# Nmap Service Enumeration (NSE)

- **URL:** https://hackindex.io/services/hosts/enumeration/nmap-service-enumeration
- **Path:** Hosts > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/hosts/enumeration.md)
- **Published:** 2025-12-29
- **Updated:** 2026-03-30

This page focuses on **deep host and service enumeration** using **NMAP NSE scripts**.  
The goal is to **extract detailed information** by actively interacting with exposed services.

NSE scripts run after the port scan completes. They speak the target service protocol and parse real responses. Each category carries a different noise level and risk profile. Start conservative. Escalate only when the lower category does not give you enough detail to decide what to do next.

## Nmap port version detection and NSE scripts

Nmap script types

| Category | Purpose | Risk |
| --- | --- | --- |
| default | Basic enumeration | Safe |
| safe | Non-intrusive checks | Safest |
| discovery | Service, protocol & feature discovery | Low |
| version | Deep version & metadata extraction | Low - Medium |
| auth | Authentication mechanism discovery | Medium |
| intrusive | Aggressive/bruteforce | Dangerous |

Run `default` first on every host. It covers the most common scripts with minimal noise. Use `auth` when you need to identify what login mechanisms are exposed. Use `discovery` when you want a full picture of protocol features and supported options. Use `version` when `-sV` returns a generic or incomplete string. Reserve `intrusive` for isolated lab targets only.

### Baseline enumeration

Run default enumeration scripts against each open port. This is your starting point for every host.

```bash
nmap --script default -T3 $TARGET_IP
```

Default scripts return service banners, protocol state, and feature flags. Look for version strings in the banner output. These feed directly into searchsploit and CVE database lookups. Services that return no banner likely have banner suppression configured or are filtered upstream. SMB signing status, SSH host key algorithms, and HTTP server headers all appear in default output.

Provides:

- basic service metadata
- protocol capabilities
- banner-level information

Cross-reference version strings against a CVE database before continuing. A single version string from a banner can surface a direct exploit path.

### Authentication enumeration

Identify authentication mechanisms and weaknesses on each open service.

```bash
nmap --script auth -T3 $TARGET_IP
```

Auth scripts probe authentication endpoints and report what they accept. Anonymous FTP access and LDAP anonymous bind are the most common findings. If a service allows anonymous access, immediately enumerate what it exposes. Supported auth method lists matter for credential attacks: a service advertising only NTLM gives a different attack surface than one supporting Kerberos or basic auth.

Finds:

- anonymous access
- supported auth methods
- misconfigured authentication

Misconfigured auth often means default credentials are still active or access is entirely unauthenticated. Verify manually before treating it as exploitable. Auth scripts do not attempt credentials by default.

### Service discovery enumeration

Enumerate protocol features and exposed functionality across all open ports.

```bash
nmap --script discovery -T3 $TARGET_IP
```

Discovery scripts map what each service exposes beyond the port and banner. This includes DNS zone information, SNMP community strings, HTTP paths and titles, NFS exports, and RPC endpoints. The output builds an attack surface map for the full host. Pay attention to services that expose more than expected: an internal HTTP title, a filesystem path in an NFS export, or an SNMP community string can all pivot the engagement.

### Version-based enumeration

Extract extended service and protocol details beyond what `-sV` alone returns.

```bash
nmap --script version -T3 $TARGET_IP
```

Version scripts go deeper than `-sV`. They probe service internals and return build metadata, library versions, and protocol negotiation details. This is useful when `-sV` output is incomplete. A generic string like `Apache httpd` without a version number often resolves to an exact version after running these scripts. Target them at specific ports where you need version accuracy to confirm whether a known CVE applies.

### Intrusive enumeration (high risk)

> [!CAUTION]
> Aggressive probing: may trigger alerts or break services (not recommended)

```bash
nmap --script intrusive -T3 $TARGET_IP
```

Intrusive scripts make aggressive probes that can crash unstable services or trigger IDS and SIEM alerts. Some scripts run partial credential stuffing against authentication endpoints. Only run intrusive scripts on isolated lab targets or with explicit written permission covering the scope. If a service crashes under an intrusive scan, document it. Unstable services that fail under active probing are a finding worth reporting.

Examples:

- aggressive feature probing
- partial brute-force behavior
- protocol fuzzing

## Output handling

Always save enumeration output. Raw scan results are your evidence trail and your reference for later phases.

```bash
nmap --script auth,discovery -oN ${TARGET_NAME}_enum.txt $TARGET_IP
```

Use `-oX` instead of `-oN` when you need to import results into other tools or parse them programmatically. Normal format is readable but not machine-parseable. Use `-oG` for grep-friendly output when working through a large subnet and extracting specific fields quickly. Store output files per target and per script category to avoid overwriting earlier results when you re-scan with a different category.

## References

- [NMAP default scripts](https://nmap.org/nsedoc/categories/default.html) - Shows all default NSE scripts
- [NMAP safe scripts](https://nmap.org/nsedoc/categories/safe.html) - Shows all safe NSE scripts
- [NMAP discovery scripts](https://nmap.org/nsedoc/categories/discovery.html) - Shows all discovery NSE scripts
- [NMAP version scripts](https://nmap.org/nsedoc/categories/version.html) - Shows all version NSE scripts
- [NMAP auth scripts](https://nmap.org/nsedoc/categories/auth.html) - Shows all auth NSE scripts
- [NMAP intrusive scripts](https://nmap.org/nsedoc/categories/intrusive.html) - Shows all intrusive NSE scripts