explicit written permission covering the scope. If a service crashes under an intrusive scan, document it. Unstable services that fail under active probing are a finding worth reporting.

Examples:

  • aggressive feature probing

  • partial brute-force behavior

  • protocol fuzzing

Output handling

Always save enumeration output. Raw scan results are your evidence trail and your reference for later phases.

┌──(kali㉿kali)-[~]
└─$ nmap --script auth,discovery -oN ${TARGET_NAME}_enum.txt $TARGET_IP
Explain command
--script auth,discovery Runs NSE scripts in the 'auth' and 'discovery' categories.
-oN ${TARGET_NAME}_enum.txt Saves output in normal format to a file named after the target.
$TARGET_IP Placeholder for the target host's IP address.

Use -oX instead of -oN when you need to import results into other tools or parse them programmatically. Normal format is readable but not machine-parseable. Use -oG for grep-friendly output when working through a large subnet and extracting specific fields quickly. Store output files per target and per script category to avoid overwriting earlier results when you re-scan with a different category.

References