Skip to content
HackIndex logo

HackIndex

Nmap Vulnerability Scanning (NSE)

1 min read Jan 4, 2026

This page covers host-level vulnerability discovery using Nmap NSE vulnerability scripts.
The goal is to identify known weaknesses in exposed services without exploitation.

This page assumes:

  • hosts are already discovered

  • open ports are known (from Active Reconnaissance)

Vulnerability scan using NSE

Run known vulnerability detection scripts

┌──(kali㉿kali)-[~]
└─$ nmap --script vuln -T3 $TARGET_IP

This runs a curated set of scripts that:

  • check for known CVEs

  • detect common service misconfigurations

  • perform non-exploitative probing

Targeted vulnerability scanning

Limit vulnerability scripts to known open ports

┌──(kali㉿kali)-[~]
└─$ nmap --script vuln -p $OPEN_PORTS -T3 $TARGET_IP

Example:

┌──(kali㉿kali)-[~]
└─$ nmap --script vuln -p 22,80,443,445 -T3 $TARGET_IP

Reduces noise and false positives.

TLS / SSL vulnerability discovery

Identify weak SSL/TLS configurations

┌──(kali㉿kali)-[~]
└─$ nmap --script ssl-* -p 443,8443 $TARGET_IP

Detects:

  • deprecated protocols

  • weak cipher suites

  • invalid certificates

SMB vulnerability discovery

Check SMB services for known vulnerabilities

┌──(kali㉿kali)-[~]
└─$ nmap --script smb-vuln* -p 445 $TARGET_IP

Includes:

  • MS17-010

  • SMB signing issues

Output handling

Save vulnerability results

┌──(kali㉿kali)-[~]
└─$ nmap --script vuln -oN ${TARGET_NAME}_vulns.txt $TARGET_IP

References